VPC Security Architecture (Subnets, Public/Private)

Overview

Amazon Virtual Private Cloud (VPC) is the foundational networking service for all AWS resources. A well-designed VPC architecture with proper subnet segregation is critical for security, providing network isolation and controlling traffic flow between resources.

Understanding the difference between public and private subnets, how routing tables work, and when to use each subnet type is essential for the SAA-C03 exam. VPC questions appear across all domains, testing both security and architectural knowledge.

The key principle is defense in depth: place resources in private subnets whenever possible, only exposing what absolutely needs public access. Load balancers and bastion hosts typically go in public subnets, while application servers and databases belong in private subnets.

Architecture Diagram

Key Concepts

What is a VPC?

Public vs Private Subnets

Route Tables

Destination     Target
10.0.0.0/16     local
0.0.0.0/0       igw-xxx

Destination     Target
10.0.0.0/16     local
0.0.0.0/0       nat-xxx

CIDR Planning

How It Works

Multi-Tier VPC Architecture

Recommended Architecture Pattern

A production VPC should span multiple Availability Zones with dedicated subnet tiers:

Tier 1: Public Subnets (DMZ)

• One public subnet per AZ
• Contains: ALB, NAT Gateway, Bastion
• Smallest practical CIDR (/24 or smaller)

Tier 2: Private Application Subnets

• One private subnet per AZ
• Contains: EC2 instances, ECS tasks, Lambda
• Larger CIDR to accommodate scaling

Tier 3: Private Data Subnets

• One private subnet per AZ
• Contains: RDS, ElastiCache, DocumentDB
• Can be isolated (no internet route at all)

Traffic Flow Examples

Inbound Web Request

Internet → IGW → ALB (public subnet) → App Server (private subnet) → RDS (private subnet)

Outbound from Private Subnet

App Server (private subnet) → NAT Gateway (public subnet) → IGW → Internet

Internal Communication

App Server (private subnet) → RDS (private subnet) [stays within VPC]

Creating a Secure VPC

# Create VPC
aws ec2 create-vpc \
  --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=Production-VPC}]'

# Create Internet Gateway
aws ec2 create-internet-gateway \
  --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=Production-IGW}]'

# Attach IGW to VPC
aws ec2 attach-internet-gateway \
  --vpc-id vpc-xxx \
  --internet-gateway-id igw-xxx

# Create Public Subnet
aws ec2 create-subnet \
  --vpc-id vpc-xxx \
  --cidr-block 10.0.1.0/24 \
  --availability-zone us-east-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=Public-1a}]'

# Create Private Subnet
aws ec2 create-subnet \
  --vpc-id vpc-xxx \
  --cidr-block 10.0.10.0/24 \
  --availability-zone us-east-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=Private-1a}]'

# Create public route table
aws ec2 create-route-table --vpc-id vpc-xxx

# Add internet route to public route table
aws ec2 create-route \
  --route-table-id rtb-public \
  --destination-cidr-block 0.0.0.0/0 \
  --gateway-id igw-xxx

# Associate public subnet with public route table
aws ec2 associate-route-table \
  --subnet-id subnet-public \
  --route-table-id rtb-public

# Create NAT Gateway (in public subnet)
aws ec2 create-nat-gateway \
  --subnet-id subnet-public \
  --allocation-id eipalloc-xxx

# Create private route table with NAT Gateway route
aws ec2 create-route-table --vpc-id vpc-xxx

aws ec2 create-route \
  --route-table-id rtb-private \
  --destination-cidr-block 0.0.0.0/0 \
  --nat-gateway-id nat-xxx

Use Cases

Use Case 1: Three-Tier Web Application

Scenario: E-commerce application with web, app, and database tiers.

Architecture:

• Public subnets: Application Load Balancer
• Private app subnets: EC2 Auto Scaling group
• Private data subnets: RDS Multi-AZ, ElastiCache

Use Case 2: Serverless with VPC Resources

Scenario: Lambda functions need to access RDS database.

Architecture:

• Lambda functions deployed in private subnets
• RDS in private data subnets
• NAT Gateway only if Lambda needs internet access

Use Case 3: Hybrid Connectivity

Scenario: On-premises data center needs connectivity to AWS.

Architecture:

• VPN Gateway or Direct Connect attached to VPC
• Private subnets for hybrid workloads
• Route propagation from Virtual Private Gateway

Use Case 4: Isolated Data Processing

Scenario: Sensitive data processing that should never touch internet.

Architecture:

• Private subnets with NO internet route
• VPC endpoints for AWS service access (S3, DynamoDB)
• No NAT Gateway - completely air-gapped from internet

Best Practices

Common Exam Scenarios

Common Pitfalls

Test Your Knowledge

Related Services

Quick Reference

Common CIDR Allocations Example

VPC: 10.0.0.0/16 (65,536 IPs)

Public Subnets:
  10.0.1.0/24  - Public-1a (251 IPs)
  10.0.2.0/24  - Public-1b (251 IPs)
  10.0.3.0/24  - Public-1c (251 IPs)

Private App Subnets:
  10.0.10.0/24 - Private-App-1a (251 IPs)
  10.0.11.0/24 - Private-App-1b (251 IPs)
  10.0.12.0/24 - Private-App-1c (251 IPs)

Private Data Subnets:
  10.0.20.0/24 - Private-Data-1a (251 IPs)
  10.0.21.0/24 - Private-Data-1b (251 IPs)
  10.0.22.0/24 - Private-Data-1c (251 IPs)

Reserved for Future:
  10.0.100.0/24 - 10.0.255.0/24

Key CLI Commands

# Describe VPCs
aws ec2 describe-vpcs

# Describe subnets
aws ec2 describe-subnets --filters "Name=vpc-id,Values=vpc-xxx"

# Describe route tables
aws ec2 describe-route-tables --filters "Name=vpc-id,Values=vpc-xxx"

# Create VPC Flow Log
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-xxx \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs \
  --log-group-name vpc-flow-logs

# Describe NAT Gateways
aws ec2 describe-nat-gateways --filter "Name=vpc-id,Values=vpc-xxx"

VPC Limits

Further Reading

• VPC User Guide
• VPC Security Best Practices
• Subnets Documentation
• VPC with Public and Private Subnets
• NAT Gateway Documentation