Architecting Secure Cloud Infrastructure: Building a Custom VPC with Public, Private, and Database Subnets
Learn how to design and implement a secure, production-ready AWS Virtual Private Cloud (VPC) featuring isolated public, private, and database tiers using Amazon RDS.
Building secure, scalable cloud architecture is a foundational challenge for modern engineering teams. When designing cloud infrastructure on Amazon Web Services (AWS), relying on the default VPC can quickly become a security bottleneck. Production workloads require strict network isolation to ensure that public-facing components cannot directly communicate with backend databases.
In this guide, we will break down how to design and configure a robust, multi-tier VPC architecture that separates your application traffic across public subnets, private compute subnets, and isolated database subnets.
Architecture Overview
A well-structured VPC divides your network resources across multiple Availability Zones (AZs) for high availability and fault tolerance:
- Public Subnets: House resources that require direct access to and from the internet, such as an Application Load Balancer (ALB) or a NAT Gateway. These subnets route outbound and inbound traffic through an Internet Gateway (IGW).
- Private Application Subnets: Host your core backend applications, containerized workloads (such as Amazon ECS or EKS), or EC2 instances. These instances handle application logic from the load balancer and reach out to the internet via the NAT Gateway for package updates or external API calls, but they are shielded from direct inbound public traffic.
- Isolated Database Subnets: Completely isolated from the internet. These hold your database instances (such as Amazon RDS or Aurora) and only accept inbound traffic originating from your private application subnets.
Step 1: Define the Network & CIDR Block
Start by establishing a IPv4 CIDR block for your VPC. A standard CIDR block like
10.0.0.0/16 provides 65,536 private IP addresses, giving you ample room to scale.- Navigate to VPC Dashboard > Create VPC.
- Select VPC only (or use the automated wizard if preferred).
- Assign a Name tag (e.g.,
Production-VPC). - Set the IPv4 CIDR block to
10.0.0.0/16. - Ensure DNS hostnames and DNS resolution are both set to Enabled.
Step 2: Configure Multi-AZ Subnets
To protect against facility-level outages, distribute your subnets across at least two Availability Zones (e.g.,
us-east-1a and us-east-1b).Subnet Layout Strategy
| Subnet Name | Availability Zone | CIDR Block | Description |
|---|---|---|---|
Public-Subnet-1A | us-east-1a | 10.0.1.0/24 | Inbound traffic & NAT Gateway |
Public-Subnet-1B | us-east-1b | 10.0.2.0/24 | Inbound traffic redundant path |
Private-App-Subnet-1A | us-east-1a | 10.0.10.0/24 | Application compute layer |
Private-App-Subnet-1B | us-east-1b | 10.0.11.0/24 | Application compute layer |
Database-Subnet-1A | us-east-1a | 10.0.20.0/24 | Primary Amazon RDS instance |
Database-Subnet-1B | us-east-1b | 10.0.21.0/24 | Secondary/Standby Amazon RDS instance |
Step 3: Configure Internet Access & Route Tables
Traffic within a VPC is managed using explicit Route Tables.
1. Public Route Table
- Create an Internet Gateway (IGW) and attach it to
Production-VPC. - Create a route table named
Public-RT. - Add a route:
0.0.0.0/0targeting the Internet Gateway ID. - Associate
Public-Subnet-1AandPublic-Subnet-1Bwith this route table.
2. Private App Route Table
- Allocate an Elastic IP (EIP) and provision a NAT Gateway inside
Public-Subnet-1A. - Create a route table named
Private-App-RT. - Add a route:
0.0.0.0/0targeting the NAT Gateway ID. - Associate
Private-App-Subnet-1AandPrivate-App-Subnet-1Bwith this route table.
3. Database Route Table
- Create a route table named
Database-RT. - Do not add any routes to
0.0.0.0/0. Leave only the local target route (10.0.0.0/16->local). - Associate
Database-Subnet-1AandDatabase-Subnet-1Bwith this route table.
Step 4: Implement Firewall Rules with Security Groups
Security groups act as stateful virtual firewalls. To enforce strict boundaries, chain security group references rather than using static IP ranges:
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article