Syspirit 
Amazon VPC (Virtual Private Cloud) is an isolated virtual network in an AWS Region: you choose its address range, how it is split into subnets, its routing and its filtering.
🧭 Which component for which need
| 📌 Need | ☁️ Service to use |
|---|---|
| 🌍 Expose a server on the Internet | Public subnet + Internet Gateway + public IP |
| 🔄 Give a private subnet outbound Internet access | NAT Gateway |
| 🌐 IPv6 outbound without inbound connections | Egress-only Internet Gateway |
| 🪣 Reach S3 or DynamoDB without the Internet | Gateway Endpoint |
| 🔌 Reach another AWS service without the Internet | Interface Endpoint |
| 🤝 Connect a few VPCs together | VPC Peering |
| 🚉 Connect many VPCs, VPNs and Direct Connect | Transit Gateway |
| 🏢 Connect a remote site quickly | Site-to-Site VPN |
| 📡 High throughput and stable latency to the datacenter | Direct Connect (VPN as backup) |
| ⛔ Block a specific IP | Deny rule in a NACL |
| 🔍 Understand why a flow is rejected | VPC Flow Logs |
📐 Addressing and sizes
CIDR (Classless Inter-Domain Routing) notation describes an address range: the longer the prefix, the smaller the range.
| 📌 Item | 📊 Value | 💡 Consequence |
|---|---|---|
| 📏 VPC size (IPv4) | From /16 (65,536 IPs) to /28 (16 IPs) | An existing block cannot be resized: add a secondary block instead |
| ➕ IPv4 CIDR blocks per VPC | 5 by default, adjustable up to 50 | The primary block counts toward the quota and cannot be removed |
| 🏠 Private ranges (RFC 1918) | 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 | RFC 1918 defines the private ranges, not routed on the Internet |
| 🚫 Range to avoid | 172.17.0.0/16 | Used by some AWS services (Cloud9, SageMaker AI): address conflicts |
| 🔲 Subnet size (IPv4) | From /16 to /28 | A subnet lives in a single AZ (Availability Zone, isolated datacenter within the Region) |
| 🔢 Subnets per VPC | 200 by default, adjustable | Plan at least one subnet per AZ and per tier (public, private) |
| 🌍 VPCs per Region | 5 by default, adjustable | Raising this quota raises the Internet Gateway quota by the same amount |
| 🎁 Default VPC | 172.31.0.0/16, one /20 subnet per AZ | All its subnets are public: handy for testing, avoid in production |
🔢 Reserved IPs per subnet
AWS reserves 5 addresses in every subnet: the first 4 and the last one. Example with 10.0.0.0/24:
| 📌 Address | 📊 Role |
|---|---|
10.0.0.0 | Network address |
10.0.0.1 | VPC router |
10.0.0.2 | Reserved by AWS (Amazon DNS answers on the VPC base address + 2) |
10.0.0.3 | Reserved by AWS for future use |
10.0.0.255 | Broadcast: not supported in a VPC, reserved anyway |
Consequence: a /28 only offers 11 usable addresses and a /24 offers 251. Interface endpoints and Transit Gateway attachments also take an IP in the subnet: an undersized subnet quickly blocks deployments.
🌐 Public or private subnet
A subnet’s type depends only on its route table.
| 📌 Type | 🛣️ Routes to | 📊 Typical use |
|---|---|---|
| 🌍 Public | IGW (Internet Gateway) | Internet-facing load balancer, bastion, zonal NAT Gateway |
| 🔒 Private | NAT Gateway, or no direct Internet exit | Application servers, databases |
| 🏢 VPN-only | VGW (Virtual Private Gateway) to the remote site | Resources reachable only from the internal network |
| 🧊 Isolated | No destination outside the VPC | Resources that only talk to the VPC |
| 📌 Requirement to reach the Internet | 📊 Detail |
|---|---|
| 🚪 IGW attached to the VPC | One IGW per VPC; free, redundant, no bandwidth constraint |
| 🛣️ Route to the IGW | 0.0.0.0/0 (IPv4) or ::/0 (IPv6) in the subnet’s route table |
| 🏷️ Public address | Public IP or EIP (Elastic IP, fixed public address): without it, no Internet even in a public subnet |
| 🛡️ Filtering | The Security Group and the NACL must allow the flow |
| 💶 Public IPv4 cost | Billed hourly, whether attached or idle |
🛣️ Route tables
| 📌 Item | 📊 Behavior |
|---|---|
| 🗺️ Main route table | Created with the VPC, applies to any subnet without an explicit association |
| 🔗 Association | A subnet has a single table; one table can serve several subnets |
🏠 local route | Covers the VPC CIDR: all subnets reach each other without any added route |
| 🎯 Priority | The most specific route wins (longest prefix match): /32 beats /24 |
| ⚖️ Identical destination | A static route takes priority over a route propagated by VPN or Direct Connect |
| 📏 Routes per table | 500 by default (excluding propagated routes), adjustable up to 1,000 |
Consequence: a subnet created without an association inherits the main route table. If that table routes to the IGW, the subnet becomes public without anyone deciding it.
🚪 NAT Gateway
NAT (Network Address Translation) lets private resources open outbound connections without being reachable from outside.
| 📌 Item | 📊 Value |
|---|---|
| 🏗️ Zonal NAT Gateway | Created in a public subnet with an EIP, redundant within its AZ only |
| 🌐 Regional NAT Gateway | No public subnet required, expands on its own to AZs that have resources (up to 60 min) |
| 🚀 Bandwidth | 5 Gbps, scales automatically up to 100 Gbps |
| 🔌 Connections | 55,000 simultaneous per IP to a single destination (IP, port, protocol) |
| 🛡️ Security Group | Cannot be attached: filter on the instances and in the NACL |
| 🔁 Source ports | 1024-65535, to allow in the NACL |
| 🚫 From a peered VPC | A peered VPC cannot exit through another VPC’s NAT Gateway |
| 🌐 IPv6 equivalent | Egress-only Internet Gateway: free, stateful, blocks inbound connections |
| 🧓 NAT instance | Self-managed EC2, source/destination check must be disabled, AWS NAT AMI no longer maintained |
High availability rule in zonal mode: one NAT Gateway per AZ, and each private subnet routes to the one in its own AZ. With a single NAT Gateway, an outage of its AZ cuts Internet access for all the others. Regional mode solves this but does not handle private NAT and is billed for each AZ it covers.
🛡️ Security Group or NACL
The SG (Security Group) filters at the ENI level (Elastic Network Interface, virtual network card); the NACL (Network Access Control List) filters what enters and leaves the subnet.
| 📌 Criterion | 🛡️ Security Group | 🧱 NACL |
|---|---|---|
| 📍 Level | Resource (ENI) | Subnet |
| ✅ Rule types | Allow only | Allow and Deny |
| 🔄 State | Stateful: the response is allowed automatically | Stateless: the response needs its own rule |
| 🔢 Evaluation | All rules before deciding | By ascending number, stops at the first match |
| 🎁 Default | default SG: inbound from the same SG, all outbound | Default NACL: all allowed; new NACL: all denied |
| 🎯 Possible source | CIDR, prefix list or another SG | CIDR only |
| 📏 Default quotas | 60 inbound and 60 outbound rules; 5 SGs per ENI (up to 16) | 20 rules per direction, adjustable up to 40 |
| 🔗 Association | Several SGs per resource | One NACL per subnet, shareable across subnets |
Neither the SG nor the NACL filters Amazon DNS, DHCP, instance metadata or the Time Sync Service. AWS recommends the SG as the primary control and the NACL as a subnet-level guardrail.
🔌 VPC Endpoints
An endpoint gives access to AWS services without an IGW or NAT: traffic stays on the AWS network.
| 📌 Criterion | 🚪 Gateway Endpoint | 🔌 Interface Endpoint |
|---|---|---|
| 🎯 Services | S3 and DynamoDB only | Most AWS services through PrivateLink, including S3 and DynamoDB |
| ⚙️ Mechanism | Route to a prefix list added to the route table | ENI with a private IP, one subnet per AZ |
| 💶 Cost | Free | Billed per hour per AZ and per GB processed |
| 🏢 Access from the site (VPN, Direct Connect) | No | Yes |
| 🔗 Access from another VPC | No (a peered VPC cannot use it) | Yes, through peering or Transit Gateway |
Rule for S3: Gateway Endpoint for traffic inside the VPC, Interface Endpoint for traffic coming from the remote site. Both can coexist in the same VPC.
🔗 VPC Peering or Transit Gateway
| 📌 Criterion | 🤝 VPC Peering | 🚉 Transit Gateway (TGW) |
|---|---|---|
| 🧩 Model | 1-to-1 link between two VPCs | Central regional virtual router |
| 🔁 Transitivity | None: A-B and B-C do not give A-C | Yes, according to the TGW route tables |
| 🧮 Links for n fully meshed VPCs | n(n-1)/2 (10 VPCs = 45 peerings) | One attachment per VPC |
| 🌍 Scope | Same Region, inter-Region, cross-account | Regional, TGW peering across Regions, sharing through RAM (Resource Access Manager) |
| 🔌 Other attachments | None: no access to the peer’s IGW, NAT, VPN or Direct Connect | VPN, Direct Connect gateway, other TGWs |
| 🧱 Segmentation | Through the choice of links created | Several route tables (isolate DEV and PROD) |
| 🚀 Throughput | No bottleneck and no single point of failure | Up to 100 Gbps per VPC attachment per AZ |
| 💶 Cost | Free to create; free traffic within an AZ, charged across AZs and Regions | Per attachment hour and per GB processed |
| 📏 Default quota | 50 active peerings per VPC, adjustable up to 125 | 5,000 attachments per TGW, adjustable |
Peering rule: CIDRs must not overlap, even partially (hence the value of a shared addressing plan). After acceptance, add the route to the remote CIDR on both sides, otherwise nothing gets through. Within the same Region, an SG can reference an SG from the peer VPC.
🏢 Hybrid connectivity
| 📌 Criterion | 🔐 Site-to-Site VPN | 📡 Direct Connect (DX) |
|---|---|---|
| 🛤️ Transport | IPsec tunnels over the Internet | Private physical link from a Direct Connect location |
| 🔒 Encryption | Yes (IPsec) | Not by default: MACsec on 10, 100 or 400 Gbps dedicated ports (selected sites), or VPN on top |
| 🚀 Throughput | 2 tunnels per connection, up to 1.25 Gbps per tunnel (5 Gbps with Large Bandwidth Tunnel on TGW) | Dedicated: 1, 10, 100 or 400 Gbps; hosted by a partner: 50 Mbps to 25 Gbps |
| ⏱️ Setup | A few minutes | Physical circuit to order (AWS port, cross-connect, carrier) |
| 📉 Latency | Depends on the Internet | Stable |
| 🧱 AWS side | VGW (one VPC) or TGW (several VPCs, ECMP to add up tunnels) | Private, public or transit VIF (Virtual Interface) |
ECMP (Equal-Cost Multi-Path) spreads traffic over several active tunnels, provided dynamic BGP (Border Gateway Protocol) routing is used. The Direct Connect gateway, a global resource, connects one DX connection to VPCs in several Regions without allowing traffic between those VPCs. Robust design: DX as the primary link, VPN as backup, with AWS always preferring the DX path when it is up.
📜 VPC Flow Logs
| 📌 Item | 📊 Detail |
|---|---|
| 🎯 Level | VPC, subnet or ENI (including those of a load balancer, a NAT Gateway or a TGW) |
| 🔎 Filter | Accepted traffic, rejected traffic, or both |
| 📦 Destinations | CloudWatch Logs, S3 (SQL queries with Athena), Data Firehose |
| ⏱️ Delay | Not real time: several minutes before the first records |
| ⚡ Network impact | None: collection happens outside the traffic path |
| ✏️ Changes | Not possible after creation: delete and recreate |
| 🙈 Not captured | Amazon DNS, DHCP, 169.254.169.254 metadata, 169.254.169.123 Time Sync, ARP |
| 💶 Cost | CloudWatch “vended logs” pricing (ingestion and archival) |
Typical use: a flow marked REJECT points to an overly restrictive SG or NACL; enabling the “rejected” filter on the subnet in question gives the answer without a packet capture.