Amazon VPC Architecture, CIDR, Subnets, and Routing – SAP-C02 Study Guide

Purpose of This Lesson

Amazon Virtual Private Cloud (VPC) provides an isolated virtual network within an AWS Region. Understanding how VPCs, subnets, Availability Zones, CIDR blocks, route tables, and gateways fit together is foundational for designing secure, resilient AWS architectures and solving SAP-C02 networking scenarios.

A VPC defines the network boundary. Subnets divide that network across Availability Zones, route tables control traffic paths, and gateways or endpoints provide connectivity to the internet, other networks, or AWS services.

Key Concepts

VPC scope and isolation

• A VPC exists within a single AWS Region.
• A VPC is logically isolated from other VPCs and AWS customers by default.
• You can create multiple VPCs in the same Region.
• Resources in a VPC are not automatically reachable from the public internet or from another VPC.
• Connectivity must be explicitly configured using routing, gateways, peering, Transit Gateway, VPN, Direct Connect, or service-specific endpoints.

A VPC is private by default, but it can contain both public-facing and internal resources. “Public” and “private” generally describe network reachability and routing, not whether the VPC itself is public.

Availability Zones and subnets

A subnet belongs to exactly one Availability Zone. It cannot span multiple Availability Zones.

This relationship is important for high availability:

• Create subnets in multiple Availability Zones.
• Deploy redundant application resources across those subnets.
• Use load balancers, Auto Scaling groups, and managed services to distribute workloads across Zones where supported.
• Do not treat multiple subnets in the same Availability Zone as equivalent to multi-AZ resilience.

You may create multiple subnets in one Availability Zone, but each subnet must have a distinct, non-overlapping CIDR range.

VPC CIDR blocks

When creating a VPC, you assign it an IPv4 CIDR block, such as 10.0.0.0/16. This is the address space from which subnet CIDRs are allocated.

For example:

VPC:      10.0.0.0/16
Subnet A: 10.0.1.0/24
Subnet B: 10.0.2.0/24
Subnet C: 10.0.3.0/24

The /16 VPC contains a larger address range than each /24 subnet. A longer prefix means a smaller network:

• /16 allocates more addresses than /24.
• Subnet CIDRs must fit within the VPC CIDR.
• Subnet CIDRs within the same VPC must not overlap.
• VPC CIDRs should generally not overlap with other networks that may need connectivity, such as on-premises networks, peered VPCs, or Transit Gateway attachments.

AWS reserves five IPv4 addresses in every subnet, including the network address, router address, DNS address, and other reserved addresses. Therefore, a /24 subnet has 256 total IPv4 addresses but 251 usable IPv4 addresses.

VPC router and route tables

Every VPC has an implicit router managed by AWS. You do not deploy or administer the router directly. Instead, you control its behavior through route tables.

A route table contains destination CIDR blocks and targets, such as:

• local for traffic between subnets in the same VPC.
• An Internet Gateway for internet-bound traffic.
• A NAT Gateway for outbound IPv4 access from private subnets.
• A VPC peering connection.
• A Transit Gateway attachment.
• A virtual private gateway for Site-to-Site VPN or Direct Connect.
• A network interface or Gateway Load Balancer endpoint in supported designs.

Each subnet is associated with one route table at a time. A route table can be associated with multiple subnets. If a subnet is not explicitly associated with a custom route table, it uses the VPC’s main route table.

Routing uses the most specific matching route. For example, a route for 10.0.2.0/24 takes precedence over a broader route for 10.0.0.0/16 when traffic is destined for 10.0.2.0/24.

Internet gateways and public subnets

An Internet Gateway (IGW) is attached to a VPC and enables internet connectivity for resources with suitable routing and addressing.

A subnet is commonly called a public subnet when its route table contains a default route such as:

0.0.0.0/0 -> Internet Gateway

For an IPv4 resource to communicate directly with the internet through an IGW, it generally also needs a public IPv4 address or an Elastic IP address. The route alone does not make an instance publicly reachable.

Public access also depends on security controls, including:

• Security group rules.
• Network ACL rules.
• Operating-system firewalls.
• Application authentication and authorization.

An Internet Gateway performs one-to-one network address translation for instances that have public IPv4 addresses. It is horizontally scaled and managed by AWS; you do not provision capacity for it.

Private subnets and outbound access

A private subnet does not have a direct route to an Internet Gateway. Workloads in private subnets can still access the internet for outbound IPv4 connections through a NAT Gateway located in a public subnet:

Private subnet -> NAT Gateway -> Internet Gateway -> Internet

A NAT Gateway allows return traffic for connections initiated from the private subnet, but it does not provide unsolicited inbound internet access to the private instances.

For high availability, deploy a NAT Gateway in each Availability Zone that requires independent outbound internet access. A single NAT Gateway shared across Zones can create a cross-AZ dependency and an Availability Zone failure risk, although it may reduce cost.

For access to AWS services such as Amazon S3 or DynamoDB, consider VPC endpoints instead of routing traffic through a NAT Gateway. Gateway endpoints for S3 and DynamoDB do not incur hourly endpoint charges, while interface endpoints use AWS PrivateLink and are charged according to usage.

AWS services inside and outside a VPC

Many compute and data services are deployed into a VPC, including:

• Amazon EC2.
• Amazon RDS and Amazon Aurora.
• Amazon EFS mount targets.
• Amazon ElastiCache.
• Application Load Balancers and Network Load Balancers.

Other services are regional, global, or AWS-managed services with public service endpoints rather than resources placed directly inside your VPC. Amazon S3 is a key example.

An AWS service having a public endpoint does not mean that its data is publicly accessible. Access still depends on identity-based policies, resource policies, encryption, network restrictions, and service configuration. For private access from a VPC, use the appropriate VPC endpoint where supported.

Exam-Relevant Takeaways

• A VPC is regional; a subnet is tied to one Availability Zone.
• A subnet never spans Availability Zones.
• Multi-AZ architecture requires resources in subnets located in multiple Availability Zones.
• A public subnet requires a route to an Internet Gateway, but a resource also needs an appropriate public address for direct internet communication.
• A private subnet has no direct route to an Internet Gateway.
• NAT Gateways provide outbound internet access for private IPv4 resources; they do not enable direct inbound connections.
• Route tables control traffic paths. Security groups and network ACLs control traffic filtering; they do not create routes.
• Use non-overlapping CIDR ranges when planning VPCs and subnets.
• Avoid overlapping VPC CIDRs when VPC peering, Transit Gateway, VPN, or Direct Connect connectivity may be needed.
• AWS services outside a VPC, such as S3, can still be accessed privately through supported VPC endpoints.
• Public accessibility is a combination of routing, addressing, and security policy—not simply the presence of a public subnet.

Architecture Decision Guide

Requirement	Typical design choice	Important considerations
Deploy resources across fault domains	Create subnets in multiple Availability Zones	A subnet is limited to one Zone; deploy redundant resources across Zones
Host a public web tier	Public subnets with an IGW route	Use public IPs only where necessary; restrict access with security groups and NACLs
Host application or database tiers privately	Private subnets without an IGW route	Use internal load balancers and controlled east-west access
Permit private instances to download updates	NAT Gateway in a public subnet	Deploy per AZ for resilience; assess data processing and hourly costs
Access S3 without traversing the public internet	S3 Gateway VPC endpoint	Configure endpoint and bucket policies; no NAT is required for S3 access
Connect multiple VPCs at scale	AWS Transit Gateway	CIDRs must be planned carefully; use route tables and attachment associations
Connect two VPCs directly	VPC peering	Non-overlapping CIDRs are required; peering is non-transitive
Connect to on-premises networks	Site-to-Site VPN or Direct Connect	Plan routing, redundancy, encryption, and address compatibility
Preserve future connectivity options	Allocate non-overlapping CIDRs	Include on-premises, acquisitions, peering, and future VPC growth in planning

Common Exam Traps

• Assuming a subnet can span AZs: It cannot. Create one subnet per AZ and deploy multiple subnets for multi-AZ designs.
• Confusing a public subnet with a public instance: A public subnet has an IGW route. The instance also needs a public IPv4 address or Elastic IP and permissive-enough security controls.
• Assuming an IGW provides private-instance internet access automatically: Private instances need a NAT Gateway or another egress design for outbound IPv4 internet traffic.
• Using a NAT Gateway for inbound publishing: NAT Gateways are for outbound connections initiated by private resources. Use a load balancer, bastion pattern, or other explicitly designed ingress path instead.
• Relying on route tables for security: Routes determine where packets go. Security groups and network ACLs determine whether traffic is allowed.
• Overlapping CIDRs during network integration: Overlap can prevent or complicate routing through peering, Transit Gateway, VPN, and Direct Connect.
• Treating S3 as an EC2-style VPC resource: S3 is not deployed into your subnets. Use IAM, bucket policies, and VPC endpoints to control access.
• Assuming public endpoints imply public data: AWS services may expose public endpoints while still requiring authentication and authorization.
• Ignoring NAT Gateway Availability Zone design: A single centralized NAT Gateway may be cheaper but can introduce cross-AZ traffic, dependency, and failure considerations.

Real-World Engineer Notes

• Design CIDR ranges before deploying workloads. Include room for growth, multiple environments, shared services, container platforms, and future network integrations.
• Keep application, data, and ingress tiers in separate subnets when their routing or security requirements differ.
• Prefer private subnets for databases and internal services. Expose only the minimum required ingress through load balancers or controlled endpoints.
• Use VPC Flow Logs, route-table inspection, Reachability Analyzer, and security-group analysis when troubleshooting connectivity.
• Consider IPv6 during address planning. IPv6 subnets use /64 CIDRs, and internet reachability is controlled through routing and security rules rather than IPv4 NAT.
• Centralized inspection architectures may use Transit Gateway, AWS Network Firewall, Gateway Load Balancer, or third-party appliances. These designs require careful route-table and return-path planning.
• When using interface VPC endpoints, configure private DNS where appropriate so applications can use standard AWS service names while resolving to private endpoint addresses.
• Keep network controls layered: routing for path selection, security groups for stateful instance-level filtering, NACLs for stateless subnet-level filtering, and IAM/resource policies for service authorization.

Quick Reference Summary

• VPC: Regional, logically isolated network boundary.
• CIDR block: Address range assigned to the VPC or subnet.
• Subnet: Regional resource constrained to one Availability Zone.
• Route table: Defines packet destinations and next-hop targets.
• Public subnet: Typically has 0.0.0.0/0 pointing to an Internet Gateway.
• Private subnet: No direct Internet Gateway route; may use NAT for outbound IPv4 access.
• Internet Gateway: Enables internet connectivity for appropriately addressed resources.
• NAT Gateway: Provides outbound IPv4 internet access from private subnets.
• VPC endpoint: Provides private connectivity to supported AWS services.
• CIDR planning: Use non-overlapping ranges and reserve capacity for growth and integration.

Flashcards

1. Q: What is the scope of a VPC?

A: A VPC is created within one AWS Region.

1. Q: Can a subnet span multiple Availability Zones?

A: No. Each subnet belongs to exactly one Availability Zone.

1. Q: What makes a subnet public?

A: Its route table generally includes a route to an Internet Gateway, typically 0.0.0.0/0 -> IGW.

1. Q: What additional requirement allows an EC2 instance in a public subnet to use the internet directly?

A: It needs a suitable public IPv4 address or Elastic IP, plus permissive security controls.

1. Q: What does a NAT Gateway provide?

A: Outbound IPv4 internet connectivity for resources in private subnets.

1. Q: Does a NAT Gateway accept unsolicited inbound connections to private instances?

A: No. It supports return traffic for connections initiated from the private side.

1. Q: What controls the VPC router?

A: Route tables define the routes used by the implicit VPC router.

1. Q: Why should VPC CIDRs avoid overlap?

A: Overlap prevents or complicates routing between VPCs and external networks.

1. Q: Where is Amazon S3 deployed?

A: S3 is not deployed into customer VPC subnets; it is an AWS-managed service accessed through service endpoints.

1. Q: How can a VPC access S3 privately?

A: Through an S3 VPC Gateway Endpoint, where supported.

Practice Questions

Question 1

A company runs EC2 application servers in private subnets across three Availability Zones. The servers must download software updates from the internet, but the company must not allow inbound internet connections to the servers. Which design best meets the requirement?

A. Add an Internet Gateway route to each private subnet.
B. Assign public IPv4 addresses to the instances.
C. Deploy a NAT Gateway in a public subnet and route private-subnet internet traffic through it.
D. Create a VPC peering connection to a second VPC with internet access.

Correct answer: C

Explanation: A NAT Gateway provides outbound IPv4 internet access without exposing private instances to unsolicited inbound connections. For resilience, deploy NAT Gateways in multiple Availability Zones and route each private subnet to a suitable local NAT Gateway. An Internet Gateway route or public IP would make the design directly internet-routable, and VPC peering does not provide transitive internet access.

Question 2

A solutions architect must deploy a highly available application across two Availability Zones. Which subnet design is valid?

A. One subnet with resources from both Availability Zones.
B. One subnet per Availability Zone, with application instances distributed across both subnets.
C. One VPC per Availability Zone, connected with VPC peering.
D. One subnet spanning the Region, with a single route table.

Correct answer: B

Explanation: Each subnet is associated with one Availability Zone. A multi-AZ deployment therefore requires separate subnets in the selected Zones, with redundant resources distributed across them.

Question 3

A company plans to connect two VPCs using VPC peering and later connect the environment to its on-premises network. The VPCs use 10.0.0.0/16 and 10.0.0.0/16. What is the primary issue?

A. VPC peering supports only public IPv4 addresses.
B. VPCs must be in different AWS Regions.
C. Overlapping CIDR ranges prevent normal routing between the networks.
D. VPCs cannot communicate through route tables.

Correct answer: C

Explanation: VPC peering and most routed network integrations require non-overlapping address ranges. The VPCs should be renumbered or redesigned before establishing connectivity.

Question 4

An application in a private subnet must access an S3 bucket without using a NAT Gateway or public internet path. Which option should the architect select?

A. Attach an additional Internet Gateway to the VPC.
B. Create an S3 Gateway VPC Endpoint and configure appropriate endpoint and bucket policies.
C. Assign Elastic IP addresses to all application servers.
D. Create a VPC peering connection to the S3 service.

Correct answer: B

Explanation: An S3 Gateway VPC Endpoint provides private connectivity from VPC resources to S3 without requiring a NAT Gateway or direct internet route. Access remains controlled through IAM and S3 bucket policies.

Question 5

An EC2 instance is deployed in a subnet whose route table contains 0.0.0.0/0 -> Internet Gateway. The instance cannot receive traffic from the internet. Which additional condition is required for direct IPv4 internet reachability?

A. The instance must have a public IPv4 address or Elastic IP, and security controls must allow the traffic.
B. The instance must be placed in a second subnet in the same Availability Zone.
C. The VPC must have a Transit Gateway attachment.
D. The subnet must use a NAT Gateway instead of an Internet Gateway.

Correct answer: A

Explanation: An IGW route alone does not provide an instance with a public address. The instance needs a public IPv4 address or Elastic IP, and its security group, network ACL, host firewall, and application must allow the requested traffic.