AWS VPC Architecture Patterns and Connectivity Decisions – SAP-C02 Study Guide

Purpose of This Lesson

AWS VPC architecture questions often present a requirement and ask you to select the most appropriate networking or security feature. The key is to map each requirement to the correct traffic-control layer, connectivity model, or routing component.

This guide covers common patterns involving Amazon S3 access, subnet-level filtering, hybrid connectivity, inter-Region VPC connectivity, IPv6, and multi-VPC routing.

Key Concepts

Restricting Amazon S3 Access to a VPC

When EC2 instances in private subnets must access an S3 bucket without using public IP addresses, use an Amazon S3 gateway VPC endpoint.

The endpoint adds private routing from the VPC to S3. You can then restrict the bucket policy with the aws:SourceVpce condition key so that requests are accepted only when they originate through the specified VPC endpoint.

Important components include:

• Private-subnet route tables associated with the S3 gateway endpoint.
• An S3 bucket policy restricting access to the endpoint ID.
• IAM permissions allowing the workload to access the bucket.
• An optional endpoint policy to further restrict permitted S3 actions and resources.

A VPC endpoint alone does not automatically grant access to the bucket. Identity-based and resource-based policies still apply.

Blocking Specific Source IP Addresses

A network ACL (NACL) can deny traffic based on source or destination IP addresses at the subnet boundary. This makes it suitable when a requirement explicitly identifies malicious source IP addresses and asks for a subnet-level block.

NACLs are:

• Stateless: return traffic must be explicitly allowed.
• Associated with subnets rather than individual ENIs.
• Evaluated in rule-number order.
• Capable of explicit deny rules.

Security groups cannot create deny rules. AWS WAF may be more appropriate for HTTP-aware filtering, but a NACL is a simple network-layer control for known IP addresses.

Direct Connect Plus VPN Encryption

AWS Direct Connect provides a private, dedicated connection between an on-premises environment and AWS. It is generally selected when predictable network performance and more consistent latency are required than an internet-based VPN can provide.

Direct Connect does not inherently encrypt application traffic. If encryption in transit is mandatory, use encryption such as a site-to-site VPN in conjunction with the Direct Connect connectivity design.

A robust hybrid architecture commonly includes:

• Direct Connect for the primary private path.
• Site-to-site VPN for encryption and/or backup connectivity.
• BGP for dynamic route exchange where supported.
• A second Direct Connect connection, location, or provider for higher resilience.

Private Connectivity Between VPCs in Different Regions

VPC peering supports private connectivity between VPCs, including VPCs in different AWS Regions and different AWS accounts, subject to supported configurations and routing requirements.

For a small number of VPCs, peering can be straightforward. However, peering is non-transitive:

• VPC A peered with VPC B does not allow VPC A to reach VPC C through VPC B.
• Each required VPC-to-VPC path needs its own peering connection.
• Routes must be added to the relevant route tables.
• CIDR ranges must not overlap.

For larger multi-VPC or multi-Region designs, AWS Transit Gateway and inter-Region peering may provide a more scalable routing model.

AWS CloudHub for Multiple Remote Offices

The AWS CloudHub pattern uses multiple site-to-site VPN connections attached to a virtual private gateway (VGW). Remote locations can exchange traffic with the VPC and, when routing is configured appropriately, with one another over the AWS network.

This is a hub-and-spoke design:

• AWS acts as the central hub.
• Each remote site establishes a VPN connection to AWS.
• Dynamic routing, typically using BGP, can advertise remote-site networks.
• Remote locations can communicate through the AWS hub rather than requiring direct VPN tunnels between every pair.

CloudHub can be useful for a modest number of sites. For larger environments, AWS Transit Gateway is generally easier to operate and scale.

Instance-Level Firewalling with Security Groups

Security groups provide stateful, instance-level or network-interface-level filtering. For a microservices application, use separate security groups for components such as:

• Load balancers
• Web servers
• Application services
• Databases
• Administrative hosts

Rules should normally reference security groups rather than hard-coded IP addresses. For example, a database security group can permit TCP port 5432 from the application-tier security group only.

Security groups are:

• Stateful: response traffic is automatically permitted when the initiating traffic is allowed.
• Allow-list based: they support allow rules, not explicit deny rules.
• Applied to ENIs and therefore appropriate for instance-level segmentation.

IPv6 Outbound-Only Internet Access

For IPv6 workloads that need outbound internet access but must not accept unsolicited inbound connections, use an egress-only internet gateway.

An egress-only internet gateway:

• Supports IPv6 traffic.
• Allows outbound connections initiated from the VPC.
• Prevents unsolicited inbound IPv6 connections.
• Requires an appropriate ::/0 route in the subnet route table.

A NAT gateway is used for IPv4 address translation and is not the equivalent solution for native IPv6 traffic.

Public IPv4 Address Assignment

To allow instances in a subnet to use internet connectivity over IPv4, the VPC must have an internet gateway, and the subnet route table must include a default route such as:

0.0.0.0/0 -> Internet Gateway

For automatic public IPv4 assignment, enable the subnet setting that assigns public IPv4 addresses to newly launched network interfaces. Instances also require a security group and NACL configuration that permits the desired traffic.

A public subnet is defined by its route to an internet gateway. Merely assigning public IP addresses does not make a subnet public.

Connecting On-Premises Networks to Multiple VPCs

When an on-premises data center must connect to several VPCs and those VPCs need scalable, transitive routing, use AWS Transit Gateway.

Typical design:

1. Attach the on-premises VPN or Direct Connect gateway to the transit gateway.
2. Create VPC attachments for the required VPCs.
3. Configure transit gateway route tables and propagation or static routes.
4. Control which VPCs and networks can communicate through route-table associations and propagation.

Transit Gateway provides a central routing hub and avoids maintaining a large number of individual VPC peering or VPN connections.

Exam-Relevant Takeaways

• Use an S3 gateway endpoint for private access from a VPC without internet or NAT traversal.
• Restrict an S3 bucket to a particular endpoint with aws:SourceVpce in the bucket policy.
• Use NACLs when an explicit subnet-level deny by IP address is required.
• Use security groups for stateful, allow-based, instance-level or ENI-level controls.
• Direct Connect provides dedicated private connectivity and more consistent performance than internet VPN, but encryption requires an additional encryption design.
• VPC peering supports private connectivity across accounts and Regions but is non-transitive.
• AWS CloudHub connects multiple remote sites through a virtual private gateway.
• Transit Gateway is the scalable hub for connecting many VPCs and on-premises networks.
• Use an egress-only internet gateway for outbound-only native IPv6 connectivity.
• A public IPv4 subnet requires both an internet gateway route and public IPv4 address assignment for automatically addressed instances.

Architecture Decision Guide

Requirement	Preferred AWS capability	Key reason
Private EC2-to-S3 access	S3 gateway VPC endpoint	Keeps traffic on AWS private connectivity and avoids NAT or internet routing
Restrict S3 access to one VPC endpoint	S3 bucket policy with aws:SourceVpce	Enforces the request path at the resource policy layer
Deny known malicious IP addresses at subnet level	Network ACL	Supports explicit deny rules using IP-based conditions
Stateful per-application firewalling	Security groups	Applies allow rules at the ENI or instance level
Consistent hybrid network performance	Direct Connect	Dedicated private connection rather than shared internet paths
Encrypted hybrid traffic	Direct Connect plus VPN/encryption	Direct Connect alone does not provide traffic encryption
Simple private connection between two VPCs	VPC peering	Direct private connectivity across VPCs, accounts, or Regions
Many VPCs and on-premises networks	Transit Gateway	Centralized, transitive routing at scale
Multiple remote sites connected through AWS	AWS CloudHub with a VGW	Hub-and-spoke VPN connectivity
Outbound-only IPv6 internet access	Egress-only internet gateway	Prevents unsolicited inbound IPv6 connections
Public IPv4 subnet	Internet gateway, default route, and public IPv4 assignment	Provides routing and addressability for internet access

Common Exam Traps

• Confusing a gateway endpoint with an interface endpoint: S3 and DynamoDB commonly use gateway endpoints, while many other AWS services use interface endpoints powered by AWS PrivateLink.
• Assuming a VPC endpoint grants S3 permissions: Routing and authorization are separate. IAM and the bucket policy must still allow the request.
• Using security groups for deny rules: Security groups are allow-only. Use a NACL or an application-layer control when explicit denial is required.
• Forgetting NACL statelessness: Return traffic must be permitted separately, including ephemeral ports where applicable.
• Assuming VPC peering is transitive: A peering connection does not act as a router for other VPCs.
• Treating Direct Connect as encrypted by default: Direct Connect is private, but privacy and encryption are not the same requirement.
• Using a NAT gateway for IPv6: Native IPv6 outbound-only traffic uses an egress-only internet gateway. NAT gateways are primarily for IPv4 translation.
• Calling a subnet public because it has public IP addresses: The subnet needs a route to an internet gateway; instances also need suitable public address assignment and filtering rules.
• Choosing CloudHub for every multi-VPC design: CloudHub is a VPN hub-and-spoke pattern. Transit Gateway is typically more appropriate for a larger multi-VPC topology.
• Ignoring overlapping CIDR blocks: VPC peering and many routing designs require non-overlapping address ranges.

Real-World Engineer Notes

• Use VPC endpoint policies and S3 bucket policies together for defense in depth. The endpoint policy can limit actions and resources, while the bucket policy can require a specific endpoint or VPC context.
• For internet-facing instances, consider whether a load balancer, private subnets, and managed egress are safer than assigning public addresses directly to instances.
• Use separate route tables where traffic isolation is required. A route to an internet gateway, NAT gateway, transit gateway, or endpoint materially changes a subnet’s connectivity model.
• Plan hybrid connectivity for failure, not merely reachability. Redundant VPN tunnels, Direct Connect links, locations, and customer gateways may be required for production availability.
• Transit Gateway route tables are a security boundary as well as a routing mechanism. Avoid broad propagation when VPC-to-VPC communication should be restricted.
• For IPv6 deployments, security groups and NACLs must explicitly account for IPv6 rules; an IPv4 rule does not automatically authorize IPv6 traffic.

Quick Reference Summary

• S3 from private subnets: S3 gateway endpoint plus endpoint-aware bucket policy.
• Subnet-level IP deny: NACL.
• Per-component stateful firewall: Security groups.
• Dedicated hybrid connectivity: Direct Connect.
• Encrypted hybrid connectivity: Add VPN or another encryption layer.
• Two VPCs privately connected: VPC peering.
• Many VPCs and networks: Transit Gateway.
• Many remote sites through a VGW: AWS CloudHub.
• Outbound-only IPv6: Egress-only internet gateway.
• Public IPv4 subnet: Internet gateway route plus automatic public IPv4 assignment.

Flashcards

1. Q: Which VPC endpoint type is commonly used for private access to Amazon S3?

A: An S3 gateway VPC endpoint.

1. Q: Which S3 bucket-policy condition can restrict requests to a specific VPC endpoint?

A: aws:SourceVpce.

1. Q: Which VPC control supports explicit deny rules for source IP addresses?

A: A network ACL.

1. Q: Are network ACLs stateful or stateless?

A: Stateless; return traffic must be allowed separately.

1. Q: Which control is best for different firewall rules per application component?

A: Separate security groups for each component or tier.

1. Q: Is Direct Connect traffic encrypted automatically?

A: No. Direct Connect provides private connectivity but not encryption by default.

1. Q: What is a limitation of VPC peering?

A: It is non-transitive.

1. Q: What AWS pattern connects multiple remote offices through a central AWS hub?

A: AWS CloudHub using VPN connections attached to a virtual private gateway.

1. Q: Which service provides scalable transitive routing among multiple VPCs?

A: AWS Transit Gateway.

1. Q: Which gateway provides outbound-only internet access for IPv6?

A: An egress-only internet gateway.

1. Q: What makes a subnet public?

A: A route to an internet gateway; instances also need suitable public IPv4 addressing and security rules for direct internet access.

1. Q: What must be considered before using VPC peering?

A: VPC CIDR blocks must not overlap, and routes must be configured on both sides.

Practice Questions

Question 1

An application runs on EC2 instances in private subnets and must access an S3 bucket. The security requirement states that the bucket must reject requests unless they use the VPC’s private connectivity path. Which design best meets the requirement?

A. Configure a NAT gateway and restrict the bucket by source public IP address
B. Create an S3 gateway endpoint and use aws:SourceVpce in the bucket policy
C. Assign public IPv4 addresses to the instances and use a security group
D. Create a transit gateway and route S3 traffic through it

Correct answer: B

An S3 gateway endpoint provides private VPC-to-S3 routing, and the bucket policy can require the specific endpoint ID. A NAT gateway uses public AWS service paths and does not directly express the required endpoint restriction.

Question 2

A security team identifies several malicious public IP addresses sending traffic to EC2 instances in a public subnet. They need a low-cost network-layer control that explicitly denies those sources for the entire subnet. Which option is most appropriate?

A. Add deny rules to the instances’ security groups
B. Add deny rules to the subnet’s network ACL
C. Add the IP addresses to an S3 bucket policy
D. Create an egress-only internet gateway

Correct answer: B

Network ACLs operate at the subnet boundary and support explicit deny rules based on IP addresses. Security groups do not support deny rules.

Question 3

A company requires a dedicated connection from its data center to AWS with more predictable performance than an internet VPN. All traffic must also be encrypted in transit. Which architecture should be selected?

A. Internet VPN only
B. Direct Connect only
C. Direct Connect with an additional VPN or encryption layer
D. VPC peering only

Correct answer: C

Direct Connect provides dedicated private connectivity and more consistent performance, but it does not inherently encrypt traffic. An additional encryption mechanism is required.

Question 4

An enterprise has 20 VPCs and an on-premises data center. The network team wants centralized, transitive routing and the ability to control which VPCs can communicate. Which solution is the best fit?

A. Create a separate VPC peering connection between every pair of VPCs
B. Attach every VPC to a virtual private gateway using CloudHub
C. Deploy AWS Transit Gateway and configure transit gateway route tables
D. Route all VPC traffic through an internet gateway

Correct answer: C

Transit Gateway provides a scalable central routing hub for VPCs and on-premises connectivity. Its route tables and attachment associations can control reachability between networks.

Question 5

An IPv6-enabled application must initiate connections to the internet but must not accept unsolicited inbound connections. Which component should be used?

A. NAT gateway
B. Internet gateway only
C. Egress-only internet gateway
D. VPC peering connection

Correct answer: C

An egress-only internet gateway is designed for outbound-only IPv6 internet connectivity. It permits return traffic for established outbound connections while blocking unsolicited inbound connections.