VPC for SysOps

Amazon Virtual Private Cloud (VPC) lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. Before VPC (introduced in 2009), all EC2 instances shared a flat network (EC2-Classic). VPC gave customers control over IP addressing, routing, and security. Every new AWS account now has a default VPC in each region, but you can create up to 5 VPCs per region (soft limit, can be increased).

A VPC spans all Availability Zones (AZs) in a region. You assign an IPv4 CIDR block (e.g., 10.0.0.0/16) and optionally an IPv6 CIDR block (a /56 from AWS's pool). The CIDR block size must be between /16 and /28. You cannot change the CIDR after creation, but you can add secondary CIDRs (up to 5, with limits). Subnets are subdivisions within a VPC, each residing in a single AZ. Subnet CIDR blocks must be a subset of the VPC CIDR (or secondary CIDR). AWS reserves the first four IP addresses and the last one in each subnet (e.g., for 10.0.0.0/24: .0 network, .1 VPC router, .2 DNS, .3 future use, .255 broadcast).

An IGW is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet. It serves two purposes: a target in your route tables for internet-routable traffic, and performs NAT for instances that have public IPv4 addresses. An IGW supports both IPv4 and IPv6. To make a subnet public, you attach an IGW to the VPC and add a route to the subnet's route table: destination 0.0.0.0/0 (or ::/0 for IPv6) target igw-id. The IGW is not a physical device; it's a logical connection managed by AWS.

A NAT (Network Address Translation) Gateway enables instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating connections with those instances. NAT Gateway is a managed service (scales automatically, up to 45 Gbps). It supports IPv4 only. You must allocate an Elastic IP (EIP) to it. For high availability, deploy one NAT Gateway per AZ. NAT Gateway automatically processes traffic and updates connection tracking. Default timeout for TCP connections is 350 seconds (configurable via idle timeout). NAT Instance is an older, self-managed EC2 instance with source/destination check disabled. Not recommended for production due to single point of failure and manual scaling.

Each subnet must be associated with a route table (explicitly or the main route table). A route table contains routes that determine where network traffic is directed. The most specific route (longest prefix match) wins. Each route table has a local route (e.g., 10.0.0.0/16 local) that cannot be deleted. You can add routes to IGW, NAT Gateway, VPC peering, Transit Gateway, VPN Gateway, etc. If no route matches, traffic is dropped. Route tables are regional resources.

Security Groups (SGs) act as virtual firewalls for instances (stateful). They support allow rules only (no explicit deny). Default SG allows all outbound, denies all inbound. You can reference other SGs or CIDR blocks. SGs evaluate all rules before deciding to allow traffic. Network ACLs (NACLs) are stateless firewalls for subnets. They support allow and deny rules, in numeric order. Default NACL allows all inbound and outbound. Custom NACLs deny all by default. NACLs are evaluated in rule number order (lowest to highest) and the first matching rule is applied.

VPC peering connects two VPCs (in same or different accounts/regions) using AWS's internal network. It's a one-to-one relationship (no transitive peering). You must add routes in both VPCs' route tables to point to the peering connection. Instances in peered VPCs can communicate as if they are on the same network (using private IPs). You cannot create a peering connection between VPCs with overlapping CIDRs. For inter-region peering, traffic stays on the AWS backbone.

Site-to-Site VPN connects your on-premises network to your VPC via encrypted tunnels over the internet. You create a Virtual Private Gateway (VGW) attached to your VPC, and a Customer Gateway (CGW) representing your on-premises router. Two tunnels are created for redundancy (IPsec). AWS VPN supports static or BGP routing (using dynamic routing). Direct Connect provides a dedicated private connection from your on-premises data center to AWS. It reduces network costs and increases bandwidth consistency. You can combine Direct Connect with VPN for encrypted traffic.

VPC endpoints allow private connections to AWS services (S3, DynamoDB, etc.) without traversing the internet. Two types: Gateway Endpoints (for S3 and DynamoDB) and Interface Endpoints (for many other services using AWS PrivateLink). Gateway endpoints are free and use route table entries. Interface endpoints are powered by PrivateLink and cost per hour + data processed. Both keep traffic within the AWS network.

Flow Logs capture IP traffic information for network interfaces in a VPC, subnet, or instance. They can be published to CloudWatch Logs or S3. Flow logs do not capture real-time logs; they are aggregated and delivered periodically (every 10 minutes for CloudWatch, every 5 minutes for S3). Flow logs record the following fields: version, account-id, interface-id, srcaddr, dstaddr, srcport, dstport, protocol, packets, bytes, start, end, action (ACCEPT/REJECT), log-status. Flow logs can help diagnose overly restrictive security group rules or network ACLs.

Transit Gateway acts as a hub for connecting multiple VPCs and on-premises networks. It supports transitive routing and simplifies network architecture. You attach VPCs and VPNs to the Transit Gateway, and create route tables to control traffic flow. Transit Gateway is a regional resource but supports inter-region peering.

A DHCP options set gives you control over the DNS servers, domain name, and NTP servers that EC2 instances use. By default, the VPC uses AmazonProvidedDNS (which resolves to the VPC's DNS server at 169.254.169.253). You can create custom DHCP options sets, but you cannot modify them after creation; you must create a new one and associate it with the VPC.

An Elastic IP (EIP) is a static, public IPv4 address that you can allocate to your account and associate with an instance or NAT Gateway. EIPs are charged when not associated with a running instance (to encourage efficient use). You can have up to 5 EIPs per region (soft limit).

Using AWS CLI:

Verification commands:

VPC integrates with many AWS services:

Understanding these interactions is critical for designing solutions and troubleshooting connectivity issues on the exam.

In enterprise environments, VPCs are the foundation for multi-tier applications. A typical three-tier architecture consists of: a public subnet for load balancers, private subnets for application servers, and private subnets for databases. For example, a financial services company might deploy an internet-facing Application Load Balancer in a public subnet, EC2 instances running a web application in private subnets (with auto scaling), and an RDS MySQL Multi-AZ database in isolated private subnets. The database subnets have no route to the internet; only the application servers can connect to the database via security group allow rules. To meet compliance, VPC Flow Logs are enabled and sent to a centralized S3 bucket for security analysis. The company also uses AWS Direct Connect to connect their on-premises data center to the VPC, with a Virtual Private Gateway and BGP routing for failover.

Another scenario: a SaaS provider needs to isolate multiple customer environments. They create separate VPCs for each customer (or use separate subnets with strict NACLs). They use VPC peering to connect customer VPCs to a shared services VPC (e.g., for Active Directory or monitoring). However, they must ensure CIDRs do not overlap. For large-scale connectivity, they use AWS Transit Gateway to interconnect hundreds of VPCs and on-premises networks, with centralized routing and security appliances.

Common misconfigurations: forgetting to disable source/destination check on NAT instances (not relevant for NAT Gateway), overlapping CIDR blocks in peering, not updating route tables after creating peering, and incorrectly assuming security groups are stateless (they are stateful). Performance considerations: NAT Gateway can handle up to 45 Gbps, but if you need more, distribute traffic across multiple NAT Gateways. For Direct Connect, bandwidth can be 50 Mbps to 100 Gbps; you must order the correct port speed. When troubleshooting, always check route tables, security groups, and NACLs first.

What goes wrong: a common issue is that an instance in a private subnet cannot access the internet because the NAT Gateway is in a different AZ with no route to it, or the NAT Gateway's security group (if using a NAT instance) blocks traffic. Another issue is that flow logs show REJECT traffic because a NACL is blocking the ephemeral ports for outbound responses. Engineers must remember that NACLs are stateless and need separate outbound rules for return traffic.