AWS VPC: Subnets, Route Tables & Internet Access

A VPC (Virtual Private Cloud) is a logically isolated network in AWS. You define the IP range, subnets, routing, and access controls. All EC2 instances, RDS databases, and most other services run inside a VPC.

VPC & Subnet Concepts

VPC
  - CIDR block: your private IP range, e.g. 10.0.0.0/16 (65,536 IPs)
  - Can have multiple subnets across AZs
  - Default VPC: auto-created per region (172.31.0.0/16), avoid for production

Subnet
  - Subdivision of VPC in a single AZ
  - Public subnet:  has route to Internet Gateway → instances can be internet-facing
  - Private subnet: no route to IGW → instances hidden from internet
  - AWS reserves 5 IPs per subnet (first 4 + last 1)

Typical multi-AZ layout (10.0.0.0/16):
  Public subnet AZ-a:   10.0.1.0/24  (254 usable IPs)
  Public subnet AZ-b:   10.0.2.0/24
  Private subnet AZ-a:  10.0.11.0/24
  Private subnet AZ-b:  10.0.12.0/24
  DB subnet AZ-a:       10.0.21.0/24
  DB subnet AZ-b:       10.0.22.0/24

Route Tables & Internet Gateway

# Create VPC
aws ec2 create-vpc --cidr-block 10.0.0.0/16
# Note the VpcId

# Create subnets
aws ec2 create-subnet   --vpc-id vpc-0abc123   --cidr-block 10.0.1.0/24   --availability-zone us-east-1a
  # Note SubnetId

# Internet Gateway (IGW) — enables public internet access
aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway   --internet-gateway-id igw-0abc123   --vpc-id vpc-0abc123

# Route table for public subnets
aws ec2 create-route-table --vpc-id vpc-0abc123
# Add route: all traffic → IGW
aws ec2 create-route   --route-table-id rtb-0abc123   --destination-cidr-block 0.0.0.0/0   --gateway-id igw-0abc123
# Associate with public subnet
aws ec2 associate-route-table   --route-table-id rtb-0abc123   --subnet-id subnet-0abc123

# Enable auto-assign public IP on public subnet
aws ec2 modify-subnet-attribute   --subnet-id subnet-0abc123   --map-public-ip-on-launch

NAT Gateway (Private Subnet Outbound)

A NAT Gateway lets instances in private subnets initiate outbound internet connections (for updates, APIs) without being reachable from the internet.

# Create Elastic IP for NAT Gateway
aws ec2 allocate-address --domain vpc

# Create NAT Gateway in PUBLIC subnet
aws ec2 create-nat-gateway   --subnet-id subnet-0public123   --allocation-id eipalloc-0abc123

# Add route in PRIVATE subnet route table → NAT Gateway
aws ec2 create-route   --route-table-id rtb-0private123   --destination-cidr-block 0.0.0.0/0   --nat-gateway-id nat-0abc123

# NAT costs: ~$0.045/hour + $0.045/GB data processed
# For dev: use NAT Instance (cheaper) or VPC Endpoints for S3/DynamoDB (free egress)

# VPC Endpoint (free access to S3 without internet)
aws ec2 create-vpc-endpoint   --vpc-id vpc-0abc123   --service-name com.amazonaws.us-east-1.s3   --route-table-ids rtb-0private123