Create a Custom AWS VPC with Public and Private Subnets – SAP-C02 Study Guide | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

A custom VPC gives you control over IPv4 addressing, subnet placement, routing, and internet connectivity. Although the VPC and more wizard can create a working network quickly, manually creating the components is valuable because it clarifies how VPC resources work together.

This lesson focuses on building a VPC with:

Public and private subnets
Subnets distributed across two Availability Zones
Separate route tables for public and private traffic
An internet gateway
Automatic public IPv4 assignment for public subnets
A test EC2 instance in a public subnet

Key Concepts

Default VPC versus custom VPC

AWS creates a default VPC in each enabled Region. Default VPCs are convenient for experimentation because they normally include subnets in each Availability Zone and public connectivity suitable for launching basic resources.

A custom VPC is preferable when you need to control:

The IPv4 CIDR range
Subnet sizes and placement
Public and private subnet separation
Route-table design
Connectivity to on-premises networks or other VPCs
Security and governance boundaries
Address planning for future growth

The default VPC should not be assumed to have the right address space or routing model for production workloads.

Availability Zone names and Availability Zone IDs

Availability Zone names, such as us-east-1a, are mapped independently for each AWS account. The us-east-1a name in one account may refer to a different physical Availability Zone than us-east-1a in another account.

Availability Zone IDs, such as use1-az1, provide a consistent physical-zone reference across accounts in the same Region. They are useful when deliberately distributing resources across accounts while avoiding accidental placement in the same underlying Availability Zone.

VPC CIDR and subnet CIDRs

A VPC requires an IPv4 CIDR block, for example 10.0.0.0/16. Subnet CIDR blocks must be non-overlapping ranges contained within the VPC CIDR.

A sample layout using two Availability Zones is:

Subnet	Availability Zone	CIDR	Intended role
Public subnet 1A	`us-east-1a`	`10.0.1.0/24`	Internet-facing resources
Public subnet 1B	`us-east-1b`	`10.0.2.0/24`	Internet-facing resources
Private subnet 1A	`us-east-1a`	`10.0.3.0/24`	Internal resources
Private subnet 1B	`us-east-1b`	`10.0.4.0/24`	Internal resources

The exact CIDRs are design choices. The important requirements are that they do not overlap and leave adequate space for future subnets, connectivity, and growth.

What makes a subnet public?

A subnet is considered public when its associated route table contains a default route to an internet gateway (IGW). The route normally looks like this:

Destination: 0.0.0.0/0
Target: Internet gateway

An EC2 instance in the subnet also needs a public IPv4 address, Elastic IP address, or another supported public addressing configuration to communicate directly with the public internet.

Therefore, a public subnet alone does not automatically make an instance internet-accessible. The design requires both:

A route from the subnet’s route table to an IGW.
A public IPv4 address on the resource, along with permissive enough security controls.

Private subnets and NAT Gateway

A private subnet should not have a default route directly to an internet gateway. If instances in a private subnet need outbound internet access for updates or downloads, the usual design is:

Private subnet route table -> NAT Gateway -> Internet gateway

The NAT Gateway is deployed in a public subnet and must have a public route through the IGW. Private subnet instances initiate outbound connections through it, but unsolicited inbound internet connections are not allowed through the NAT Gateway.

NAT Gateways incur hourly and data-processing charges. A VPC, subnets, route tables, and an internet gateway do not themselves incur hourly usage charges, although data transfer and related services may still create costs.

Main route table and explicit subnet associations

Every VPC has a main route table. A subnet that has no explicit route-table association uses the main route table implicitly.

For a clear public/private design:

Associate public subnets explicitly with a public route table.
Associate private subnets explicitly with a private route table.
Keep the private route table free of a direct route to the IGW.

Creating an additional route table does not automatically move any subnet to it. Explicit associations are required.

Internet gateway attachment

An internet gateway must be attached to the VPC before a route table can use it as a target. The IGW provides internet connectivity for resources with public addresses, subject to security group and network ACL rules.

Automatic public IPv4 assignment

Subnet-level auto-assign public IPv4 address controls whether eligible resources launched into the subnet receive public IPv4 addresses by default.

This setting is separate from routing:

Enabling it does not create an internet route.
A subnet with an IGW route may still launch instances without public addresses.
The public-IP choice can often be overridden during an EC2 launch.

For consistently internet-facing subnets, enabling automatic public IPv4 assignment can reduce deployment mistakes. For controlled production environments, teams may instead manage public addressing explicitly with Elastic IPs or load balancers.

Manual Build Sequence

A dependable manual sequence is:

Create the VPC with a planned IPv4 CIDR block.
Create public and private subnets in at least two Availability Zones.
Create separate public and private route tables.
Explicitly associate public subnets with the public route table.
Explicitly associate private subnets with the private route table.
Create and attach an internet gateway to the VPC.
Add 0.0.0.0/0 to the public route table with the IGW as the target.
Leave the private route table without a direct IGW default route.
Enable public IPv4 assignment for public subnets if that is the intended operating model.
Launch and test a resource using the correct VPC, subnet, route table, security group, and address settings.

The default local route remains in route tables so resources can communicate within the VPC CIDR.

Exam-Relevant Takeaways

A public subnet has a route to an internet gateway; it is not defined merely by its name.
An EC2 instance generally needs a public IPv4 address or Elastic IP to communicate directly with the internet through an IGW.
A private subnet should not route directly to an IGW. Use a NAT Gateway for outbound IPv4 internet access when required.
NAT Gateway placement matters: it belongs in a public subnet with a route to the IGW.
A VPC can have multiple route tables, but each subnet uses one route table at a time.
Subnets without explicit associations use the VPC’s main route table.
Distribute application tiers across multiple Availability Zones for resilience.
Use Availability Zone IDs when coordinating placement across AWS accounts.
Default VPCs are convenient but may not satisfy address planning, segmentation, or governance requirements.
NAT Gateway cost includes an hourly charge and data-processing charges; do not select it casually for workloads that can use VPC endpoints.
For private access to AWS services such as Amazon S3, evaluate gateway or interface VPC endpoints to reduce NAT dependency and improve network isolation.

Architecture Decision Guide

Requirement	Recommended design	Important considerations
Quick development environment	Default VPC or VPC and more wizard	Verify CIDRs, subnet types, public-IP behavior, and generated routes
Full network control	Manually create VPC components	Requires deliberate route-table and subnet associations
Internet-facing EC2 instance	Public subnet + IGW route + public IPv4/EIP	Security groups and network ACLs still apply
Internal application tier	Private subnet	No direct IGW route; use internal load balancers where appropriate
Private outbound IPv4 internet access	NAT Gateway in each required AZ or a centralized design	Consider resilience, cross-AZ data charges, and NAT processing cost
Private access to Amazon S3 or DynamoDB	Gateway VPC endpoint	Avoids requiring NAT for supported traffic and keeps traffic on the AWS network
Cross-account AZ placement coordination	Availability Zone IDs	AZ names are account-specific mappings
High availability	Duplicate subnet tiers across multiple AZs	Deploy resources and supporting network components with failure domains in mind

Common Exam Traps

Trap: “A subnet with an internet gateway is public.”

The IGW must be referenced by the subnet’s route table through a default route.

Trap: “An instance in a public subnet can access the internet automatically.”

It also needs a public IPv4 address or equivalent public connectivity, plus appropriate security rules.

Trap: “Private subnets can use an IGW for outbound-only access.”

For typical private IPv4 workloads, use a NAT Gateway or NAT instance. An IGW is not an outbound-only translation service.

Trap: “Creating a private route table automatically associates private subnets.”

Subnet associations must be created explicitly. Otherwise, the subnet continues using the main route table.

Trap: “The first letter of the AZ name identifies the same physical location for every account.”

Use AZ IDs when physical-zone consistency across accounts matters.

Trap: “A NAT Gateway is free because the VPC is free.”

NAT Gateways have hourly and data-processing charges.

Trap: “Turning on auto-assign public IPv4 makes a subnet public.”

Public addressing and routing are separate configuration requirements.

Real-World Engineer Notes

Design CIDR ranges with future VPC peering, Transit Gateway attachments, VPNs, and Direct Connect in mind. Overlapping address spaces complicate connectivity.
Two AZs are a minimum for many resilient designs, but production architectures should select the number of AZs based on service support, capacity, cost, and recovery objectives.
A single NAT Gateway creates a dependency on one AZ. For stronger AZ isolation, deploy a NAT Gateway per AZ and route each private subnet to the NAT Gateway in its own AZ.
Centralized egress through a shared networking VPC can reduce duplication, but it introduces routing, operations, and cross-AZ cost considerations.
Avoid assigning public IP addresses to workloads that do not need direct public connectivity. Prefer private subnets, load balancers, bastion alternatives such as Systems Manager Session Manager, and VPC endpoints.
When testing connectivity, validate the entire path: subnet association, route table, IGW or NAT, public/private address, security group, network ACL, and host-level firewall.
Delete test resources after validation. NAT Gateways are particularly important to remove when no longer required because they continue generating charges.

Quick Reference Summary

VPC: Regional logical network with a chosen CIDR block.
Subnet: A range of VPC IP addresses tied to one Availability Zone.
Public subnet: Route table has a default route to an IGW.
Private subnet: No direct route to an IGW; NAT or endpoints may provide selected outbound access.
Internet gateway: VPC-attached target for internet routing; it does not assign public IP addresses.
Route table: Controls traffic leaving a subnet; every subnet uses one route table.
Main route table: Used implicitly by subnets without explicit associations.
Public IPv4 auto-assignment: Determines whether eligible launched resources receive public IPv4 addresses by default.
NAT Gateway: Managed outbound translation service for private IPv4 resources; billed hourly and by data processed.
Availability Zone ID: Stable AZ identifier useful for cross-account placement decisions.

Flashcards

Q: What makes a subnet public?

A: Its associated route table contains a route, typically 0.0.0.0/0, to an internet gateway.

Q: Does an internet gateway assign public IP addresses?

A: No. Resources need public IPv4 addresses or another public addressing mechanism.

Q: What route should normally be absent from a private subnet?

A: A default route directly to an internet gateway.

Q: How does a private subnet obtain outbound IPv4 internet access?

A: By routing through a NAT Gateway or NAT instance in a public subnet.

Q: What happens to a subnet without an explicit route-table association?

A: It uses the VPC’s main route table.

Q: Can a subnet be associated with multiple route tables simultaneously?

A: No. A subnet uses one route table at a time.

Q: Why use separate public and private route tables?

A: To give public subnets internet routes while preventing private subnets from using a direct IGW route.

Q: What is the difference between an AZ name and an AZ ID?

A: AZ names are account-specific mappings; AZ IDs identify the underlying Availability Zone consistently across accounts.

Q: What does subnet auto-assign public IPv4 control?

A: Whether eligible resources launched there receive public IPv4 addresses by default.

Q: What are two common NAT Gateway cost components?

A: The hourly NAT Gateway charge and the charge for data processed.

Q: Why should VPC CIDRs be selected carefully?

A: They must avoid overlap with networks used for peering, Transit Gateway, VPN, or on-premises connectivity.

Q: What route allows communication between resources inside the VPC CIDR?

A: The automatically present local route.

Practice Questions

Question 1

A company launches EC2 instances into a subnet whose route table contains 0.0.0.0/0 pointing to an internet gateway. The instances cannot reach the internet. The security group permits outbound traffic, and the network ACL is permissive. What is the most likely missing configuration?

A. A NAT Gateway in the private subnet
B. A public IPv4 address on the instances
C. A second route table association
D. An S3 gateway endpoint

Correct answer: B

Explanation: A route to an IGW makes the subnet public, but an EC2 instance generally also needs a public IPv4 address or Elastic IP for direct internet communication. A NAT Gateway is used for private subnet egress, not required for a public instance.

Question 2

An architect must ensure that application instances in private subnets can download operating-system updates but cannot accept unsolicited inbound connections from the internet. Which design best meets the requirement?

A. Add a default route from the private subnets directly to an internet gateway.
B. Assign public IPv4 addresses to the application instances.
C. Deploy a NAT Gateway in a public subnet and route private subnet egress through it.
D. Add an internet gateway to each private subnet.

Correct answer: C

Explanation: A NAT Gateway provides outbound internet translation for private IPv4 instances while preventing unsolicited inbound internet connections. The NAT Gateway itself must be in a public subnet with a route to an IGW.

Question 3

A network team creates a new private route table and expects two existing private subnets to start using it. Afterward, those subnets still have a default route to an internet gateway. What should the team do?

A. Enable auto-assign public IPv4 addresses.
B. Explicitly associate both private subnets with the new private route table.
C. Attach a second internet gateway to the VPC.
D. Replace the VPC’s CIDR block.

Correct answer: B

Explanation: Creating a route table does not associate it with subnets. The private subnets must be explicitly associated with the new route table. Their previous route-table association must no longer provide the direct IGW route.

Question 4

A company uses AWS Organizations and deploys one workload in each of several accounts. The architecture requires the workloads to be distributed across distinct physical Availability Zones. Which identifier should the architect use when coordinating placement?

A. Availability Zone name, such as us-east-1a
B. Region name, such as us-east-1
C. Availability Zone ID, such as use1-az1
D. Subnet name tag

Correct answer: C

Explanation: Availability Zone names are mapped independently per account. Availability Zone IDs provide a consistent reference for the underlying zone across accounts in a Region.

Question 5

A workload in a private subnet frequently accesses Amazon S3. The organization wants to reduce NAT Gateway data-processing costs and avoid routing this traffic through public internet egress. Which option should be evaluated first?

A. Internet gateway
B. Gateway VPC endpoint for Amazon S3
C. Public IPv4 addresses on the workload
D. Additional public subnets

Correct answer: B

Explanation: An S3 gateway VPC endpoint provides private connectivity from the VPC to S3 without requiring NAT Gateway processing for that traffic. The endpoint must be associated with the relevant route tables and governed by appropriate endpoint and bucket policies.