VPC & Networking

VPC, subnets, and CIDR blocks

A VPC is a logically isolated network in a single AWS region. You assign one or more IPv4 CIDR blocks (e.g. 10.0.0.0/16) and optionally IPv6. Subnets are subdivisions of the VPC CIDR, each mapped to exactly one Availability Zone. Every ENI (EC2, RDS, Lambda in VPC, ALB nodes) gets an IP from its subnet's range.

RFC 1918 private ranges are standard: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. Avoid overlapping CIDRs with on-premises networks or other VPCs you will peer — overlapping ranges block peering.

CIDR sizing rules of thumb

Three-tier network pattern

Production web apps use a three-tier layout across at least two AZs for high availability:

1. Public tier — Application Load Balancer (ALB) faces the internet via an Internet Gateway (IGW). Only load balancers and NAT Gateways live here; never place application servers directly in public subnets.
2. Private app tier — ECS/Fargate tasks, EC2 app servers, Lambda functions (when VPC-attached). Outbound internet (package updates, third-party APIs) routes through NAT Gateway in the public tier. Inbound user traffic arrives only via ALB.
3. Isolated data tier — RDS, Aurora, ElastiCache, Amazon MQ. No route to IGW or NAT — only app-tier security groups can reach database ports.

flowchart TB
  subgraph Internet["Internet"]
    USERS["Users / Clients"]
  end

  subgraph VPC["VPC 10.0.0.0/16"]
    IGW["Internet Gateway"]

    subgraph AZa["Availability Zone A"]
      PUBa["Public Subnet 10.0.1.0/24\nALB + NAT GW"]
      APPa["Private App 10.0.10.0/20\nECS / Lambda"]
      DBa["Isolated DB 10.0.100.0/24\nRDS Primary"]
    end

    subgraph AZb["Availability Zone B"]
      PUBb["Public Subnet 10.0.2.0/24\nALB + NAT GW"]
      APPb["Private App 10.0.20.0/20\nECS / Lambda"]
      DBb["Isolated DB 10.0.101.0/24\nRDS Standby"]
    end
  end

  USERS --> IGW
  IGW --> PUBa
  IGW --> PUBb
  PUBa --> APPa
  PUBb --> APPb
  APPa --> DBa
  APPb --> DBb
  APPa -.->|"outbound via NAT"| PUBa
  APPb -.->|"outbound via NAT"| PUBb

Route table design

Create a three-tier VPC

# Create VPC with DNS support
VPC_ID=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=prod-vpc}]' \
  --query Vpc.VpcId --output text)

aws ec2 modify-vpc-attribute --vpc-id "$VPC_ID" --enable-dns-hostnames
aws ec2 modify-vpc-attribute --vpc-id "$VPC_ID" --enable-dns-support

IGW_ID=$(aws ec2 create-internet-gateway --query InternetGateway.InternetGatewayId --output text)
aws ec2 attach-internet-gateway --internet-gateway-id "$IGW_ID" --vpc-id "$VPC_ID"

# Public subnet AZ-a + route to IGW
PUB_A=$(aws ec2 create-subnet --vpc-id "$VPC_ID" --cidr-block 10.0.1.0/24 \
  --availability-zone eu-west-1a --query Subnet.SubnetId --output text)
RT_PUB=$(aws ec2 create-route-table --vpc-id "$VPC_ID" --query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id "$RT_PUB" --destination-cidr-block 0.0.0.0/0 --gateway-id "$IGW_ID"
aws ec2 associate-route-table --route-table-id "$RT_PUB" --subnet-id "$PUB_A"

# Private app subnet AZ-a + NAT (repeat per AZ for HA)
PRIV_A=$(aws ec2 create-subnet --vpc-id "$VPC_ID" --cidr-block 10.0.10.0/20 \
  --availability-zone eu-west-1a --query Subnet.SubnetId --output text)
EIP=$(aws ec2 allocate-address --domain vpc --query AllocationId --output text)
NAT_A=$(aws ec2 create-nat-gateway --subnet-id "$PUB_A" --allocation-id "$EIP" \
  --query NatGateway.NatGatewayId --output text)
RT_PRIV=$(aws ec2 create-route-table --vpc-id "$VPC_ID" --query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id "$RT_PRIV" --destination-cidr-block 0.0.0.0/0 --nat-gateway-id "$NAT_A"
aws ec2 associate-route-table --route-table-id "$RT_PRIV" --subnet-id "$PRIV_A"

# Isolated DB subnet (no 0.0.0.0/0 route)
DB_A=$(aws ec2 create-subnet --vpc-id "$VPC_ID" --cidr-block 10.0.100.0/24 \
  --availability-zone eu-west-1a --query Subnet.SubnetId --output text)

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"

  name = "prod-vpc"
  cidr = "10.0.0.0/16"
  azs  = ["eu-west-1a", "eu-west-1b"]

  public_subnets   = ["10.0.1.0/24",  "10.0.2.0/24"]
  private_subnets  = ["10.0.10.0/20", "10.0.20.0/20"]
  database_subnets = ["10.0.100.0/24", "10.0.101.0/24"]

  enable_nat_gateway     = true
  single_nat_gateway     = false   # one NAT per AZ for HA
  one_nat_gateway_per_az = true

  enable_dns_hostnames = true
  enable_dns_support   = true

  create_database_subnet_route_table = true
  # database subnets have no internet route by default in this module
}

output "vpc_id" { value = module.vpc.vpc_id }
output "private_subnets" { value = module.vpc.private_subnets }

import * as ec2 from 'aws-cdk-lib/aws-ec2';

const vpc = new ec2.Vpc(this, 'ProdVpc', {
  ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
  maxAzs: 2,
  natGateways: 2, // one per AZ
  subnetConfiguration: [
    { name: 'Public',   subnetType: ec2.SubnetType.PUBLIC,       cidrMask: 24 },
    { name: 'App',      subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, cidrMask: 20 },
    { name: 'Database', subnetType: ec2.SubnetType.PRIVATE_ISOLATED,    cidrMask: 24 },
  ],
});

// ECS service in app tier
new ecs.FargateService(this, 'ApiService', {
  cluster,
  taskDefinition,
  vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
  vpc,
});

Internet Gateway vs NAT

NAT Gateway pricing (us-east-1, check your region): $0.045/hour per NAT Gateway (~$32.85/month per AZ) plus $0.045/GB processed. A single NAT in one AZ is cheaper but creates a cross-AZ failure domain and cross-AZ data charges when private subnets in AZ-b route through NAT in AZ-a.

High availability pattern

Deploy one NAT Gateway per AZ in the public subnet of each AZ. Private subnet route tables in AZ-a point to NAT in AZ-a — never cross-AZ NAT routing in production. If cost is the constraint in dev/staging, a single NAT Gateway is acceptable with the understanding that AZ failure takes outbound internet with it for all private subnets.

IPv6 and Egress-Only Internet Gateway

IPv6 addresses assigned to instances are globally routable. An Egress-Only Internet Gateway allows outbound IPv6 (software updates, external APIs) while blocking inbound connections initiated from the internet — the IPv6 equivalent of NAT for outbound-only, without address translation. Pair with security groups for fine-grained control.

Security groups: stateful firewall

A security group (SG) acts as a virtual firewall for ENIs. Rules are allow-only (no deny rules). Stateful means if you allow inbound TCP 443, the return traffic is automatically permitted — you don't need an outbound rule for the response. Default: all outbound allowed, all inbound denied.

ALB → App → DB reference pattern

Production three-tier apps chain security groups by reference instead of CIDR:

1. ALB SG — inbound 443 from 0.0.0.0/0 (or CloudFront prefix list); outbound to App SG on app port
2. App SG — inbound app port only from ALB SG; outbound to DB SG on 5432 (PostgreSQL) or 3306 (MySQL)
3. DB SG — inbound database port only from App SG; no outbound to internet

{
  "SecurityGroupRules": [
    {
      "Description": "App tier accepts traffic only from ALB",
      "IpProtocol": "tcp",
      "FromPort": 8080,
      "ToPort": 8080,
      "ReferencedGroupId": "sg-alb123456"
    }
  ]
}

Network ACLs: stateless subnet filter

NACLs apply at the subnet boundary. They are stateless — allow inbound AND allow outbound (ephemeral ports) must both be configured explicitly. Rules are numbered (lowest first) and include explicit deny. Default NACL allows all; custom NACLs deny all until you add rules.

Gateway vs interface endpoints

Endpoint policies

Both gateway and interface endpoints support endpoint policies — IAM-style JSON that restricts which API actions and resources can be accessed through the endpoint. Default policy allows full access; tighten to specific buckets, tables, or accounts for defense in depth:

{
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": ["s3:GetObject", "s3:PutObject"],
    "Resource": "arn:aws:s3:::my-app-artifacts/*",
    "Condition": {
      "StringEquals": { "aws:PrincipalAccount": "123456789012" }
    }
  }]
}

PrivateLink

AWS PrivateLink (interface endpoints) also exposes your own services to consumers in other VPCs or accounts via endpoint services (NLB-backed). Consumers create an interface endpoint in their VPC; traffic stays on the AWS network. Use for shared platform APIs, SaaS integrations, and cross-account service consumption without VPC peering.

Gateway endpoint for S3

# Create S3 gateway endpoint and attach to private route tables
VPCE_ID=$(aws ec2 create-vpc-endpoint \
  --vpc-id vpc-0abc123 \
  --service-name com.amazonaws.eu-west-1.s3 \
  --route-table-ids rtb-priv-a rtb-priv-b \
  --query VpcEndpoint.VpcEndpointId --output text)

# Optional: restrict with endpoint policy
aws ec2 modify-vpc-endpoint --vpc-endpoint-id "$VPCE_ID" \
  --policy-document file://s3-endpoint-policy.json

resource "aws_vpc_endpoint" "s3" {
  vpc_id       = module.vpc.vpc_id
  service_name = "com.amazonaws.${var.region}.s3"
  route_table_ids = concat(
    module.vpc.private_route_table_ids,
    module.vpc.database_route_table_ids,
  )

  policy = jsonencode({
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = ["s3:GetObject", "s3:PutObject", "s3:ListBucket"]
      Resource  = [
        aws_s3_bucket.artifacts.arn,
        "${aws_s3_bucket.artifacts.arn}/*",
      ]
    }]
  })
}

resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = module.vpc.vpc_id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = module.vpc.private_subnets
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

import * as ec2 from 'aws-cdk-lib/aws-ec2';

// Gateway endpoint — free, route table based
vpc.addGatewayEndpoint('S3Endpoint', {
  service: ec2.GatewayVpcEndpointAwsService.S3,
  subnets: [{ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }],
});

// Interface endpoint — ECR pull without NAT
vpc.addInterfaceEndpoint('EcrApi', {
  service: ec2.InterfaceVpcEndpointAwsService.ECR,
  subnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
});
vpc.addInterfaceEndpoint('EcrDkr', {
  service: ec2.InterfaceVpcEndpointAwsService.ECR_DOCKER,
  subnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
});

VPC peering

A VPC peering connection links two VPCs with private IP routing. Peering is non-transitive: if VPC-A peers with VPC-B and VPC-B peers with VPC-C, VPC-A cannot reach VPC-C through B. You must create a direct peering connection or use Transit Gateway.

• Same or different accounts, same or different regions (inter-region peering supported)
• CIDR blocks must not overlap
• No transitive routing — no "hub" VPC that forwards for others
• DNS resolution can be enabled to resolve private hosted zone names across peered VPCs
• Update route tables on both sides manually

Transit Gateway (TGW)

Transit Gateway is a regional hub that connects VPCs, VPNs, and Direct Connect. Attachments propagate routes; you control route tables per attachment. Supports hub-and-spoke at scale — dozens of VPCs, cross-account via RAM (Resource Access Manager), and inter-region peering between TGWs.

flowchart TB
  TGW["Transit Gateway\n(hub)"]
  SHARED["Shared Services VPC\nDNS, logging, CI"]
  PROD["Production VPC"]
  STAGE["Staging VPC"]
  DEV["Development VPC"]
  VPN["Site-to-Site VPN\nOn-premises"]

  PROD --> TGW
  STAGE --> TGW
  DEV --> TGW
  SHARED --> TGW
  VPN --> TGW

Routing policies

Private hosted zones

A private hosted zone is associated with one or more VPCs and resolves DNS names only inside those VPCs — e.g. api.internal.mycompany.com → internal ALB. Cross-VPC resolution works via peering/TGW with enableDnsHostnames and private zone association on each VPC. Split-horizon DNS uses the same domain publicly and privately with different records.

Route53 Resolver

For hybrid cloud, Route53 Resolver provides inbound and outbound endpoints:

• Inbound endpoint — on-premises DNS forwards queries for cloud domains to Resolver ENIs in your VPC
• Outbound endpoint — forward VPC queries for on-prem domains (e.g. corp.local) to on-premises DNS servers via forwarding rules
• Resolver rules — conditional forwarding: match domain suffix, forward to target IPs

# CloudFormation / example failover record structure
Resources:
  PrimaryRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref HostedZone
      Name: api.example.com
      Type: A
      SetIdentifier: primary
      Failover: PRIMARY
      AliasTarget:
        DNSName: !GetAtt PrimaryAlb.DNSName
        HostedZoneId: !GetAtt PrimaryAlb.CanonicalHostedZoneID
      HealthCheckId: !Ref PrimaryHealthCheck

  SecondaryRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref HostedZone
      Name: api.example.com
      Type: A
      SetIdentifier: secondary
      Failover: SECONDARY
      AliasTarget:
        DNSName: !GetAtt SecondaryAlb.DNSName
        HostedZoneId: !GetAtt SecondaryAlb.CanonicalHostedZoneID