3.4.1. VPC Components (Subnets, Route Tables, IGW, NAT Gateway)

💡 First Principle: VPC components (subnets, route tables, Internet Gateways, NAT Gateways) provide the building blocks for an isolated, customizable virtual network, enabling SysOps Administrators to control network topology and traffic flow.

Scenario: You need to set up a new VPC for an application. It will have public web servers accessible from the internet and private database servers that can only access the internet for outbound updates.

The Amazon Virtual Private Cloud (VPC) is the foundational networking service in AWS, allowing you to define your own virtual network in isolation. SysOps Administrators manage these components to ensure proper connectivity and security.

Key VPC Components:

• VPC: (A logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define.) Your private, customizable network in AWS.
• Subnets: (Subdivisions of a VPC defined by CIDR blocks.) You define public subnets (for internet-facing resources) and private subnets (for internal resources).
• Route Tables: Control where network traffic from a subnet or gateway is directed. Each subnet must be associated with a route table.
• Internet Gateway (IGW): (A horizontally scaled, redundant, and highly available VPC component.) Allows communication between your VPC and the internet for IPv4 traffic. Attached to the VPC.
• NAT Gateway: (A highly available, managed Network Address Translation (NAT) service.) Allows EC2 instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while remaining isolated from inbound internet connections.
• Egress-Only Internet Gateway: For IPv6 traffic. Allows outbound-only internet connectivity for private IPv6 subnets.

⚠️ Common Pitfall: Not associating a route table with a subnet, or misconfiguring routes, leading to connectivity issues.

Key Trade-Offs: Public subnets (direct internet access, but higher exposure) versus private subnets (isolated, but require NAT Gateway for outbound internet).

Practical Implementation: A simplified VPC setup in CloudFormation (YAML):

Resources:
  MyVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
  MyPublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs '']
  MyInternetGateway:
    Type: AWS::EC2::InternetGateway
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref MyVPC
      InternetGatewayId: !Ref MyInternetGateway
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref MyVPC
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref MyInternetGateway
  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref MyPublicSubnet
      RouteTableId: !Ref PublicRouteTable

Reflection Question: How would you use VPC components like public/private subnets, Internet Gateways, NAT Gateways, and route tables to control network topology and traffic flow, ensuring both internet accessibility for web servers and privacy for databases?