VPC, Subnets, and Route Tables

1What a VPC Is

A VPC (Virtual Private Cloud) is an isolated, software-defined network inside a Region — your own private IP address space that nothing else in AWS can reach unless you explicitly wire it up. You define it with a CIDR block (a range of IP addresses):

aws ec2 create-vpc --cidr-block 10.0.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=app-vpc}]'

A /16 gives ~65,000 addresses. Nothing runs directly "in" the VPC — the VPC is just the address space; you then carve it into subnets.

2Subnets Are Tied to One Availability Zone

A subnet is a slice of the VPC's CIDR range, and critically, it lives in exactly one Availability Zone — never spread across AZs. This is why high-availability designs always create at least one subnet per AZ per tier (public, private) rather than one giant subnet.

aws ec2 create-subnet --vpc-id vpc-0123456789abcdef0 --cidr-block 10.0.1.0/24 --availability-zone us-east-1a
aws ec2 create-subnet --vpc-id vpc-0123456789abcdef0 --cidr-block 10.0.2.0/24 --availability-zone us-east-1b

3Route Tables Define "Public" vs. "Private" — Not a Setting

There is no checkbox that makes a subnet "public." A subnet is public purely because its associated route table sends 0.0.0.0/0 (all internet-bound traffic) to an Internet Gateway (IGW). A subnet is private if that same route instead points nowhere useful for the open internet (or to a NAT Gateway for outbound-only access — see the Internet/NAT Gateway topic).

aws ec2 create-route-table --vpc-id vpc-0123456789abcdef0
aws ec2 create-route --route-table-id rtb-0abc123 --destination-cidr-block 0.0.0.0/0 --gateway-id igw-0def456
aws ec2 associate-route-table --route-table-id rtb-0abc123 --subnet-id subnet-0111

Terraform equivalent:

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
}

resource "aws_route_table_association" "public_a" {
  subnet_id      = aws_subnet.public_a.id
  route_table_id = aws_route_table.public.id
}

4The Main Route Table and Local Routes

Every VPC gets an implicit local route (traffic within the VPC's own CIDR range routes directly, always, and cannot be removed) plus a main route table that any subnet uses by default until you explicitly associate it with a different one. Forgetting to associate a subnet with your custom route table means it silently falls back to the main table's rules — a common source of "why can't this subnet reach the internet" confusion.

5CIDR Sizing and Non-Overlap

Subnets within a VPC cannot overlap in address range, and if you ever plan to VPC-peer or connect via Transit Gateway, the two VPCs' CIDR ranges cannot overlap either — this has to be planned up front because it can't be fixed by reconfiguring later without re-addressing everything.

VPC:              10.0.0.0/16   (65,536 addresses)
  public-a:       10.0.1.0/24   (256 addresses, ~251 usable — AWS reserves 5 per subnet)
  public-b:       10.0.2.0/24
  private-a:      10.0.11.0/24
  private-b:      10.0.12.0/24

AWS reserves the first four and the last address in every subnet (network address, VPC router, DNS, future use, broadcast) — a /24 "256 addresses" subnet really gives you 251 usable ones.

6Security Groups vs. NACLs (Preview)

Route tables control where traffic goes; they say nothing about whether it's allowed. That's the job of Security Groups (stateful, attached to instances/ENIs — covered in its own topic) and Network ACLs (stateless, attached to the subnet itself, evaluated in numbered rule order, and the only construct that can explicitly Deny traffic at the network layer). A packet must pass the subnet's NACL AND the resource's security group to be delivered.

⚠️ Common Pitfalls

1. Forgetting to associate a subnet with a custom route table, leaving it silently on the main table — the subnet behaves unexpectedly (often stuck "private" when it was meant to be public) with no error anywhere.
2. Overlapping CIDR ranges across VPCs that are later peered — this cannot be resolved without re-IP'ing one of the VPCs, which is disruptive at any scale.
3. Treating "has a route to an IGW" and "is actually reachable from the internet" as the same thing — an instance in a route-table-public subnet still needs a public IP/Elastic IP AND a security group allowing the inbound traffic; the route table is necessary but not sufficient.
4. Assuming NAT Gateway routes make a subnet "public." A private subnet routing outbound traffic through a NAT Gateway still cannot receive unsolicited inbound connections from the internet — NAT is outbound-initiated only.
5. Sizing subnets too small. A /28 (11 usable addresses after AWS's reservations) fills up fast once you add load balancer ENIs, NAT gateway ENIs, and autoscaled instances — undersized subnets are a frequent "why can't I launch another instance" surprise.

📋 Quick Reference

Concept	What it does
VPC	isolated IP address space in a Region (CIDR block)
Subnet	slice of the VPC CIDR, tied to exactly one AZ
Route table	next-hop lookup by longest-prefix-match; defines public vs private
Local route	implicit, unremovable, routes in-VPC traffic directly
Internet Gateway	the target of 0.0.0.0/0 that makes a route table's subnet "public"
NACL	stateless, subnet-level, ordered rules, can explicitly Deny
Security Group	stateful, instance-level, allow-only

bashCopy

aws ec2 describe-route-tables --filters "Name=vpc-id,Values=vpc-0123456789abcdef0"
aws ec2 describe-subnets --filters "Name=vpc-id,Values=vpc-0123456789abcdef0"

🎤 Interview Q&A

🛠️ Practice exercises

Each exercise is a file in this topic folder. Code exercises are self-checking: run them and make the checks pass.

✅ Check yourself

Source: aws_vpc_subnets_route_tables_theory.md · generated by tools/build_lessons.py