Create a Custom AWS VPC: Wizard and Manual Configuration

Purpose of This Lesson

This hands-on lesson demonstrates two ways to create an Amazon Virtual Private Cloud (VPC):

• The VPC and more wizard, which quickly creates a multi-subnet network.
• A manual configuration, which exposes how VPC components integrate.

The manual workflow creates a custom VPC with public and private subnets across two Availability Zones, separate route tables, an internet gateway, automatic public IPv4 assignment for public subnets, and an EC2 connectivity test.

Key Concepts

Default VPC versus custom VPC

AWS provides a default VPC in enabled Regions. The default VPC includes subnets across the Region’s Availability Zones, and those subnets are configured as public subnets. This makes it convenient to launch resources quickly.

A custom VPC is appropriate when you need control over:

• The VPC IPv4 CIDR block
• Subnet boundaries and placement
• Public and private network tiers
• Route-table associations
• Internet connectivity
• IP address assignment behavior

Availability Zones and Availability Zone IDs

Availability Zone names, such as us-east-1a, can be mapped differently between AWS accounts. Availability Zone IDs identify the underlying Availability Zone consistently and are useful when resources must be deliberately separated across accounts.

Public subnet requirements

A subnet is not public merely because it is named “public.” Resources in the subnet need:

1. A route table with a default route to an internet gateway.
2. A public IPv4 address, either automatically assigned or configured during launch.
3. Security-group rules permitting the required traffic.

Private subnet requirements

A private subnet should not have a route to an internet gateway. If private resources need outbound internet access, a NAT gateway can be introduced, but the lesson notes that NAT gateways can incur charges after applicable free-tier usage.

VPC Creation Workflows

Option 1: VPC and more wizard

The VPC and more wizard creates several related components for you. In the demonstration, the configuration included:

• A custom VPC name
• Three Availability Zones
• Public and private subnets in each Availability Zone
• DNS hostnames enabled
• DNS resolution enabled
• No NAT gateway
• No Amazon S3 gateway endpoint

The wizard also creates and associates route tables, creates an internet gateway, attaches it to the VPC, and adds the relevant internet-gateway route for the public networking configuration.

The wizard is fast and useful when the generated architecture matches your needs. However, reviewing the resulting subnets, route tables, associations, and routes is still important.

Option 2: Manual VPC configuration

The manual workflow used a VPC named my VPC and an IPv4 CIDR block supplied by the course materials. The resulting subnet plan was:

Subnet	Availability Zone	CIDR block	Intended tier
public 1A	us-east-1a	10.0.1.0/24	Public
public 1B	us-east-1b	10.0.2.0/24	Public
private 1A	us-east-1a	10.0.3.0/24	Private
private 1B	us-east-1b	10.0.4.0/24	Private

The important design principle is that public and private subnets require different routing behavior, even when they share the same VPC.

Technical / Operational Context

1. Create the VPC only

In the VPC console, choose Create VPC and select the VPC only option. Provide the VPC name and IPv4 CIDR block. IPv6 was not enabled in this exercise.

At this point, the VPC exists, but it has no custom subnets, internet gateway, or manually configured route associations.

2. Create the subnets

Create four subnets in the custom VPC:

• Two public subnets, one in each of two Availability Zones.
• Two private subnets, one in each of the same Availability Zones.

Using multiple Availability Zones improves architectural resilience compared with placing all subnets in one Availability Zone.

3. Use the default route table carefully

A new VPC includes a main route table. Subnets without an explicit association use the VPC’s main route table implicitly.

The demonstration first used this route table for the public configuration, then created a separate route table for private subnets. This separation is essential because private subnets must not inherit a default route to an internet gateway.

4. Create and associate the private route table

Create a route table named my private RT and explicitly associate it with:

• private 1A
• private 1B

The private route table should not contain a default route to an internet gateway. If outbound internet access is later required for private resources, a NAT gateway and the appropriate route would be considered.

5. Create and attach an internet gateway

Create an internet gateway named my IGW, then attach it to the custom VPC.

Attachment alone does not provide internet connectivity. A route table must also contain a default route whose destination is 0.0.0.0/0 and whose target is the internet gateway.

6. Configure the public route table

The public route table retains the VPC’s local route for traffic within the VPC. Add this default route:

Destination: 0.0.0.0/0
Target: Internet gateway (my IGW)

The local route handles traffic within the VPC CIDR range. The default route handles destinations outside that range by sending traffic to the internet gateway.

Ensure that the public subnets are associated with this public route table. In the demonstration, the public route table was labeled public RT for easier identification.

7. Enable automatic public IPv4 assignment

For each public subnet, open Actions → Edit subnet settings and enable Auto-assign public IPv4 address.

This setting is separate from route-table configuration. A subnet can have a route to an internet gateway while launched instances still lack public IP addresses. Public IP assignment can also be overridden during an EC2 launch, but enabling it at the subnet level reduces the chance of missing the setting.

8. Test with an EC2 instance

The demonstration launched an Amazon Linux 2023 t2.micro instance into public 1B and changed the network settings to use the custom VPC.

A security group named web access my VPC allowed SSH on port 22 from any source for the test. With a public IPv4 address and the required route in place, EC2 Instance Connect was used with the ec2-user account. A ping google.com test confirmed outbound connectivity.

After testing, the instance was terminated. The VPC was retained.

Exam- or Assessment-Relevant Takeaways

• A custom VPC provides control over CIDR ranges, subnet design, routing, and network tiers.
• The VPC and more wizard is faster, while manual creation is better for understanding component relationships and precise control.
• A public subnet requires both a route to an internet gateway and public IP addressing for the resource.
• An internet gateway must be attached to the VPC and referenced by a route table; attachment alone is insufficient.
• Private subnets should use a separate route table without an internet-gateway default route.
• Subnets without explicit route-table associations use the VPC’s main route table implicitly.
• Availability Zone names can vary between AWS accounts; Availability Zone IDs provide consistent physical-zone identification across accounts.
• NAT gateways provide a possible path for private-subnet outbound internet access but can create charges.
• VPCs, subnets, and internet gateways themselves do not incur charges in the demonstrated setup; NAT gateway usage is the cost concern highlighted by the lesson.

Tool / Feature Decision Guide

Requirement	Recommended choice	Reason
Quickly create a conventional VPC layout	VPC and more wizard	It creates the VPC, subnets, route tables, associations, and gateway configuration together.
Learn or control every network component	Manual VPC creation	Each dependency and association is configured explicitly.
Make resources reachable through an internet gateway	Public subnet and public route table	The subnet needs a 0.0.0.0/0 route to the internet gateway.
Prevent direct internet-gateway routing	Private subnet with a separate route table	This avoids exposing private subnets through the public route table.
Give newly launched instances public addresses automatically	Enable auto-assign public IPv4 at the subnet level	It reduces the chance that launches in the public subnet lack public IPs.
Give private resources outbound internet access	Consider a NAT gateway	The lesson identifies this as the relevant pattern and warns about possible charges.
Identify the same physical Availability Zone across accounts	Use Availability Zone IDs	AZ names are account-specific mappings, while IDs identify the underlying zone consistently.

Common Traps / Misconceptions

• “A subnet is public because it has a public name.” A public subnet needs an internet-gateway route and resources need public IP addresses.
• “Attaching an internet gateway is enough.” The applicable route table must explicitly send external traffic to the gateway.
• “The main route table only applies to the VPC itself.” Subnets without explicit associations use the main route table implicitly.
• “Private subnets can share the public route table.” Sharing a route table containing an internet-gateway default route defeats the intended private-subnet design.
• “Auto-assign public IPv4 is always enabled in a custom public subnet.” The lesson specifically demonstrates that it may be disabled and must be checked or enabled.
• “A public IP alone provides internet access.” Routing, public addressing, and security-group rules all matter.
• “Availability Zone us-east-1a is physically the same everywhere.” AZ names can map differently across accounts; use AZ IDs when cross-account placement matters.
• “All VPC components are chargeable.” The lesson identifies NAT gateway usage as the cost item to watch, not the VPC, subnets, or internet gateway themselves.

Real-World Engineer / Analyst Notes

• Label route tables clearly, such as public RT and my private RT, because explicit associations become difficult to audit in larger VPCs.
• Validate the complete path rather than checking only one setting: subnet association, route table entries, gateway attachment, public IP assignment, and security-group rules.
• Use separate public and private route tables even when the initial private subnets do not need outbound connectivity. This preserves a clean security boundary for future changes.
• Test connectivity with a disposable instance, then terminate it to avoid leaving unnecessary resources running.
• Before adding NAT gateways, review the expected cost and whether the workload truly requires outbound internet access from private subnets.
• When designing across accounts, reason about Availability Zone IDs rather than assuming that matching AZ letters represent the same physical zone.

Quick Reference Summary

Custom VPC
├── Public subnet 1A ── public route table ── 0.0.0.0/0 → internet gateway
├── Public subnet 1B ── public route table ── 0.0.0.0/0 → internet gateway
├── Private subnet 1A ─ private route table ── no IGW default route
└── Private subnet 1B ─ private route table ── no IGW default route

For a public EC2 connectivity test, verify:

1. The instance is in the intended custom VPC and public subnet.
2. The subnet has auto-assign public IPv4 enabled, or the launch explicitly assigns a public IP.
3. The public route table has 0.0.0.0/0 targeting the attached internet gateway.
4. The security group allows the required connection, such as SSH port 22 for the demonstration.
5. The instance is using the expected network settings.

Flashcards

Q: When should you use the VPC and more wizard instead of creating a VPC manually?

A: Use the wizard when its generated topology meets your needs and speed is the priority. Use manual creation when you need precise control or want to understand every dependency and association.

Q: What components made the demonstrated custom VPC public subnets usable for internet connectivity?

A: The subnets needed a route table with 0.0.0.0/0 pointing to an attached internet gateway, and launched instances needed public IPv4 addresses.

Q: What is the main routing difference between the public and private route tables?

A: The public route table contains a default route to an internet gateway. The private route table does not contain that internet-gateway default route.

Q: What happens to a subnet that has no explicit route-table association?

A: It is implicitly associated with the VPC’s main route table. This can unintentionally give it the main table’s routing behavior.

Q: An instance is in a subnet with an internet-gateway route but has no public IPv4 address. What is the likely problem?

A: Auto-assign public IPv4 may be disabled for the subnet, and the launch may not have overridden it. Check the subnet setting or the instance launch network settings.

Q: Why was a separate private route table created for private 1A and private 1B?

A: To give the private subnets routing behavior distinct from the public subnets and prevent them from receiving a default route to the internet gateway.

Q: What does an internet gateway attachment accomplish, and what does it not accomplish by itself?

A: It connects the VPC to the internet gateway service. It does not create internet connectivity until a route table sends external traffic to that gateway.

Q: What does the 0.0.0.0/0 route represent in the public route table?

A: It is the default route for destinations outside the VPC’s local CIDR range. In this design, that traffic is sent to the internet gateway.

Q: Why might an engineer use Availability Zone IDs instead of names?

A: AZ names can map differently across AWS accounts. AZ IDs identify the underlying Availability Zone consistently for cross-account placement decisions.

Q: Which feature should be considered when private-subnet instances need outbound internet access?

A: A NAT gateway is the feature highlighted by the lesson. It provides the relevant connectivity pattern but can incur charges.

Q: Why does a public subnet name not prove that the subnet is public?

A: Names are labels, not behavior. The route table must point external traffic to an internet gateway, and resources generally need public IP addressing to use that path.

Q: What security-group rule supported the EC2 Instance Connect test?

A: The test security group allowed SSH traffic on port 22 from any source. This was used for the demonstration and is broader than a restrictive production rule should typically be.

Practice Questions

Question 1

An EC2 instance is launched into a custom subnet. The subnet’s route table has 0.0.0.0/0 pointing to an attached internet gateway, but the instance cannot reach the internet. The instance has no public IPv4 address. What should be checked first?

A. Whether IPv6 was enabled for the VPC
B. Whether auto-assign public IPv4 was enabled or overridden during launch
C. Whether the private route table has a NAT gateway
D. Whether the VPC has a second internet gateway

Correct answer: B

The decisive clue is the missing public IPv4 address. The lesson shows that custom subnets may have automatic public IP assignment disabled even when they are intended to be public.

Question 2

An administrator wants two private subnets to remain isolated from direct internet-gateway routing while public subnets remain internet-accessible. Which design best matches the lesson?

A. Associate all subnets with the main route table and attach an internet gateway
B. Create a private route table without an internet-gateway default route and associate both private subnets with it
C. Create one internet gateway per subnet
D. Assign public IPv4 addresses only to the private-subnet instances

Correct answer: B

A separate private route table prevents the private subnets from inheriting the public route table’s default route to the internet gateway.

Question 3

A team launches resources across accounts and must ensure that resources are separated into the same underlying Availability Zones. Which identifier should the team compare?

A. Subnet name
B. Availability Zone letter only
C. Availability Zone ID
D. VPC name

Correct answer: C

Availability Zone names can map differently across accounts, while Availability Zone IDs provide the consistent underlying-zone identifier highlighted in the lesson.

Question 4

A VPC has an internet gateway attached, but instances in its public subnets still have no external connectivity. Which missing configuration is most likely?

A. A default route from the public route table to the internet gateway
B. A second VPC CIDR block
C. An S3 gateway endpoint
D. An additional private subnet

Correct answer: A

Gateway attachment alone is insufficient. The public route table must include a default route such as 0.0.0.0/0 targeting the internet gateway.

Question 5

An engineer wants to build a VPC quickly with three Availability Zones, public and private subnets, DNS settings enabled, and no NAT gateway. Which console option most directly supports this requirement?

A. Create VPC using VPC only, then manually create every component
B. Use the VPC and more wizard and configure the requested options
C. Launch an EC2 instance into the default VPC
D. Create only an internet gateway and route table

Correct answer: B

The VPC and more wizard can generate the VPC, subnets, route tables, associations, DNS settings, and internet gateway configuration in one workflow.

WordPress Metadata

Suggested Slug:
create-custom-aws-vpc-wizard-manual-configuration

Meta Description:
Learn how to create a custom AWS VPC with public and private subnets, route tables, an internet gateway, automatic public IP assignment, and basic connectivity testing.

Tags:
AWS VPC, Amazon VPC, CIDR, subnets, route tables, internet gateway, availability zones, public subnets, private subnets, EC2, AWS Certified CloudOps Engineer