Contents
AWS understand · networking · 19
VPC and Subnets
A hand-drawn animated video with a voice and subtitles. Every fact in it comes from the official AWS documentation (listed at the end).
- A VPC is your own private network in AWS, only for your account, kept apart from other networks ("logically isolated").
- A subnet is a smaller range of IP addresses inside the VPC. You launch servers into subnets. Subnets cannot overlap.
- Each subnet sits in exactly one Availability Zone. Use two zones so one zone failing does not stop you.
- AWS keeps 5 addresses in every subnet: a
/24has 256 addresses, you can use 251. - Public subnet = has a direct route to an internet gateway. Private subnet = does not; it needs a NAT device to reach the internet.
Video file: aws-understand/06-networking/19-vpc-and-subnets/video.mp4
The ideas
01The picture, part by part
| AWS word | In the picture | What AWS docs say |
|---|---|---|
VPC | Gated society | A virtual network dedicated to your AWS account, logically isolated from other virtual networks. |
| Subnet | A building | A range of IP addresses in your VPC. You launch resources such as EC2 instances into subnets. |
| IP address | House number | An IPv4 address is 4 groups of numbers, each 0 to 255. Example: 10.0.1.0. |
| Availability Zone | A separate part of the city | Multiple, isolated locations within each Region. |
| Internet gateway | The main gate to the outside | Lets instances connect to the internet. |
Source: how-it-works.html, vpc-ip-addressing.html, EC2 using-regions-availability-zones.html
02Address blocks (CIDR)
| Block | Addresses | Note from AWS docs |
|---|---|---|
/16 | 65,536 | Biggest block allowed for a VPC. Example: 10.0.0.0/16 = 10.0.0.0 to 10.0.255.255. |
/24 | 256 | Example subnet 10.0.0.0/24. You can use 251 (5 kept by AWS). |
/28 | 16 | Smallest block allowed for a VPC or a subnet. |
Address kept by AWS (in 10.0.0.0/24) | Used for |
|---|---|
10.0.0.0 | Network address |
10.0.0.1 | VPC router |
10.0.0.2 | DNS server |
10.0.0.3 | Kept for future use |
10.0.0.255 | Network broadcast address (broadcast is not supported in a VPC) |
Source: vpc-cidr-blocks.html, subnet-sizing.html, vpc-ip-addressing.html
03One subnet, one zone
AWS docs: "Each subnet must reside entirely within one Availability Zone and cannot span zones. By launching AWS resources in separate Availability Zones, you can protect your applications from the failure of a single Availability Zone."
Source: configure-subnets.html ("Subnet basics")
04Public vs private subnet
| Type | Route to an internet gateway? | Reach the internet? |
|---|---|---|
| Public subnet | Yes, a direct route | Yes |
| Private subnet | No | Only through a NAT device |
| Isolated subnet | No routes outside the VPC | No, only reaches resources in the same VPC |
AWS docs recommend private subnets to protect resources, and show a layout with a public subnet for web servers and a private subnet for database servers in each Availability Zone.
Source: configure-subnets.html ("Subnet types", "Subnet security"), security-group-rules.html (example layout)
05Default VPC
Accounts created after December 4, 2013 come with a default VPC in each Region. It has a default subnet in each Availability Zone, an attached internet gateway, and a route that sends all traffic to that gateway, so an EC2 instance launched there can reach the internet. A VPC you create yourself is called a nondefault VPC.
Source: how-it-works.html ("Default and nondefault VPCs")
Reference
—Sources
| What | Where (official AWS docs) |
|---|---|
| How Amazon VPC works | vpc/latest/userguide/how-it-works.html |
| Subnets: types, one AZ each | vpc/latest/userguide/configure-subnets.html |
| Subnet sizes, 5 reserved addresses | vpc/latest/userguide/subnet-sizing.html |
| VPC CIDR blocks /16 to /28 | vpc/latest/userguide/vpc-cidr-blocks.html |
| IP addressing, CIDR notation | vpc/latest/userguide/vpc-ip-addressing.html |
| Regions and Availability Zones | AWSEC2/latest/UserGuide/using-regions-availability-zones.html |