VPC Design

Subnet design, CIDR planning, route tables, internet gateway, NAT gateway, and multi-tier architectures.

Overview

A VPC (Virtual Private Cloud) is an isolated virtual network in AWS. Every VPC has a CIDR block (e.g., 10.0.0.0/16) defining its address space. Subnets are subdivisions of the VPC CIDR, each tied to one Availability Zone.

Subnet types

Public subnets — route table has a route to an Internet Gateway (IGW). Resources need a public or Elastic IP for direct internet connectivity.
Private subnets — no IGW route. Outbound internet access goes through a NAT Gateway deployed in a public subnet. Inbound internet access is not possible.
Isolated subnets — no internet route at all. Used for databases (RDS, ElastiCache) and internal services.

CIDR planning

CIDR is hard to undo — plan carefully upfront. AWS reserves 5 IPs per subnet (network address, VPC router, DNS, future use, broadcast). A /24 has 251 usable IPs; a /28 has only 11. ECS tasks, Lambda VPC functions, and Kubernetes pods each consume an ENI IP. Plan for 2-3x your expected peak.

Avoid CIDR conflicts with on-premises networks if you plan VPN or Direct Connect.

Multi-tier architecture

Public subnet — ALB, NAT Gateway, bastion host
Private-app subnet — ECS tasks, EC2 application servers
Private-data subnet — RDS, ElastiCache (no internet route)

Security groups chain the tiers: ALB SG allows 0.0.0.0/0:443 → app SG allows only from ALB SG → data SG allows only from app SG.

NAT Gateway per AZ

A NAT Gateway is single-AZ. If you use one NAT Gateway for all private subnets, an AZ failure takes out internet connectivity for all private subnets. Best practice: deploy one NAT Gateway per AZ and configure each AZ's private route table to use its local NAT Gateway.

Key concepts

Internet Gateway (IGW): Horizontally scaled, redundant gateway attached to a VPC. Resources in public subnets use it for inbound and outbound internet traffic (requires Elastic IP or public IP).
NAT Gateway: Managed NAT device in a public subnet. Allows private subnet resources to initiate outbound internet connections without exposing inbound ports. Single-AZ — deploy one per AZ for HA.
Route table: Per-subnet routing rules. Main route table applies to all unassociated subnets. Custom route tables for public (with IGW route) and private (with NAT route) subnets.
VPC Endpoint: Private connection between VPC and AWS services (S3, DynamoDB, SSM) without internet. Gateway endpoints (S3, DynamoDB) are free. Interface endpoints use PrivateLink (per-hour + data cost).
Security group vs NACL: Security groups: stateful, instance-level, allow rules only, evaluated as a set. NACLs: stateless, subnet-level, allow and deny rules, evaluated in order by rule number.

When to use it

Designing a multi-tier VPC for a new AWS workload from scratch
Explaining why private subnets still need a NAT Gateway for outbound internet
Calculating the right subnet CIDR size for a Kubernetes cluster node pool
Avoiding cross-AZ NAT Gateway traffic costs by deploying per-AZ NAT

Interview questions

Design the VPC architecture for a three-tier web application that must be highly available across two AZs.
What is the difference between VPC peering, Transit Gateway, and PrivateLink? When do you use each?