DEV Community

Said Olano
Said Olano

Posted on

AWS VPC: Network Architecture Design (2026-08-15 17:02)

#aws #networking #vpc #cloudarchitecture

AWS VPC: Network Architecture Design

Amazon Virtual Private Cloud (VPC) is the networking backbone of any AWS deployment. A well-designed VPC provides security, scalability, and isolation for your workloads. This post walks through the core concepts and best practices for designing production-grade VPC architectures.

What Is a VPC?

A VPC is a logically isolated section of the AWS cloud where you launch resources within a virtual network you define. You control the IP address range, subnets, route tables, and gateways. Each VPC is confined to a single AWS region but can span multiple Availability Zones (AZs).

Planning Your CIDR Block

The first decision is your VPC's CIDR range. Choose an RFC 1918 private range and leave room for growth.

10.0.0.0/16    → 65,536 addresses
172.16.0.0/16  → 65,536 addresses
192.168.0.0/16 → 65,536 addresses
Enter fullscreen mode Exit fullscreen mode

Best practices:

  • Avoid overlapping CIDRs if you plan to use VPC peering or Transit Gateway.
  • Reserve a /16 for large environments; use smaller blocks for isolated accounts.
  • AWS reserves the first four and last IP in every subnet, so account for that.

Subnet Design

Subnets partition your VPC across AZs. A common pattern uses a three-tier layout replicated across multiple AZs for high availability.

Tier Type Example CIDR Purpose
Public Public 10.0.0.0/24 Load balancers, NAT gateways
App Private 10.0.10.0/24 Application servers
Data Private 10.0.20.0/24 Databases, caches

Deploy each tier across at least two AZs to survive an AZ failure:

AZ-a: 10.0.0.0/24 (public), 10.0.10.0/24 (app), 10.0.20.0/24 (data)
AZ-b: 10.0.1.0/24 (public), 10.0.11.0/24 (app), 10.0.21.0/24 (data)
Enter fullscreen mode Exit fullscreen mode

Public vs. Private Subnets

The distinction is defined by routing, not the subnet itself:

  • A public subnet has a route to an Internet Gateway (IGW).
  • A private subnet routes outbound traffic through a NAT Gateway.

Internet Gateway

An IGW allows bidirectional internet access. Attach one per VPC and add a route in the public subnet's route table:

Destination: 0.0.0.0/0 → Target: igw-xxxxxxxx
Enter fullscreen mode Exit fullscreen mode

NAT Gateway

Private subnets that need outbound internet (for patches, API calls) route through a NAT Gateway placed in a public subnet:

Destination: 0.0.0.0/0 → Target: nat-xxxxxxxx
Enter fullscreen mode Exit fullscreen mode

Deploy one NAT Gateway per AZ to avoid cross-AZ data transfer costs and single points of failure.

Route Tables

Route tables control traffic flow between subnets and gateways. Keep them explicit and minimal.

# Public route table
10.0.0.0/16   → local
0.0.0.0/0     → igw-xxxxxxxx

# Private route table (AZ-a)
10.0.0.0/16   → local
0.0.0.0/0     → nat-xxxxxxxx (in AZ-a)
Enter fullscreen mode Exit fullscreen mode

Security Layers

AWS provides two stateful and stateless mechanisms to control traffic.

Security Groups (Stateful)

Attached to ENIs/instances, security groups allow return traffic automatically.

# App tier security group
Inbound:  TCP 443 from ALB-SG
Outbound: TCP 5432 to DB-SG
Enter fullscreen mode Exit fullscreen mode

Network ACLs (Stateless)

NACLs operate at the subnet level and require explicit inbound and outbound rules. Use them for broad subnet-level controls, such as blocking known bad IP ranges.

VPC Endpoints

Endpoints let you reach AWS services privately without traversing the internet.

  • Gateway Endpoints — free, for S3 and DynamoDB via route table entries.
  • Interface Endpoints — powered by PrivateLink, for most other services (billed hourly + data). 
Gateway endpoint route:
pl-xxxxxxxx (S3 prefix list) → vpce-xxxxxxxx
Enter fullscreen mode Exit fullscreen mode

Connectivity Between VPCs

As environments grow, you connect multiple VPCs:

  • VPC Peering — one-to-one, non-transitive connections. Simple but hard to scale.
  • Transit Gateway — a hub-and-spoke model that centralizes routing across many VPCs and on-premises networks.
  • Site-to-Site VPN / Direct Connect — for hybrid connectivity to on-prem data centers.

For more than a handful of VPCs, prefer Transit Gateway to avoid a mesh of peering connections.

Reference Architecture

A typical production VPC design:

                     Internet
                        │
                    ┌───▼───┐
                    │  IGW  │
                    └───┬───┘
              ┌─────────┴─────────┐
         Public Subnet       Public Subnet
          (ALB, NAT)          (ALB, NAT)
              │                   │
         Private App          Private App
          Subnet AZ-a          Subnet AZ-b
              │                   │
         Private Data         Private Data
          Subnet AZ-a          Subnet AZ-b
Enter fullscreen mode Exit fullscreen mode

Design Checklist

  • [ ] Non-overlapping CIDR with room to grow
  • [ ] Subnets across at least two AZs
  • [ ] Private data tier with no internet route
  • [ ] NAT Gateway per AZ

Top comments (0)