Internet gateway
IGW and egress-only IGW
An IGW is a horizontally scaled gateway, one per VPC, that performs 1:1 NAT for public IPv4 addresses. An egress-only IGW allows only outbound IPv6 and blocks inbound connection initiation.
Amazon Virtual Private Cloud · Isolated virtual network
Draw your network on AWS with your own IP ranges
Amazon VPC is a logically isolated virtual network within AWS. You choose CIDR blocks, carve subnets in each Availability Zone, and use route tables and gateways to decide where traffic goes. Every other AWS networking service runs on top of it.
Subnet plan · 3 tiers × 2 AZap-northeast-2
vpc 10.0.0.0/162001:db8:1234:1a00::/56
AZ aAZ c
Public
10.0.0.0/240/0 → igw
10.0.1.0/240/0 → igw
App
10.0.16.0/200/0 → nat-a
10.0.32.0/200/0 → nat-c
Data
10.0.64.0/24local · vpce-s3
10.0.65.0/24local · vpce-s3
A subnet belongs to one Availability Zone. Place a subnet for each role in every AZ and separate tiers with route tables.
/16 – /28
IPv4 CIDR block size (IPv6: /44 – /60, default /56)
5
IPv4 addresses AWS reserves in each subnet
100 Gbps
NAT gateway automatic scaling bandwidth
Free
Charge for VPCs, subnets, and route tables themselves
Why Amazon VPC
The starting point for every AWS network
Every resource that needs a private network, from EC2, RDS, and EKS to Lambda VPC connectivity, places an ENI in a subnet inside a VPC. Get the addressing, routing, and access control right once, and later hybrid connectivity and multi-VPC growth become much easier.
Isolate
A network isolated per account and Region
A VPC belongs to one Region and is separated from other VPCs by default. You choose private ranges that don't overlap with on-premises.
Route
The route table is the policy
The route table associated with each subnet decides whether traffic goes to an IGW, NAT, endpoint, peering connection, or TGW.
Control
Two layers of filtering
Apply stateful security groups to ENIs and stateless network ACLs at subnet boundaries. Lock down the whole account with Block Public Access.
Route tables
The route table defines what a subnet is
There is no "public subnet" setting. If the default route points to an internet gateway, the subnet is public; if it points to a NAT gateway or there is none, it is private. Below is an example route table for a private app-tier subnet.
rtb-app-a · not mainlongest prefix match
subnet-app-a 10.0.16.0/2010.0.0.0/16locallocal
0.0.0.0/0nat-0a1b · AZ aNAT
::/0eigw-0c2dEIGW
pl-78a54011 (S3)vpce-0e3f · gatewayVPCE
10.20.0.0/16pcx-0f4a · peer VPCPCX
172.16.0.0/12tgw-01b2 · on-premisesTGW
When a destination matches several routes, the most specific prefix wins. The local route can't be deleted.
local
Traffic inside the VPC always flows
A local route for the entire VPC CIDR is added to every route table automatically. To block traffic between subnets, use security groups or NACLs, not routing.
IGW · NAT
Two ways out to the internet
An IGW handles two-way traffic for resources with public IPs; a NAT gateway handles only outbound IPv4 from private resources. For outbound-only IPv6, use an egress-only IGW.
VPCE · PCX · TGW
Private paths
Gateway endpoints attach through prefix list routes; peering and Transit Gateway attach through CIDR routes. Interface endpoints connect through DNS and ENIs, not routes.
Design tip: Split route tables per AZ by default. Each AZ's private subnets should point to the NAT gateway in the same AZ so that one AZ failure doesn't cut internet egress for the others.
Features
Main features
NAT gateway
Managed NAT
Starts at 5 Gbps and scales automatically to 100 Gbps, with up to 8 IPv4 addresses (55,000 simultaneous connections per destination per address). Comes in public and private types and supports NAT64. Regional mode is created per VPC without a public subnet, expands automatically to AZs where workloads run, and uses up to 32 IPs per AZ. Private NAT is available only in zonal mode.
VPC peering
VPC peering
Connects two VPCs 1:1 over private IPs. It can cross accounts and Regions, but transitive routing isn't supported and overlapping CIDRs can't be connected. To interconnect many VPCs, use Transit Gateway.
VPC endpoints
Gateway and interface endpoints
Reach S3 and DynamoDB through free gateway endpoints, and other AWS services and SaaS through PrivateLink-based interface endpoints, without traversing the internet.
IPAM
VPC IP Address Manager
Divides your organization's IP space into pools, allocates them to accounts and Regions, and monitors overlap and utilization. Also covers BYOIP, Amazon-provided contiguous IPv6 blocks, and Public IP Insights.
Block Public Access
VPC BPA
Authoritatively blocks IGW and EIGW routes per Region. Bidirectional mode blocks both directions; ingress-only mode blocks only inbound and allows NAT and EIGW outbound. Exempt only the VPCs or subnets that need it with exclusions.
Encryption Controls
VPC Encryption Controls
Monitors and enforces encryption in transit for traffic within and between VPCs. In monitor mode, find plaintext flows with the encryption-status field in Flow Logs; in enforce mode, creating resources that don't support encryption is blocked. Only designated resources such as IGWs and NAT can be exclusions.
Route Server
VPC Route Server
Peers over BGP (optionally with BFD) with firewall and router appliances in the VPC and dynamically installs the best routes into subnet and IGW route tables. Routes fail over on appliance failure without scripts.
VPC sharing
Subnet sharing and SG reuse
Share subnets with other accounts in your organization through AWS RAM so several accounts use one VPC. Security groups can be associated with other VPCs in the same account and Region through VPC associations, or shared with participant accounts of a shared VPC.
Security groups vs NACLs
Security groups and network ACLs: what goes where
The two filters aren't substitutes; they're layers you stack. Use security groups for fine-grained allow policies and network ACLs for coarse blocking at subnet boundaries.
| Item | Security group | Network ACL |
|---|---|---|
| Applies to | ENIs (instances, endpoints, load balancers, and so on) | Subnets. Applies to every resource in the subnet |
| State | Stateful. Responses to allowed requests pass regardless of rules | Stateless. Response traffic (ephemeral ports) must also be allowed explicitly |
| Rule types | Allow only | Both allow and deny |
| Evaluation | All rules are evaluated together; traffic is allowed if any rule matches | Rules are evaluated from the lowest number; the first match applies |
| Can reference | CIDRs, prefix lists, other security groups | CIDRs |
| Reuse scope | The VPC it was created in by default. Can be associated with other VPCs in the same Region through VPC associations | Associated only with subnets in one VPC |
| Default behavior | A new security group has no inbound rules and allows all outbound | The default NACL allows all; a new custom NACL denies all until you add rules |
| Main use | Least-privilege traffic between workloads. Express tier-to-tier allows with SG references | Blocking specific ranges, guardrails between subnet tiers |
Design tip: Security group references (for example, App SG → DB SG on 5432) keep the policy intact when IPs change. When you tighten NACLs, don't forget the ephemeral port range for return traffic.
Reference architecture
Three-tier VPC across two AZs
Each tier has one subnet per AZ, and each AZ's app subnet egresses through the NAT gateway in the same AZ. S3 traffic uses a gateway endpoint and other AWS service APIs use interface endpoints, so both stay on private paths.
On narrow screens, swipe the diagram sideways.
Getting started
Steps to design a VPC
- STEP 1
Plan addressing
Choose CIDRs that don't overlap with on-premises or other VPCs. For multiple accounts and Regions, allocate from IPAM pools.
- STEP 2
Create the VPC and subnets
Create tiered subnets in two or more AZs. The console's "VPC and more" option creates them all at once.
- STEP 3
Gateways and routing
Create an IGW and per-AZ NAT gateways (or a regional NAT gateway), and associate a route table with each subnet.
- STEP 4
Filters and endpoints
Split security groups by tier, then add an S3 gateway endpoint and the interface endpoints you need.
- STEP 5
Guardrails and visibility
Prevent unintended internet exposure with Block Public Access, and verify paths with Flow Logs and Reachability Analyzer.
Pricing
Cost components
VPCs, subnets, route tables, IGWs, security groups, and NACLs themselves are free. Costs come from components such as NAT gateways, public IPv4 addresses, endpoints, IPAM, and Encryption Controls, and from data transfer.
| Charge | Billing basis | Notes |
|---|---|---|
| NAT gateway | NAT gateway hours + GB processed (regional mode bills hours for each AZ it expands into) | Partial hours are billed as full hours. Processing charges apply regardless of source or destination, and standard data transfer charges are separate. Routing S3 and DynamoDB traffic through gateway endpoints reduces processing charges. |
| Public IPv4 addresses | Per address per hour | Includes EC2 auto-assigned public IPs, Elastic IPs (in use or idle), and public IPs created by managed services. Private IPv4 and BYOIP addresses aren't charged. The EC2 Free Tier includes 750 hours of public IPv4. |
| IPAM | Free tier at no cost · Advanced tier billed per active managed IP per hour | The Free tier covers a single Region and single account and provides BYOIP, Public IP Insights, private IPv6 management, and more. Private IPv4 management, cross-account pool sharing, and IP history auditing require the Advanced tier. IPs not attached to an ENI aren't charged. |
| Encryption Controls | Per non-empty VPC per hour in monitor or enforce mode | VPCs attached to a transit gateway with Encryption Support enabled are charged even without Encryption Controls turned on (once per VPC per hour). |
| VPC endpoints | Gateway endpoints free · Interface endpoints billed per AZ per hour + GB processed | Interface endpoint charges are billed as AWS PrivateLink charges. |
| Data transfer | GB across AZs, across Regions, and out to the internet | Private IP traffic within the same AZ is free. VPC peering transfer within the same AZ is also free; cross-AZ and cross-Region transfer is charged. |
| Network analysis | Reachability Analyzer analyses · Network Access Analyzer EC2 instance ENIs analyzed · Traffic Mirroring session ENI hours | Flow Logs are billed as ingestion and storage charges in CloudWatch Logs, S3, or Data Firehose. |
Rates vary by Region and usage. See the Amazon VPC pricing page for current rates.
Next step
Decide addressing and routing together in your first design
Bring your target Regions and number of AZs, on-premises ranges, internet exposure scope, and the list of VPCs to connect, and we'll review the CIDR plan and subnet and routing design together.