VPC, Subnets, Route Tables, NAT

When to use

Define an isolated virtual network with controlled egress and intra-VPC routing.

Analogy

VPC = your private neighborhood. Subnets = streets. Route tables = wall-mounted maps. NAT Gateway = the one exit door to the internet.

Data-flow diagram

  VPC 10.0.0.0/16
    Route Table (per subnet)
      - 10.0.0.0/16  -> local
      - 0.0.0.0/0   -> igw-... (public)  OR nat-... (private)
    +-----------------+    +------------------+
    | Public Subnet   |    | Private Subnet   |
    | 10.0.1.0/24     |    | 10.0.10.0/24     |
    | NAT, ALB        |    | App Servers      |
    +-----------------+    +------------------+

Deep explanation

An Amazon VPC is a logically isolated network (CIDR e.g. 10.0.0.0/16). Subnets partition the VPC into /24 (256 IPs) networks in a single AZ. Public subnets route 0.0.0.0/0 to an Internet Gateway (IGW); private subnets route to a NAT Gateway in a public subnet. Each subnet has one route table. For HA, deploy NAT Gateways across AZs; for cost, share one - at the cost of AZ-failure resilience.

Examples

Example 1

aws ec2 create-vpc --cidr-block 10.0.0.0/16
aws ec2 create-subnet --vpc-id vpc-... \
  --cidr-block 10.0.1.0/24 --availability-zone us-east-1a

creates a VPC and a /24 subnet in one AZ; repeat for additional AZs.

Example 2

aws ec2 create-route-table --vpc-id vpc-...
aws ec2 create-route --route-table-id rtb-... \
  --destination-cidr-block 0.0.0.0/0 --gateway-id igw-...

creates a public route-table (with IGW) and associates it with a subnet.

Example 3

aws ec2 allocate-address --domain vpc
aws ec2 create-nat-gateway --subnet-id subnet-public-1a \
  --allocation-id eipalloc-...

creates a NAT Gateway (per hour + per GB cost). Place one per AZ for HA.

Common mistake

Putting databases in public subnets ‘because the SG is locked down’. Public subnets are reachable from the internet; risky. Using 192.168.0.0/16 (collides with home networks over VPN).

Key takeaway

private subnets for stateful workloads (RDS, ECS tasks); public for ingress only (ALB, NAT, bastion). NAT per AZ in production.

Production Failure Playbook

Failure scenario 1: database-accidentally-public

• Symptom: a security audit found the RDS instance had a public IP.
• Detection: AWS Config rule rds-instance-public-access-check flagged it.
• Root cause: RDS Subnet Group with a public subnet; RDS acquired a public IP.
• Mitigation: rebuild RDS in private subnets only; rotate credentials; review CloudTrail.
• Prevention: RDS Subnet Group validation: only subnet-tier=private accepted.

Failure scenario 2: single-nat-az-failure

• Symptom: us-east-1b went down; instances in 1a private subnet lost egress for 4h.
• Detection: CloudWatch alarm on NAT Gateway status; downstream S3 failed.
• Root cause: only one NAT Gateway in public-1c; when 1c degraded, 1a/1b routed to it.
• Mitigation: failover to surviving NAT (route table edit); bring up a second NAT.
• Prevention: ADR: deploy NAT Gateway per AZ; AWS Config rule checks NAT count >= AZ count.