Understanding AWS VPCs: What I Learned About Subnets, Route Tables, and Internet Gateways
A beginner-friendly explanation of Amazon VPC, subnets, route tables, and Internet Gateways, including how these components work together to connect resources in the AWS Cloud.
Understanding AWS VPCs: What I Learned About Subnets, Route Tables, and Internet Gateways
As I started learning AWS and preparing for the AWS Certified Cloud Practitioner certification, one concept I wanted to understand properly was Amazon Virtual Private Cloud (VPC).
At first, networking concepts such as subnets, route tables, and Internet Gateways seemed confusing. However, understanding how these components work together made AWS networking much easier to follow.
In this article, I'll explain these concepts from a beginner's perspective.
1. What is an Amazon VPC?
An Amazon Virtual Private Cloud (VPC) is a logically isolated virtual network within AWS where you can launch resources such as EC2 instances.
Think of a VPC as your own network inside AWS. You decide its IP address range and configure how resources communicate with one another and with external networks.
For example, you might create a VPC using the IPv4 CIDR block
10.0.0.0/16.This provides a private IP address range that you can divide into smaller networks.
2. What is a subnet?
A subnet is a smaller IP network within a VPC.
You can create multiple subnets to organise resources according to their purpose.
For example:
- Public subnet: Commonly contains resources that need direct internet connectivity, such as a public facing web server.
- Private subnet: Commonly contains application servers or databases that should not be directly accessible from the internet.
A subnet is associated with a single Availability Zone.
One important detail: naming a subnet "public" does not automatically make it public. Its routing configuration determines whether it has a route to an Internet Gateway.
3. What is a route table?
A route table determines where network traffic from a subnet or other associated network resource should go.
Imagine that a route table is a set of directions for network packets.
The local route allows communication within the VPC's IPv4 network.
The default route
0.0.0.0/0 directs traffic destined for other IPv4 addresses to the Internet Gateway.This route alone does not guarantee internet access for every resource. The resource also needs appropriate networking configuration, public addressing where applicable, and security rules that permit the required traffic.
4. What is an Internet Gateway?
An Internet Gateway allows communication between a VPC and the internet when the necessary routing and resource-level conditions are satisfied.
For example, suppose you launch an EC2 instance in a public subnet.
For that instance to communicate directly with the internet using IPv4, you generally need:
- An Internet Gateway attached to the VPC.
- A route to that Internet Gateway in the subnet's route table.
- A public IPv4 address or Elastic IP for the instance.
- Appropriate security group and network ACL rules.
- An operating system and application configuration that permit the required traffic.
If these conditions are not satisfied, simply attaching an Internet Gateway will not make the instance internet-accessible.
5. How do these components work together?
Let's consider a simple web application.
Imagine that you want to host a website on an EC2 instance.
The architecture could look like this:
Internet → Internet Gateway → Public subnet → Web server
The VPC provides the network boundary, the subnet organises the resources, the route table directs traffic, and the Internet Gateway provides the connection between the VPC and the internet.
For a more secure architecture, you could place the database in a private subnet and allow access to it only from the application tier.
The database would not need direct inbound access from the public internet.
This illustrates why understanding VPC networking is important when designing cloud applications.
6. What I learned
The biggest lesson for me was that these components serve different purposes:
- VPC: Defines the virtual network.
- Subnet: Divides the network into smaller networks within Availability Zones.
- Route table: Determines where traffic is directed.
- Internet Gateway: Enables internet connectivity for a VPC when the required configuration is in place.
Understanding the difference between these components makes it easier to reason about AWS architectures and troubleshoot networking problems.
I'm continuing to explore AWS networking as I work towards the AWS Certified Cloud Practitioner certification and build my cloud engineering knowledge.
Conclusion
AWS networking becomes easier to understand when you stop treating each service as an isolated concept and start looking at how the components work together.
My next step is to practise configuring these components in a controlled environment and observe how changing routes and security rules affects connectivity.
If you're also learning AWS, what networking concept took you the longest to understand? I'd love to hear your experience.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article