A secure enterprise cloud deployment begins with network isolation. In Amazon Web Services, the Amazon Virtual Private Cloud (Amazon VPC) is the foundational software-defined network (SDN) boundary that provisions a private, isolated virtual network topology. Understanding how subnets, route tables, Internet Gateways (IGW), and NAT Gateways interact is mandatory for securing cloud applications against unauthorized public internet exposure.
VPC CIDR Architecture & Multi-AZ Subnet Planning
When provisioning a VPC, the architect assigns a primary IPv4 Classless Inter-Domain Routing (CIDR) block (typically an RFC 1918 private range between /16 and /28, such as 10.0.0.0/16 providing 65,536 private IP addresses).
1.
10.0.1.0: Network address.2.
10.0.1.1: Reserved by AWS for the VPC default router.3.
10.0.1.2: Reserved by AWS for the internal Amazon DNS (AmazonProvidedDNS).4.
10.0.1.3: Reserved by AWS for future operational use.5.
10.0.1.255: Network broadcast address (broadcast is not supported in VPC).A
/24 subnet therefore yields 251 usable IP addresses, not 254.
The Multi-Tier Subnet Topology
Enterprise cloud architectures never deploy application servers or databases directly to public-facing networks. Modern VPCs utilize a multi-tier, multi-Availability Zone (AZ) layout:
| Subnet Tier | Subnet Routing Destination | Public IP Assignment? | Hosted Workloads |
|---|---|---|---|
| Public Subnet | Route 0.0.0.0/0 pointed directly to Internet Gateway (igw-xxxx) |
Yes (Public IPv4 / Elastic IPs) | Public Application Load Balancers (ALB), Bastion Hosts / NAT Gateways |
| Private App Subnet | Route 0.0.0.0/0 pointed to a NAT Gateway (nat-xxxx) |
No (Private RFC 1918 IPs only) | Web servers, backend API microservices, container clusters (ECS/EKS) |
| Isolated DB Subnet | Local VPC route only (zero route to IGW or NAT) | No | Relational databases (Amazon RDS, Aurora), Redis/Memcached clusters |
Internet Gateways (IGW) vs NAT Gateways
Managing outbound and inbound connectivity requires pairing the correct gateway component with subnet Route Tables:
1. Internet Gateway (IGW)
- A horizontally scaled, redundant, highly available VPC component that imposes zero availability risks or bandwidth bottlenecks.
- Performs 1-to-1 Network Address Translation (NAT) between public IPv4 addresses and private instances.
- A subnet is defined as "public" if and only if its associated Route Table contains an explicit default route pointing to an attached Internet Gateway:
0.0.0.0/0 -> igw-xxxx.
2. NAT Gateway
- Enables instances residing in private subnets to initiate outbound connections to the internet (for software package updates, OS patches, or third-party API calls) while preventing external internet clients from initiating inbound connections to those instances.
- Deployed inside a public subnet and allocated a dedicated Elastic IP address.
- Private subnet Route Tables direct their outbound default traffic to the NAT Gateway:
0.0.0.0/0 -> nat-xxxx.
Security Groups vs Network Access Control Lists (NACLs)
AWS enforces traffic filtering using two distinct firewall layers within the VPC:
| Security Attribute | Security Groups | Network Access Control Lists (NACLs) |
|---|---|---|
| Level of Operation | Instance / Elastic Network Interface (ENI) level | Subnet boundary level |
| Statefulness | Stateful: Return traffic is automatically permitted regardless of inbound rules | Stateless: Return traffic must be explicitly allowed via outbound ephemeral port rules |
| Rule Evaluation | All rules evaluated before deciding to permit traffic | Rules processed in strict numerical order (lowest number evaluated first) |
| Deny Rules | Only supports Allow rules (implicit deny all) | Supports explicit Allow and explicit Deny rules |
Cross-Cloud Analogy: AWS VPC vs Microsoft Azure VNet
Engineers operating in multi-cloud environments map these constructs directly to Microsoft Azure:
- An AWS VPC equates to an Azure Virtual Network (VNet).
- An AWS Internet Gateway / Route Table maps to Azure User-Defined Routes (UDR) and Azure Virtual Network Gateways.
- An AWS Security Group maps directly to an Azure Network Security Group (NSG).
Summary
Designing an enterprise Amazon VPC demands a disciplined separation of public and private tiers. By provisioning multi-AZ subnets, deploying NAT Gateways for secure outbound egress, and isolating sensitive databases into completely air-gapped private subnets, cloud engineers construct scalable and fortified cloud network architectures.