VPC Architecture and CIDR Planning
A Virtual Private Cloud (VPC) is an isolated virtual network within a cloud provider that gives you full control over IP addressing, routing, and connectivity. When designing a VPC, the first critical decision is selecting a CIDR block. The CIDR block defines the IP address range available for all resources within the VPC. AWS supports CIDR blocks from /16 (65,536 IPs) down to /28 (16 IPs), though the practical recommendation is to start with at least a /16 for future flexibility. You cannot change a VPC's CIDR after creation, so careful planning is essential.
Subnet sizing follows a hierarchical model: subnets are carved from the VPC CIDR and must not overlap. A common approach allocates /24 subnets (256 IPs each) per availability zone for public tiers, and /20 or /18 blocks for private workloads where containerized or auto-scaled applications will run. Remember that AWS reserves five IPs in every subnet — the network address, broadcast address, and three for AWS infrastructure (DNS, VPC router, and future use). A /24 subnet actually provides 251 usable IPs.
Public subnets have a route to an Internet Gateway (IGW) via the 0.0.0.0/0 route entry in their associated route table. Private subnets have no direct internet route and rely on a NAT Gateway or NAT Instance for outbound internet access. The NAT Gateway is placed in a public subnet with an Elastic IP, and private subnet route tables point 0.0.0.0/0 to this NAT Gateway. This architecture ensures private resources can pull updates, access APIs, and communicate externally without being directly reachable from the internet.
Three-tier architectures separate presentation (public subnets with load balancers), application (private subnets with compute), and data (private subnets with databases) layers. Each tier resides in its own subnet range across multiple AZs for high availability. This segmentation limits blast radius and simplifies security group rules. Two-tier architectures combine the application and data layers into a single private tier, suitable for simpler workloads. Regardless of pattern, always design for at least three AZs, distribute subnets evenly, and reserve address space for future services like VPC peering or transit gateway connections.
Quiz
1. How many usable IP addresses does a /24 subnet provide in AWS?
2. Which component allows private subnet resources to access the internet for outbound traffic?
3. What is the primary reason to use a /16 CIDR block for a VPC?
Flashcards
Question
What is a VPC?
Click to reveal answer
Answer
An isolated virtual network in the cloud where you control IP addressing, subnets, route tables, and gateways.
Question
What is the difference between a public and private subnet?
Click to reveal answer
Answer
A public subnet has a route to an Internet Gateway (0.0.0.0/0 → IGW). A private subnet has no internet route and uses NAT for outbound traffic.
Question
How many IPs does AWS reserve in each subnet?
Click to reveal answer
Answer
5 IPs: network address, broadcast address, VPC router, DNS server, and one reserved for future use.
Question
What is a NAT Gateway?
Click to reveal answer
Answer
A managed service in a public subnet that provides outbound internet connectivity for resources in private subnets, using an Elastic IP.
Question
What is a three-tier VPC architecture?
Click to reveal answer
Answer
Separates public (load balancers), application (compute), and data (databases) layers into distinct subnets across multiple AZs.
Revision Notes
Key Takeaways
- 1. VPC CIDR cannot be changed after creation — plan carefully
- 2. Always reserve 5 IPs per subnet for AWS infrastructure
- 3. Use NAT Gateways in public subnets for private subnet outbound access
- 4. Design for at least 3 AZs with evenly distributed subnets
- 5. Three-tier architecture separates public, application, and data layers
Interview Tips
- • Explain why you would choose a /16 over a /24 for a VPC
- • Describe the difference between public and private subnets with route tables
- • Walk through IP address planning for a multi-AZ deployment
- • Discuss when to use NAT Gateway vs NAT Instance
Cheat Sheet
VPC = isolated network. CIDR defines IP range (can't change). Public subnets route to IGW. Private subnets route to NAT Gateway. Always plan for 3 AZs. Reserve 5 IPs per subnet. Three-tier: public → application → data.