Study guide
Technical reference and lesson notes
Purpose of This Lesson
Amazon Virtual Private Cloud (Amazon VPC) provides an isolated networking environment within AWS where you can deploy and connect cloud resources. This introductory lesson establishes the major design areas that must be understood before working with detailed VPC architectures:
- IP address range design
- Network routing
- Resource and subnet security
- Inbound and outbound connectivity
- Connections to on-premises environments
- Connectivity between VPCs, including VPCs in different AWS Regions
VPC design is a substantial part of AWS architecture because networking decisions affect security, availability, operations, migration, and the ability to integrate multiple environments.
Key Concepts
Logically isolated networking
A VPC is a logically isolated portion of the AWS Cloud. It gives an organization control over the networking environment used by its AWS resources rather than placing those resources into one undifferentiated global network.
Logical isolation should not be confused with complete disconnection. A VPC can be designed with controlled paths to:
- The public internet
- Other AWS services
- On-premises data centers
- Other VPCs
- VPCs in other Regions
The connectivity that exists depends on the networking components and routes configured for the environment.
Address range selection
VPC design begins with choosing the IP address ranges used by the network. Address planning is important because the ranges must support current workloads, future growth, and any networks that may later need to connect to the VPC.
Overlapping address ranges can create complications when connecting VPCs or integrating with on-premises networks. Consequently, address planning is an architectural concern rather than a minor implementation detail.
Routing control
Routing determines where network traffic can go. A VPC provides control over routing configuration so that traffic can be directed toward appropriate destinations, such as another network, an external connection, or a specific AWS component.
A secure design requires both intended paths and the absence of unintended paths to be considered.
Security and firewall controls
VPC security involves multiple layers of control. The introductory areas include:
- Security groups, which control traffic associated with supported AWS resources such as instances
- Subnet-level firewall controls, which help regulate traffic entering or leaving network segments
- Routing controls, which determine whether a path to a destination exists at all
These controls address different parts of the network design. A permitted security rule does not by itself create network reachability if routing is missing, and a valid route does not override a blocking security control.
Connectivity into and out of a VPC
VPC architectures commonly need controlled connectivity in both directions:
- Outbound access from workloads to external systems or services
- Inbound access from users, applications, or connected networks
- Private connectivity to on-premises data centers
- Connectivity between VPCs used by separate applications, accounts, or environments
- Inter-Region VPC connectivity when workloads span multiple AWS Regions
The correct connectivity technology depends on the required scope, traffic pattern, security model, resilience requirements, and operational complexity.
Exam-Relevant Takeaways
- An Amazon VPC is a logically isolated networking environment for AWS resources.
- VPC architecture includes more than IP addressing; it also includes routing, security, and connectivity decisions.
- Address ranges should be planned with future expansion and network integration in mind.
- Connectivity into or out of a VPC is not automatic. It must be designed and controlled.
- VPC security depends on coordinated controls, including routing, security groups, and subnet-level firewall mechanisms.
- AWS provides multiple ways to connect VPCs, on-premises networks, and Regions. Service selection should be based on the required network relationship rather than a one-size-fits-all approach.
- Hands-on configuration is particularly valuable for VPC because the interaction between addressing, routing, and security controls is easier to understand when tested directly.
Architecture Decision Guide
At a high level, VPC design decisions can be organized as follows:
| Design question | Why it matters |
|---|---|
| What IP ranges should the VPC use? | Determines available capacity and whether future network connections can be made without address conflicts. |
| Which routes should exist? | Defines where traffic is allowed to travel and which destinations are reachable. |
| Which resources or network segments need protection? | Determines where security groups and subnet-level firewall controls should be applied. |
| Does the VPC need external connectivity? | Identifies whether controlled inbound, outbound, or both types of access are required. |
| Must the VPC connect to on-premises or another VPC? | Drives selection of an appropriate inter-network connectivity architecture. |
| Does the design span AWS Regions? | Requires consideration of cross-Region connectivity and the associated operational and resilience implications. |
Common Exam Traps
- Treating a VPC as automatically connected to other networks: A VPC is isolated by default at the logical-network level. Required connectivity must be deliberately designed.
- Selecting a connectivity option before checking address ranges: Network integration can be affected by overlapping or poorly planned IP ranges.
- Assuming routing and security are interchangeable: Routing determines whether a path exists; security controls determine whether traffic is permitted through the relevant control points.
- Focusing only on outbound access: Many architectures require both controlled egress and controlled ingress, often with different security requirements.
- Ignoring future connectivity: A VPC that works as a standalone environment may be difficult to connect to an on-premises network or another VPC later if its addressing was not planned carefully.
- Treating all VPC connectivity requirements as identical: On-premises integration, VPC-to-VPC communication, and cross-Region connectivity are different architectural problems.
Real-World Engineer Notes
VPC design is foundational infrastructure. Changes to address ranges, routes, and network security controls can affect many applications at once, so these decisions should be documented and managed carefully.
A useful design review should identify:
- The VPC’s intended IP ranges and expected growth.
- Which networks and services must be reachable.
- Which traffic flows are inbound, outbound, or bidirectional.
- Which controls protect individual resources and which protect broader network segments.
- Whether future connections to other VPCs or on-premises environments are likely.
Hands-on testing is especially useful for validating how routes and security controls interact. A resource can have a seemingly correct security rule but remain unreachable because the necessary network path does not exist.
Quick Reference Summary
- VPC: A logically isolated AWS networking environment.
- Addressing: Defines the VPC’s IP space and affects future connectivity.
- Routing: Controls available network paths and destinations.
- Security groups: A resource-oriented security control discussed as part of VPC design.
- Subnet-level firewall controls: Add security enforcement at a broader network-segment level.
- Connectivity: May include internet, on-premises, VPC-to-VPC, and cross-Region communication.
- Core design principle: Plan addressing, routing, security, and connectivity together.
Flashcards
1. What is an Amazon VPC?
An isolated virtual networking environment in AWS where resources can be deployed with controlled addressing, routing, and security.
2. What does “logically isolated” mean in the context of a VPC?
The VPC provides a separate network environment within AWS. It does not imply that the VPC can never connect to other networks; connectivity can be deliberately configured.
3. Which major areas of control are associated with VPC design?
IP address ranges, routing, security controls, and connectivity to external or other AWS networks.
4. Why is VPC address planning important?
The selected ranges must support growth and should avoid conflicts with networks that may later connect to the VPC.
5. What role does routing play in a VPC?
Routing determines which destinations are reachable and which network paths traffic can use.
6. Why are routing and security separate considerations?
A route can make a destination reachable, while security controls determine whether traffic is allowed through the relevant control points.
7. What types of networks might connect to a VPC?
The internet, on-premises data centers, other VPCs, and VPCs in different AWS Regions.
8. Why should VPC connectivity be selected according to the use case?
Different relationships—such as on-premises connectivity, VPC-to-VPC communication, and cross-Region networking—have different scope, security, resilience, and operational requirements.
Practice Questions
Question 1
A company is designing a new VPC that may later connect to its on-premises data center and to another VPC. Which decision should be made early to reduce future integration problems?
A. Choose the largest possible instance types
B. Plan non-conflicting IP address ranges
C. Permit all inbound traffic initially
D. Remove routing controls until connectivity is required
Correct answer: B
Explanation: IP address planning affects whether networks can be connected cleanly later. Overlapping or poorly planned address ranges can complicate VPC-to-VPC and on-premises integration.
Question 2
An application has a security rule that permits traffic from a required source, but the destination is still unreachable. Which VPC design area should be investigated first alongside the security rule?
A. Network routing
B. Compute instance size
C. Object storage lifecycle configuration
D. DNS record expiration
Correct answer: A
Explanation: Security permission alone does not create a network path. Routing must also direct traffic toward the intended destination.
Question 3
A solutions architect is asked to design a VPC for an application that needs communication with a corporate data center and another AWS VPC. What is the most accurate initial approach?
A. Assume all VPCs are automatically interconnected
B. Design the required connectivity paths and apply appropriate security controls
C. Use only resource-level security rules and ignore routing
D. Give every workload unrestricted internet access
Correct answer: B
Explanation: VPCs are logically isolated environments. Connections to on-premises networks and other VPCs must be deliberately designed, routed, and secured.
Question 4
Which statement best describes the scope of VPC architecture?
A. It is limited to assigning IP addresses
B. It concerns only internet access
C. It includes addressing, routing, security, and network connectivity
D. It applies only to compute instances
Correct answer: C
Explanation: VPC design encompasses the complete networking environment, including address ranges, routes, security controls, and connections to other networks.