AWS VPC, Subnets, Route Tables and Peering Explained

An Amazon Virtual Private Cloud is a logically isolated network in which you choose address ranges, subnets, routes, connectivity, and security controls. A good design begins with non-overlapping CIDR ranges and a clear separation between internet-facing and internal workloads.

Start with valid CIDR planning#

Choose an RFC 1918 range large enough for growth but small enough to avoid unnecessary waste. Subnet CIDRs must be contained inside the VPC CIDR and cannot overlap one another. Reserve capacity for multiple Availability Zones, future environments, and hybrid connectivity.

Public and private subnets#

Route tables decide where traffic goes#

Every subnet is associated with one route table. The local route supports traffic inside the VPC. A public subnet normally has a default route to an internet gateway; a private subnet may send outbound IPv4 traffic to a NAT gateway in a public subnet. More specific routes win over less specific routes.

Security groups and network ACLs#

Security groups are stateful controls attached to resources. Network ACLs are stateless controls applied at the subnet boundary. Use security groups as the primary workload policy, keep rules narrow, and use ACLs where a subnet-level guardrail is justified.

How VPC peering works#

A peering connection provides private routing between two VPCs. Both sides must add routes for the other CIDR and allow the required traffic. Peering is not transitive: if VPC A peers with B and B peers with C, A does not automatically reach C through B. Overlapping CIDRs cannot be peered.

DNS and operational checks#

• Enable the DNS attributes needed by your workloads.
• Verify the correct subnet-to-route-table associations.
• Confirm gateway attachment and NAT gateway placement.
• Check security groups, ACLs, and return paths together.
• Use VPC Flow Logs and Reachability Analyzer to narrow failed paths.

Design checklist#

Spread workloads across Availability Zones, avoid putting databases directly in public subnets, centralize egress only when the operational tradeoff is understood, document every route, and monitor address consumption. For many networks or transitive connectivity, evaluate Transit Gateway instead of building a large peering mesh.

Amazon VPC documentation