CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Amazon VPC — Networking Foundations: When to Use What (and How the Exam Tests It)
Master Amazon VPC networking essentials for the SAA-C03 exam. Understand when to choose public or private subnets, and key architectural decisions.
Amazon VPC allows you to create a logically isolated network within the AWS cloud. You define IP ranges, subnets, routing, and gateways. This foundational component is critical for any AWS architecture.
When to Choose What
Understanding the roles of public and private subnets is essential. Here’s a simple breakdown:
| Subnet Type | Use Cases | Connectivity |
|---|---|---|
| Public Subnet | Resources that need direct internet access | Route to an Internet Gateway |
| Private Subnet | Resources that don’t require direct access | Outbound via NAT Gateway |
Public Subnet
Use a public subnet when your resources need direct access to the internet. Typical examples include web servers or load balancers. The route to an Internet Gateway allows these resources to send and receive traffic from the internet.
Private Subnet
For resources that do not need direct internet access, such as databases or application servers, a private subnet is ideal. Outbound internet access is achieved through a NAT Gateway. Remember, for high availability, deploy one NAT Gateway per Availability Zone (AZ).
Key Architectural Decisions
Several architectural decisions can significantly impact your design:
- CIDR Sizing: Choose your CIDR block generously. A /16 CIDR provides 65,536 IP addresses. Once set, you cannot reduce the size later.
- VPC Endpoints: Use VPC endpoints to access AWS services privately, avoiding public internet exposure. A Gateway Endpoint is suitable for services like S3 and DynamoDB, while Interface Endpoints work for other services.
- Network Connectivity: Connect different networks through VPC peering (non-transitive), Transit Gateway (hub-and-spoke), VPN, or Direct Connect. Each option has specific use cases and limitations.
Gotchas & Exam Traps
Be aware of common pitfalls that can show up on the exam:
- IP Reservation: AWS reserves the first four and the last IP address in every subnet. This can lead to confusion during subnet planning.
- VPC Peering Limitations: Remember that VPC peering is not transitive. If you need a mesh network, consider using Transit Gateway.
- NAT Gateway Charges: NAT Gateway data processing charges can add up quickly. To avoid costs, leverage VPC endpoints for S3 access instead.
How the Exam Tests This
Exam questions often focus on practical scenarios. Here are a few patterns to look out for:
- Scenario-Based Questions: Expect questions that ask you to choose between public and private subnets based on specific requirements.
- Cost Considerations: Questions may involve financial implications of using NAT Gateways versus VPC endpoints.
- Connectivity Challenges: You might encounter situations where you need to decide between VPC peering and Transit Gateway for connecting multiple VPCs.
The Rule to Remember
Get the subnet and routing model right, and everything downstream, including security and cost, falls into place. Treat the network as the foundation, not an afterthought.
For further preparation, Take the free SAA-C03 mock exam.