Introduction

Modern cloud architectures require strict network isolation to safeguard sensitive databases and application workloads from unauthorized access. Amazon Web Services provides this network layer through Amazon Virtual Private Cloud (AWS VPC).

In this tutorial, we will explain the fundamental components of an AWS VPC and demonstrate step-by-step how to build a multi-AZ custom network equipped with public and private subnets, internet gateways, and route tables.

What is an AWS VPC and Why Do You Need It?

An AWS Virtual Private Cloud (VPC) is a logically isolated virtual network dedicated to your AWS account. It gives you complete control over your cloud networking environment, including IP address selection, subnet creation, and route table configuration.

Key Components of an AWS VPC Architecture

Before provisioning your network, it is important to understand how core VPC components interact:

• Subnets: Smaller network segments inside a VPC defined by a subset of the main CIDR block.
  • Public Subnet: Connected directly to an Internet Gateway to host public-facing resources like web servers or load balancers.
  • Private Subnet: Isolated from direct internet access. Ideal for internal backend applications, microservices, and databases.
• Internet Gateway (IGW): A horizontally scaled, highly available VPC component that enables communication between public subnets and the internet.
• Route Tables: Set of network rules (routes) that determine where network traffic from subnets or gateways is directed.
• NAT Gateway: A Network Address Translation service that permits instances in a private subnet to connect to the internet (for software updates) while blocking inbound internet traffic.
• Security Groups & NACLs: Firewalls protecting your environment. Security Groups operate at the individual instance level (stateful), whereas Network Access Control Lists (NACLs) operate at the subnet level (stateless).

Hands-On Guide: Building a Multi-AZ Custom VPC

Step 1: Create a Custom VPC with a Private CIDR Block

First, define the main virtual network container using a standard RFC 1918 private IPv4 block:

• Sign in to the AWS Management Console and search for VPC.
• Click Your VPCs on the left menu, then click Create VPC.
• Choose VPC only and configure the settings:
  • Name tag: MyDemoVPC
  • IPv4 CIDR block: 10.0.0.0/16 (Provides 65,536 private IP addresses)
• Leave tenancy as Default and click Create VPC.

Step 2: Provision Public and Private Subnets Across Multiple AZs

Next, divide your main /16 network block into four /24 subnets across two Availability Zones:

• Navigate to Subnets in the VPC Console and click Create subnet.
• Select MyDemoVPC as your VPC ID.
• Configure two Public Subnets:
  • Public-Subnet-1: AZ: us-east-1a | IPv4 CIDR: 10.0.1.0/24
  • Public-Subnet-2: AZ: us-east-1b | IPv4 CIDR: 10.0.2.0/24
• Configure two Private Subnets:
  • Private-Subnet-1: AZ: us-east-1a | IPv4 CIDR: 10.0.3.0/24
  • Private-Subnet-2: AZ: us-east-1b | IPv4 CIDR: 10.0.4.0/24
• Click Create subnet to finalize subnet provisioning.

Step 3: Attach an Internet Gateway to your custom VPC

To allow public subnets to exchange inbound and outbound traffic with the internet, attach an Internet Gateway:

• In the left panel, select Internet Gateways > Click Create internet gateway.
• Set the Name tag to MyInternetGateway and click Create internet gateway.
• Select your newly created gateway > Click Actions > Choose Attach to VPC.
• Choose MyDemoVPC from the dropdown list and click Attach internet gateway.

Step 4: Configure Public and Private Route Tables

Now, establish traffic pathways by linking subnets to dedicated route tables

• Navigate to Route Tables > Click Create route table.
• Create a Public Route Table:
  • Name: Public-Route-Table | VPC: MyDemoVPC
  • Open the Routes tab > Click Edit routes > Add Route:
    • Destination: 0.0.0.0/0 | Target: Internet Gateway (MyInternetGateway)
  • Open Subnet associations > Click Edit subnet associations > Select Public-Subnet-1 and Public-Subnet-2.
• Create a Private Route Table:
  • Name: Private-Route-Table | VPC: MyDemoVPC
  • Open Subnet associations > Click Edit subnet associations > Select Private-Subnet-1 and Private-Subnet-2.

Step 5: Provision a NAT Gateway for Outbound Private Access (Optional)

Finally, allow instances inside private subnets to reach external APIs or repository updates without exposing them to inbound internet access:

• Go to NAT Gateways > Click Create NAT gateway.
• Enter the following parameters:
  • Name: My-Private-NATgateway
  • Subnet: Select Public-Subnet-1 (NAT Gateways must reside in a public subnet)
  • Connectivity type: Public
• Click Allocate Elastic IP to attach a static public IP address.
• Click Create NAT gateway.
• Update Private-Route-Table:
  • Add Route > Destination: 0.0.0.0/0 | Target: NAT Gateway (My-Private-NATgateway).

Network Security Best Practices for AWS VPCs

• Enable Auto-Assign Public IP Carefully: Enable Auto-assign public IPv4 address ONLY on public subnets. Keep this setting disabled on private subnets.
• Distribute Subnets Across AZs: Always split workloads across at least two Availability Zones to ensure fault tolerance.
• Audit Security Groups Regularly: Avoid opening 0.0.0.0/0 on management ports like SSH (22) or RDP (3389). Use AWS Systems Manager Session Manager instead.

Troubleshooting Common VPC Routing Errors

Diagnose common configuration issues during custom VPC deployments:

Error 1: Instances in Public Subnet Cannot Access Internet

• The Cause: The Internet Gateway is either not attached to the VPC, or the subnet route table is missing the 0.0.0.0/0 -> IGW target route.
• The Fix: Verify that Public-Route-Table is explicitly associated with your public subnets and contains a default route (0.0.0.0/0) pointing to MyInternetGateway.

Error 2: Private Subnet Outbound Connections Timeout

• The Cause: The NAT Gateway is provisioned in a private subnet instead of a public subnet, or the Elastic IP is unattached.
• The Fix: Ensure your NAT Gateway lives inside a Public Subnet and has a valid Elastic IP assigned.