A Virtual Private Cloud (VPC) is a logically isolated section of the cloud where you launch your resources. It solves the problem of controlling network traffic and keeping your infrastructure secure from the public internet. For the ANS-C01 exam, mastering VPC and subnet configurations is foundational because every advanced networking scenario – from hybrid connectivity to service meshes – is built on top of this core concept.
Jump to a section
A simple way to picture Implementing VPC and Subnet Configurations
An enormous apartment building with hundreds of floors and thousands of units.
You are the building manager. The entire building is your 'Virtual Private Cloud' (VPC) – it's your private, isolated space within the city of the cloud provider. You can't see your neighbours' buildings, and they can't see yours. Your first job is to divide this building into separate 'subnets' (sub-networks). You decide that the ground floor is for the lobby and mail room (a public subnet where anyone can come), floors 1-10 are for offices (a private subnet for employees only), and floors 11-100 are for apartments (a private subnet with even stricter rules). You also install a 'router' in the basement – a device that acts as a directory, telling any packet (person with a message) which floor and which room to go to. Before any packet can leave the building to go to another building (the internet), it must pass through a 'gateway' – the main door with a security guard. This guard checks IDs and ensures no unauthorised packets slip out. Without this plan, residents would wander into offices, and deliveries would get lost. The VPC is your building, the subnets are the floor ranges, and the router and gateway are the traffic control systems. You, the architect, decide it all using a 'network configurator' (like the cloud console).
A Virtual Private Cloud (VPC) is a private, virtual network that you define inside a cloud provider’s data centre. Think of it as your own section of the internet that is completely isolated from every other customer. Within this VPC, you create subnets (sub-networks) to segment and organise your resources.
Every VPC spans a single 'Region' (a geographic area, like London or Sydney). Within that Region, you define a range of IP addresses using something called 'Classless Inter-Domain Routing' (CIDR) notation. CIDR looks like '10.0.0.0/16' – this tells the VPC how many IP addresses it can use. The '/16' part means you have over 65,000 possible addresses. You then carve this big pool into smaller pools for each subnet. For example, you might give a subnet the CIDR '10.0.1.0/24', which gives you 256 addresses.
Subnets live inside a single 'Availability Zone' (AZ). An AZ is a physically separate data centre within a Region. Spreading subnets across multiple AZs makes your application resilient – if one data centre goes down, the other still works. Each subnet can be either 'public' or 'private'. A public subnet has a direct path to the internet. A private subnet has no path to the internet by default.
To connect these subnets, you use a 'Virtual Router' – it’s the brain of your VPC. Every VPC has one by default. The router uses 'Route Tables'. A route table is a set of rules, or 'routes', that say: 'If traffic is destined for this network, send it to this device.' For example, a main route table might have a rule: 'Destination 10.0.0.0/16 – Target local'. That means any traffic to an address inside the VPC stays inside the VPC. You can attach different route tables to different subnets, giving each subnet its own traffic rules.
To let traffic in from or out to the internet, you attach an 'Internet Gateway' (IGW) to your VPC. It’s a horizontally scaled, redundant device that acts as a bridge. A public subnet must have a route in its route table that points to the IGW for '0.0.0.0/0' (which means 'any IP address not already defined'). If you have resources that need to go outbound to the internet but should not be directly reachable from the internet, you use a 'Network Address Translation (NAT) Gateway' or a 'NAT instance' in a public subnet. The private subnet’s route table then points 0.0.0.0/0 to the NAT Gateway, which translates the private IP into the NAT Gateway’s public IP and sends the traffic out.
Why does this all exist? Before VPCs, customers had to use public IP addresses for everything, which was insecure and hard to manage. VPCs gave you the ability to build a private, isolated environment that mimics a classic on-premises network but in the cloud. AWS ENTERPRISE customers use VPCs to comply with strict security and compliance requirements, like keeping credit card data in private subnets with no internet access.
For the ANS-C01 exam, you must understand:
How CIDR blocks work and how to choose them (don’t overlap with on-premises networks!).
The difference between public and private subnets.
How route tables determine traffic flow.
How Internet Gateways and NAT Gateways operate.
The role of Availability Zones in subnet placement.
'VPC Peering', 'Transit Gateway', and 'VPC Endpoints' are also built on top of this foundation, so you need to be rock solid on the base.
1. Choose Region and CIDR
Decide which AWS Region your VPC will live in – this affects latency, compliance, and cost. Then choose a primary CIDR block (e.g., 10.0.0.0/16) that does not overlap with any existing network you need to connect to, like an on-premises data centre.
2. Create the VPC
Use the AWS Management Console, CLI, or SDK to create the VPC with your chosen CIDR. In the console, you name it and optionally enable DNS resolution and DNS hostnames. This step establishes the isolated virtual network container.
3. Create Subnets in Different Availability Zones
Divide your VPC’s CIDR into smaller CIDRs for subnets. For high availability, create at least one subnet in two different Availability Zones (e.g., in us-west-2a and us-west-2b). Tag each subnet as 'public' or 'private' based on its routing requirements.
4. Create and Attach an Internet Gateway
Create an Internet Gateway and attach it to your VPC. This component provides the bridge between the VPC and the public internet. Without this attachment, no public traffic can enter or leave the VPC.
5. Configure Route Tables
Create custom route tables for your public and private subnets. For public subnets, add a route '0.0.0.0/0 -> Internet Gateway'. For private subnets, add a route '0.0.0.0/0 -> NAT Gateway' (after creating the NAT Gateway in a public subnet). Attach the correct route table to each subnet.
6. Launch Resources and Test Connectivity
Launch an EC2 instance in the public subnet with a public IP. Launch a database instance in the private subnet with only a private IP. Test by accessing the web server from your browser and verifying the database cannot be reached from the internet. Adjust security groups and network ACLs as needed.
A company called 'GreenLeaf Inc.' is migrating its internal web application to AWS. The application has a public-facing web server and a private database that should never be directly accessed from the internet. The IT professional, Maria, must design the VPC and subnet configuration.
Maria starts by creating a VPC with the CIDR block '10.0.0.0/16'. She thinks ahead: the company’s on-premises data centre uses '10.1.0.0/16', so the VPC CIDR does not overlap – a critical requirement if they ever want to connect the VPC to their office network using 'VPN' or 'Direct Connect'.
Next, she creates three subnets in two different Availability Zones (AZ-a and AZ-b). - In AZ-a, she creates a public subnet '10.0.1.0/24' and a private subnet '10.0.2.0/24'. - In AZ-b, she creates a public subnet '10.0.3.0/24' and a private subnet '10.0.4.0/24'.
She then launches an EC2 instance (a virtual server) in the public subnet. She assigns it a public IP address. She also launches a database instance (like Amazon RDS) in the private subnet – it gets only a private IP.
Maria now configures routing:
A main route table for the VPC (used by default) has a local route for 10.0.0.0/16.
She creates a custom route table for the public subnets and adds a route: '0.0.0.0/0 -> Internet Gateway (igw-12345)'. She attaches this route table to both public subnets.
She creates another route table for the private subnets and adds a route: '0.0.0.0/0 -> NAT Gateway'. The NAT Gateway lives in one of the public subnets and is assigned a static public IP (an Elastic IP). She attaches this route table to both private subnets.
Now the web server can be accessed by customers over the internet. When the web server needs to fetch an update from an external API, it sends traffic to the NAT Gateway, which forwards it. The database, in the private subnet, cannot be reached from the internet – but it can receive traffic from the web server because the private subnet’s route table allows it to send traffic back out to the web server via the local route. Security groups and network ACLs also block unwanted traffic.
Maria then tests by SSH-ing into the web server (using its public IP) and pinging the database’s private IP. It works. She also tries to ping the database’s private IP from her home computer – it fails, exactly as intended. The architecture is secure and functional.
This scenario is directly tested on the ANS-C01. You will be asked to design subnets for high availability, pick CIDRs that don’t overlap with on-premises, and choose whether an Internet Gateway or NAT Gateway is the right component for a given requirement.
The ANS-C01 exam heavily tests your ability to design and troubleshoot VPC and subnet configurations. Expect scenario-based questions where you must choose the correct combination of components.
'CIDR overlap' is a constant trap. The exam will show an on-premises CIDR of 10.0.0.0/8 and ask you to pick a VPC CIDR that does not overlap. The correct answer is usually something like '172.16.0.0/16' – a private IP range that is not in the same block. Do not pick anything with '10.x.x.x' unless it is explicitly non-overlapping or you are told to peer.
Another classic trap: 'public subnet' vs. 'private subnet'. The exam will describe a web server that must be reachable from the internet. The correct answer: place it in a public subnet with an Internet Gateway attached to the VPC and a route to the IGW in the subnet’s route table. If you forget the route table entry, the instance will not be reachable even if it has a public IP.
'NAT Gateway vs. Internet Gateway' – the exam will ask: 'You have a private subnet that needs to download patches from the internet. Which do you use?' Answer: a NAT Gateway in a public subnet. Adding an Internet Gateway to the VPC alone does not help unless the private subnet’s route table has a route to the IGW – but that would make it a public subnet.
'Availability Zone failure' – the exam will present a scenario where all subnets are in a single AZ. The correct solution is to spread subnets across at least two AZs.
Exam topics to memorise:
The default VPC – it exists in each region, has a default CIDR, an Internet Gateway, a default route table, and subnets. Know it exists, but design best practices mean you should create a custom VPC.
The difference between 'Main route table' and 'Custom route table'. The main one is used by default unless you associate a custom one.
VPC CIDR must be between /16 and /28.
You cannot change the CIDR of a VPC after creation.
Subnet CIDR must be within the VPC CIDR.
Reserved IPs in each subnet: the first 4 and the last 1 IP are reserved by AWS. For example, in 10.0.0.0/24, 10.0.0.0, 10.0.0.1, 10.0.0.2, 10.0.0.3, and 10.0.0.255 are reserved.
The 'Internet Gateway' is a horizontally scaled, redundant, and component that must be attached to a VPC.
A 'NAT Gateway' is managed by AWS and is not a security device – you still need Security Groups and Network ACLs.
Trap pattern: 'Which component allows instances in a private subnet to access the internet?' The answer is a NAT Gateway, but the exam might offer 'Internet Gateway' as a distractor. The IGW does not work for private subnets because private subnets do not have a route to the IGW.
Trap pattern: 'You want to allow an on-premises network to connect to your VPC. Which do you need?' The answer could be a Virtual Private Gateway (VPG) plus a VPN connection, but if the question mentions a direct, private connection, it might be AWS Direct Connect. Understand the difference.
A VPC is a logically isolated network in AWS that you define with a CIDR block covering a single Region.
Subnets segment a VPC into smaller networks, each residing in a single Availability Zone.
Route tables control where network traffic is directed; every subnet must have an associated route table.
An Internet Gateway enables public internet access for resources in a public subnet, but is useless without a corresponding route table entry.
A NAT Gateway allows instances in a private subnet to initiate outbound traffic to the internet while preventing inbound connections.
Cannot change primary CIDR after VPC creation, but you can add secondary CIDR blocks.
Every subnet reserves the first four and the last IP address for AWS internal use – plan your IP ranges accordingly.
Spreading subnets across multiple Availability Zones is fundamental for high availability and resilience.
These come up on the exam all the time. Here's how to tell them apart.
Public Subnet
Route table has a route to an Internet Gateway (0.0.0.0/0 -> IGW).
Instances can be directly reachable from the internet if they have public IPs.
Typically used for web servers, load balancers, and bastion hosts.
Private Subnet
Route table does NOT have a direct route to an Internet Gateway; may use a NAT Gateway for outbound.
Instances cannot be directly reached from the internet.
Typically used for databases, application servers, and internal services.
Internet Gateway (IGW)
Attached to a VPC, allows two-way communication between the VPC and the internet.
Instances in public subnets need a route to the IGW to be reachable.
Does not perform Network Address Translation for private IPs.
NAT Gateway (NAT)
Sits in a public subnet to provide outbound-only internet access for private subnets.
Translates private IPs to its own Elastic IP for outbound traffic.
Blocks unsolicited inbound connections from the internet.
VPC Peering
Direct one-to-one connection between two VPCs.
No transitive routing – each VPC must be directly connected.
Simple and free for small-scale cross-VPC communication.
Transit Gateway
Hub-and-spoke architecture for connecting many VPCs and on-premises networks.
Transitive routing is allowed – all connected networks can communicate.
Priced per hour and per GB, best for large, complex networks.
Mistake
A public subnet means any instance placed in it automatically has a public IP address and is reachable from the internet.
Correct
An instance in a public subnet only has public internet access if it is assigned a public IP address (or an Elastic IP) and the subnet's route table has a route to an Internet Gateway, and the security group allows the traffic.
Beginners confuse the subnet's 'public' label with the automatic assignment of a public IP, not realising that the route table and security groups are also required.
Mistake
A NAT Gateway is used to allow inbound traffic from the internet into a private subnet.
Correct
A NAT Gateway only allows outbound traffic from private subnets to the internet, and it blocks any unsolicited inbound traffic from the internet.
The word 'gateway' sounds like it opens in both directions, but NAT is specifically for outbound-only initiated connections.
Mistake
You can change a VPC's CIDR block after it is created if you need to peer with another network.
Correct
Once a VPC is created, its primary CIDR block cannot be changed. You can add secondary CIDR blocks, but the original is fixed.
People assume cloud resources are infinitely flexible; CIDR is a foundational, immutable property of the VPC.
Mistake
Subnets across different Availability Zones within the same VPC can communicate freely without any route configuration.
Correct
Subnets in different AZs within the same VPC can communicate via the VPC's local route (which is in the main route table). No additional gateway or routing is needed.
Learners think AZs are as isolated as separate VPCs, but the VPC's built-in router handles inter-AZ traffic automatically.
Mistake
The default VPC is an ideal production environment because it is already set up.
Correct
The default VPC has public subnets only, lacks customised routing for private workloads, and does not meet many compliance requirements. Always create a custom VPC for production.
The default VPC looks convenient, but it sacrifices the flexibility and isolation needed for real business applications.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
The instance will have only a private IP address and will not be directly reachable from the internet, even though it sits in a public subnet. You need both a public IP and a route to the Internet Gateway.
No. A subnet is either public or private based solely on its route table. If the route table has a route to an Internet Gateway, it is public for all instances in that subnet.
Use a Virtual Private Gateway (VPG) attached to the VPC and set up a VPN connection over the internet, or use AWS Direct Connect for a dedicated private link.
A Security Group acts as a virtual firewall at the instance level – it is stateful and supports allow rules only. A Network ACL acts at the subnet level – it is stateless and supports both allow and deny rules.
The default VPC has pre-defined CIDRs and subnets that might overlap with other networks, lacks custom routing for private workloads, and is not set up for high availability across multiple AZs by default.
Create a NAT Gateway in a public subnet and update the private subnet’s route table to send 0.0.0.0/0 traffic to the NAT Gateway. The NAT Gateway will translate the private IP into its own public IP for outbound traffic.
AWS reserves the first four IP addresses (network address, VPC router, DNS server, and future use) and the last IP address (broadcast address) in every subnet. You cannot assign these to resources.
You've finished Implementing VPC and Subnet Configurations. Continue through the ANS-C01 study guide to build a complete picture of the exam.
Done with this chapter?