Skip to main content
LetMeMaster
Search Loading account Sign in

Amazon VPC

Your own isolated network in AWS: CIDR blocks, subnets and reserved addresses, route tables, internet, NAT, and egress-only gateways, IPv6, VPC peering and its limits, VPC endpoints, Flow Logs, Block Public Access, Reachability Analyzer, IPAM, the default VPC, and cost.

9 min read · Last reviewed · SAA-C03

Loading your progress

Sign in to bookmark tutorials and track what you have read.

On this page

What it is

Amazon Virtual Private Cloud (Amazon VPC) lets you launch AWS resources in a logically isolated virtual network that you define. You choose the IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry address ranges, create SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry, configure route tables and gateways, and control traffic with Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry and Network ACLA stateless firewall for a subnet, with numbered allow and deny rules checked in order. Because it is stateless, return traffic needs its own rule, usually for a range of ephemeral ports.Glossary entry. Almost every architecture question on the exam involves a VPC.

This tutorial covers the building blocks and connectivity. For how subnets, NAT gatewayA managed VPC component that lets instances in private subnets start connections to the internet or other networks, while blocking connections started from outside. It is billed per hour and per gigabyte processed.Glossary entry, security groups, and network ACLs work together to secure traffic, see VPC security layers.

Building blocks

  • CIDR (Classless Inter-Domain Routing)A notation for a range of IP addresses: an address, a slash, and the number of fixed leading bits, such as 10.0.0.0/16 for 65,536 addresses. VPCs and subnets are defined by CIDR blocks; the smaller the number after the slash, the larger the range.Glossary entry: a VPC's IPv4 range is between /16 (65,536 addresses) and /28 (16 addresses). You can't resize a CIDR block once it exists. When a VPC runs out of addresses, associate a secondary IPv4 CIDR block (also /16 to /28, not overlapping the existing ones) and create new subnets from it; existing resources keep their addresses. You can also add IPv6 blocks.
  • Subnets: a range of the VPC's addresses in one AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry. Subnets are also /16 to /28. Five addresses in every subnet are reserved: the first four and the last. For example, in 10.0.0.0/24, those are .0 (network address), .1 (VPC router), .2 (reserved by AWS; the DNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entry server is at the VPC range's base plus two), .3 (reserved for future use), and .255.
  • Route tables: decide where traffic goes. Each subnet is associated with one route table; the local route for the VPC CIDR is always present.
  • Internet gateway: lets resources with public IP addresses reach the internet and be reached from it. A subnet is public when its route table sends 0.0.0.0/0 to an internet gateway.
  • NAT gateway: lets resources in private subnets start outbound connections to the internet without being reachable from it. It is a zonal gateway in a public subnet, or a regional NAT gateway that expands across Availability Zones automatically. See VPC security layers.
    • A NAT (Network address translation)Rewriting the IP addresses in packets as they pass through a device, most often so that many private addresses can share one public address to reach the internet.Glossary entry instance is an EC2 instance you run and patch yourself, with FailoverSwitching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.Glossary entry by script; AWS recommends NAT gateways instead.
    • A private NAT gateway has no internet access; it translates addresses for traffic to other VPCs or On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry networks.
  • Egress-only internet gateway: outbound-only internet access for IPv6, since IPv6 addresses are public.
  • DHCP option sets: DNS servers and domain names given to instances.
  • Default VPC: each AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry has one ready to use, with a public subnet in each Availability Zone.
A VPC across two Availability Zones. Each zone has a public subnet with a NAT gateway and a private subnet with EC2 instances that have no public IP addresses. The instances in each zone send outbound traffic to the NAT gateway in the same zone, which sends it to the internet gateway. The public route table sends 0.0.0.0/0 to the internet gateway; each private route table sends 0.0.0.0/0 to the NAT gateway in its own zone.

A NAT gateway in each Availability Zone, with each private subnet routing to the one in its own zone, keeps outbound internet access working if a zone fails.

Connecting VPCs and services

Need Use
Connect two VPCs directly, in the same or another account or Region VPC peering
Connect many VPCs and on-premises networks through a hub AWS Transit Gateway
Reach S3 or DynamoDB privately from inside the VPC, at no charge Gateway VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry
Reach other AWS services, or services in other VPCs, privately Interface VPC endpoint (AWS PrivateLink)
Connect to on-premises networks Site-to-Site VPN or Direct Connect

VPC peering is a one-to-one connection:

  • It is not transitive: if A peers with B, and B with C, A can't reach C through B.
  • It doesn't support overlapping CIDR blocks, and you can't route through the peer's gateways or connections (for example, its internet gateway or VPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entry).
  • Update route tables on both sides.
VPC peering is not transitive. VPC A is peered with VPC B, and VPC B with VPC C, but VPC A can't reach VPC C through VPC B; A and C need their own peering connection.

Gateway endpoints serve only traffic that starts inside their own VPC. On-premises networks (over VPN or Direct Connect), peered VPCs, and other Regions can't use them; give those an interface endpoint for S3 or DynamoDB instead. Both types can exist in the same VPC.

An EC2 instance in a private subnet reaches AWS services without internet access in two ways. Through a gateway endpoint, a route table entry for the service's prefix list sends traffic to Amazon S3 or DynamoDB; it supports only those two services, costs nothing extra, and can't be used from on premises. Through an interface endpoint, a network interface with a private IP address, security group, and private DNS name connects over AWS PrivateLink to services such as Amazon SQS or KMS; it supports most AWS services, has hourly and data charges, and can be reached over VPN or Direct Connect.

VPC sharing uses AWS RAM to share subnets of one VPC with other accounts in the same AWS Organizations organization. The owner account manages the VPC, subnets, route tables, and gateways; participant accounts launch and pay for their own resources in the shared subnets, but can't change the network or see other accounts' resources.

Visibility and guardrails

  • VPC Flow Logs capture IP traffic information for network interfaces, subnets, or VPCs, and publish it to CloudWatch Logs, S3, or Data Firehose. Use them to troubleshoot connectivity and investigate accepted and rejected traffic.
  • VPC Block Public Access blocks internet gateway and egress-only internet gateway traffic across an entire account and Region, in bidirectional or ingress-only mode, with exclusions for specific VPCs or subnets. Ingress-only mode still allows outbound traffic through NAT gateways and egress-only internet gateways; bidirectional mode blocks that too.
  • Traffic Mirroring copies the actual packets, including payloads, from the network interfaces of chosen instances to a security or monitoring appliance (an instance, or a fleet behind an NLB or GWLB), with no agents on the instances. Flow Logs record only metadata about flows, not their contents.
  • Reachability Analyzer tests whether one resource can reach another, and shows which component blocks the path.
  • IPAM plans, tracks, and allocates IP addresses across accounts and Regions to avoid overlaps.

Security, resilience, performance, and cost

Security

  • Keep workloads in private subnets, expose only load balancers publicly, and use security groups and network ACLs.
  • Use VPC endpoints so traffic to AWS services stays off the internet, and Flow Logs for auditing.
  • Lock endpoints down from both sides. An endpoint policy limits what can be reached through the endpoint, for example only one bucket. A bucket policy with the aws:SourceVpce condition key makes the bucket accept requests only through that endpoint, so leaked credentials don't work from outside. Gateway endpoints have no security groups. See AWS PrivateLink.

Resilience

  • Spread subnets across at least two Availability Zones and place redundant resources in each, such as one NAT gateway per Availability Zone or a regional NAT gateway.

Cost

  • VPCs, subnets, route tables, internet gateways, and gateway endpoints have no charge.
  • You pay for:
    • NAT gateways, per hour and per GB.
    • Public IPv4 addresses.
    • Interface endpoints.
    • Data transfer across Availability Zones and Regions.
    • Flow Logs delivery.
  • Gateway endpoints for S3 and DynamoDB can cut NAT gateway costs.

VPC building blocks at a glance

If the requirement is Choose
Public web servers Public subnet with a route to an internet gateway
Private instances need outbound internet for updates NAT gateway
IPv6 outbound only Egress-only internet gateway
Private access to S3 without NAT costs Gateway endpoint
Two VPCs talk privately VPC peering, or Transit Gateway at scale
See accepted and rejected traffic VPC Flow Logs
Inspect full packets, including payloads Traffic Mirroring
VPC is out of IP addresses Secondary IPv4 CIDR block
Other accounts launch resources into one central VPC VPC sharing through AWS RAM
On premises reaches S3 privately S3 interface endpoint, not a gateway endpoint
Ensure no VPC in the account is internet-reachable VPC Block Public Access

Reverse mindmap: when the question points here

Is it an Amazon VPC feature?
  • Addressing
    • Largest and smallest VPC leads to /16 and /28
    • Usable addresses in a /24 subnet leads to 251, five are reserved
    • Avoid overlapping ranges across accounts leads to IPAM
    • VPC is running out of addresses leads to Add a secondary CIDR block
  • Internet access
    • Public subnet leads to Route 0.0.0.0/0 to an internet gateway
    • Outbound only from private subnets leads to NAT gateway
    • Outbound only for IPv6 leads to Egress-only internet gateway
  • Connectivity
    • Two VPCs, non-transitive leads to VPC peering
    • Many VPCs and on premises leads to Transit Gateway
    • S3 or DynamoDB without internet leads to Gateway endpoint
    • Other AWS services privately leads to Interface endpoint
    • S3 from on premises or a peered VPC leads to Interface endpoint, not gateway
    • Bucket reachable only through our endpoint leads to aws:SourceVpce in the bucket policy
    • Many accounts in one central VPC leads to VPC sharing through AWS RAM
  • Visibility and guardrails
    • Investigate rejected traffic leads to VPC Flow Logs
    • Copy packet payloads to an IDS leads to Traffic Mirroring
    • Why can't A reach B leads to Reachability Analyzer
    • Block internet access account-wide leads to VPC Block Public Access
  • Security groups and NACLs leads to VPC security layers tutorial

Key takeaways

  • A VPC is your isolated network: /16 to /28 CIDR blocks, with subnets in single Availability Zones and five reserved addresses per subnet.
  • Route tables decide public vs private: an internet gateway route makes a subnet public; NAT gateways give private subnets outbound access; egress-only gateways do that for IPv6.
  • VPC peering is one-to-one, non-transitive, and needs non-overlapping CIDRs; Transit Gateway connects many networks.
  • Gateway endpoints (S3, DynamoDB) are free but serve only traffic from inside their VPC; interface endpoints use PrivateLink and also serve on-premises networks and other Regions.
  • Flow Logs, Reachability Analyzer, Block Public Access, and IPAM help you see and govern the network.

Sources

Check your understanding

Loading your quiz progress

Sign in to check your understanding with 34 questions on Amazon VPC.

Related tutorials

Glossary Install the app

LetMeMaster is an independent educational project and is not affiliated with or endorsed by Amazon Web Services. Practice results do not predict actual exam outcomes.

© 2026 LetMeMaster. All rights reserved. Content may not be copied or redistributed without permission.

Proudly made in Canada

Add LetMeMaster to your Home Screen

  1. Tap the Share button in your browser's toolbar. In Safari it is at the bottom of the screen, or at the top on iPad.
  2. Scroll down and tap Add to Home Screen.
  3. Tap Add. Open LetMeMaster from its icon on your Home Screen.