What I have learned about VPC on AWS

This is the eighth post of content for preparing yourself for becoming an AWS Solutions Architect Associate.

In this post, we are going to focus on VPCs and networking features within AWS.

As I have done previously let’s look at the similarities and differences to the closest equivalent in Azure. As I go through this section, I will point out some of the similar platforms.


Virtual Private Cloud that provisions your own network configuration within the AWS datacenter. On Azure, a VPC would be a combination of Resource group and virtual network (VNet).

VPCs are regional and a subnet cannot be on multiple availability zones. Can create public and private subnets. Can create on private network ranges (,, Cannot create a subnet range any larger than /16 and /28 is the smallest.

Network ACL are stateless with allow and deny rules.

Default VPC allows you to immediately deploy instances. All subnets in default VPC have a route to the Internet. Each EC2 instance has a public and a private IP address.

Custom VPC requires additional configuration and routing rules.

VPC peering - connect one VPC to another on the same or different AWS accounts. Peering is a star configuration with no transitive peering.

Custom VPC

When creating a Custom VPC, the following is created:

Subnet and Internet Gateway is not created by default.

Subnets cannot span multiple availability zones.

AWS does reserve 5 IP addresses, same with Azure for network address, VPC router, broadcast, DNS, and one future.

For a subnet to have a public IP address, you need to modify the IP assignment to enable public IP assignment to instances when created.

Internet gateway needs to be created and then attached to a VPC.

After Internet gateway is created, you need to create a Route table for the VPC and configure the route to the Internet. The default Route table for the VPC should be left with it’s default private routing as a best practice.

Route to the Internet is associated with the Internet Gateway. Associate the route table to the subnet that you want to make public under Subnet associations.

Security groups do not span VPCs and one security group cannot communicate with another.

Instances can be moved to be associated to different security groups.


NAT - Network Address Translation

Do not want to make instances public to the Internet, but do need the ability to go out to the Internet to get software updates.

NAT Instances is an EC2 instance and are out of date. Source and destination checks must be disabled for an EC2 NAT instance to work. NAT instances are not highly available or resilient, and can also become a bottleneck to traffic to the Internet. Must be in a public subnet with a route to the Internet. Always behind a security group.

NAT Gateways are used to address this issue. Route table will point to the NAT Gateway. Redundant within the availability zone but cannot span AZs. No need to patch. Not associated to a security group and automatically assigned a public IP address.

Best practice is to have multiple NAT Gateways with a AZ independent architecture for high availability.

Network access control lists (ACL) v Security Groups

Network ACLs are associated to the VPC and subnets within that VPC.

Network access control lists are similar to the rules of a Network Security Group (NSG) within Azure.

Elastic Load Balancers (ELB) and Custom VPCs

Internet facing or internal load balancers are available. Internet facing load balancer requires an Internet gateway. A minimum of two (2) public subnets are required to create a ELB.

VPC Flow Logs

Amazon CloudWatch logs store all network traffic. Traffic flows can be reviewed at the following levels:

Need a log group within CloudWatch to send logs to CloudWatch. Can send logs to a S3 bucket as well.

Network flow logs are similar to NetworkWatcher within Azure Monitor.

Peered VPCs must be within the same AWS account.

Cannot change a flow log configuration once it is created.

Amazon DNS, DHCP traffic is not tracked.


Bastion is a special purpose computer that is hardened to withstand attacks and allows access from untrusted devices.

Bastion is configured on a public subnet that allows management ports. Bastion allows connection to the private subnet instances for a management port connnection.

In AWS, Bastion is more of a jump box configuration rather than the Azure Bastion.

Direct Connect

Direct Connect is the cloud service that creates a dedicated connection between the on-premises to the AWS datacenter. Direct and private connection on dedicated ISP connection.

High throughput, stable, reliable connection to AWS.

Connection from the Direct Connect partner cross-connect across the AWS backbone and then connect the last mile to company on-premises with a MPLS connection.

Steps to create Direct Connnect:

  1. Create a virtual interface in Direct Connect console. The Public Virtual Interface.
  2. In the VPC console VPN connections, create a Customer Gateway.
  3. Create a Virtual Private Gateway within your VPC.
  4. Attach the Virtual Private Gateway to the VPC.
  5. Select the VPN connections and create a new VPN connection.
  6. Select the Virtual Private Gateway and the Customer Gateway.
  7. Once the VPN is available, set up the VPN on the customer gateway or firewall.

Global Accelerator

VPC Endpoints

AWS PrivateLink

AWS Transit Gateway

AWS VPN CloudHub

AWS Network costs


I hope that you are enjoying this information so far. It is helping me to continue to comprehend these services as I prepare for the exam myself. Thank you very much.

Reference links:

What I’ve Learned about IAM on AWS


What I’ve Learned about S3 on AWS


What I’ve Learned about EC2 on AWS


What I’ve Learned about EBS on AWS


What I’ve Learned about Cloudwatch on AWS


What I’ve Learned about RDS on AWS


What I’ve Learned about Route 53 on AWS


What I’ve Learned about VPC on AWS


What I’ve Learned about High Availability on AWS


What I’ve Learned about Applications on AWS


What I’ve Learned about Security on AWS


What I’ve Learned about Lambda and serverless on AWS