CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Amazon VPC — Networking Foundations
Your private virtual network. Subnets, route tables, gateways, and the security boundary of everything.
What it is
A logically isolated network you define: IP ranges, subnets, routing, and gateways.
Mental model
- Public subnet: route to an Internet Gateway.
- Private subnet: outbound internet via a NAT Gateway (one per AZ for HA).
- Security groups (stateful, instance level) + NACLs (stateless, subnet level).
Key architectural decisions
- Size the CIDR generously (a /16 is 65,536 IPs); you cannot shrink it later.
- Reach AWS services privately with VPC endpoints (Gateway for S3/DynamoDB, Interface for the rest).
- Connect networks with peering (non-transitive), Transit Gateway (hub-and-spoke), VPN, or Direct Connect.
Gotchas & exam traps
- AWS reserves the first four and the last IP in every subnet.
- VPC peering is not transitive — Transit Gateway solves the mesh.
- NAT Gateway data processing charges are a common cost trap; endpoints avoid them for S3.
The architect view
Get the subnet and routing model right and everything downstream — security, HA, cost — falls into place. Treat the network as the foundation, not an afterthought.