The VPC is the foundation everything else sits on, and networking is where SAA-C03 candidates most often lose marks. The good news is that the model is small — a handful of objects and a single routing rule — and once it clicks, a large family of questions becomes mechanical.
The VPC and its CIDR
A VPC is a logically isolated network in one Region, defined by an IPv4 CIDR block between /16 (65,536 addresses) and /28 (16 addresses). Use private ranges from RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
Two planning rules that repay attention:
- The primary CIDR cannot be changed after creation, though you can add secondary CIDR blocks later.
- Do not overlap with any network you might later connect to — other VPCs, on-premises, partners. Overlapping CIDRs block VPC peering and Transit Gateway routing outright, and the fix is a migration.
Subnets
A subnet is a slice of the VPC CIDR that lives in exactly one Availability Zone. That is the whole reason multi-AZ architectures need multiple subnets.
AWS reserves five addresses in every subnet: the network address, the VPC router, the DNS server, one reserved for future use, and the broadcast address. So a /24 gives you 251 usable addresses, not 256.
Public and private are about routing
There is no "public" switch on a subnet. A subnet is public if and only if its route table sends 0.0.0.0/0 to an internet gateway. That is the entire definition.
The standard three-tier layout, per AZ:
| Tier | Contains | Default route |
|---|---|---|
| Public subnet | Load balancers, NAT gateways, bastion hosts | Internet gateway |
| Private app subnet | Application instances, containers, Lambda ENIs | NAT gateway |
| Private data subnet | RDS, ElastiCache | None, or NAT if outbound access is needed |
Route tables
Every subnet is associated with exactly one route table (the VPC's main route table if you do not associate another). Routing is longest-prefix-match wins: a route for 10.0.1.0/24 beats one for 10.0.0.0/16, which beats 0.0.0.0/0.
The local route covering the VPC CIDR is present in every route table, cannot be deleted, and is why every subnet in a VPC can reach every other subnet by default. Isolation between subnets is enforced with security groups and NACLs, not with routing.
Gateways
| Gateway | Direction | Notes |
|---|---|---|
| Internet gateway (IGW) | Bidirectional, IPv4 and IPv6 | One per VPC. Horizontally scaled and highly available by design; it is not a bottleneck or a failure point. |
| NAT gateway | Outbound only, IPv4 | Managed, scales to 45 Gbps, lives in one AZ — deploy one per AZ for resilience. Charged hourly plus per GB processed. |
| Egress-only internet gateway | Outbound only, IPv6 | The IPv6 equivalent of a NAT gateway. Free. |
| Virtual private gateway (VGW) | Bidirectional | The VPC-side endpoint for Site-to-Site VPN and Direct Connect. |
Placing a NAT gateway in a private subnet. It must live in a public subnet — it needs its own route to the internet gateway to work. And because a NAT gateway is zonal, a single one is a single point of failure for every AZ that routes through it; if that AZ fails, the other AZs lose outbound access too.
NAT gateway versus NAT instance
A NAT instance is a self-managed EC2 instance doing the same job. The exam expects you to prefer the gateway on availability, bandwidth and operational overhead, and to know the two things only a NAT instance can do: act as a bastion host, and support port forwarding. It also needs source/destination check disabled — a detail that appears in questions about NAT instances not forwarding traffic.
Public IP addressing
- Public IPv4 address — assigned from the AWS pool, changes on stop/start. Now charged per hour for all public IPv4 addresses, in use or not.
- Elastic IP — a static IPv4 address you allocate and keep. Charged when not associated with a running instance, which is the classic "why are we paying for unused Elastic IPs" cost question.
- Private IP — from the subnet range, persists through stop/start.
Prefer a load balancer or NAT gateway over per-instance public addresses. Modern guidance is that instances rarely need one at all.
Sizing worth remembering
Do not over-subnet. A /24 per subnet in a /16 VPC gives you 256 subnets of 251 addresses — comfortable for most designs. The failure mode to avoid is a subnet too small for an Auto Scaling group at peak, or too small to hold the elastic network interfaces that Lambda, RDS proxies and interface endpoints consume.