1The Importance of CIDR Planning
One of the most common and painful mistakes in cloud architecture is choosing overlapping CIDR blocks (e.g., using 10.0.0.0/16 for every VPC). If your company acquires another business or needs to establish VPC Peering with another internal department, overlapping CIDR blocks make direct peering impossible. Network architects must establish an IPAM (IP Address Manager) strategy from day one to ensure unique, non-overlapping IP ranges across the entire organization.
2Default vs Custom VPC Architecture
While the Default VPC is convenient for quick experimentation, it is highly discouraged for production workloads. The Default VPC places all resources into public subnets with automatic public IP assignment. Enterprise security best practices mandate creating custom VPCs where the vast majority of workloads (databases, application servers) reside in isolated private subnets, with only load balancers or bastion hosts exposed to the public internet.
3Step-by-Step Breakdown
What is a VPC?. A Virtual Private Cloud (VPC) is your own isolated virtual network inside the AWS cloud. It is the logical equivalent of a traditional on-premises data center network.
VPC vs Default VPC. Every AWS account comes with a Default VPC in each region, pre-configured with public subnets and an Internet Gateway. Custom VPCs start completely isolated.
CIDR Blocks. When creating a VPC, you must assign an IPv4 CIDR block (e.g., 10.0.0.0/16). This defines the total range of IP addresses available in the VPC (65,536 addresses for a /16).
Regional Scope. A VPC is a regional resource. It spans all Availability Zones (AZs) within a single AWS region (like us-east-1), but cannot span across multiple regions.
Subnets Overview. To use a VPC, you divide its CIDR block into smaller subnets (e.g., 10.0.1.0/24). Unlike the VPC itself, each subnet resides entirely within a single Availability Zone.
Knowledge Check. Which of the following statements about an AWS VPC and its subnets is true?
- →A VPC spans across multiple AWS Regions globally
- →A VPC spans all Availability Zones within a single Region, while a subnet is confined to a single AZ
- →A subnet spans all Availability Zones within a VPC
Route Tables. A Route Table contains a set of rules (routes) that determine where network traffic from your subnets is directed. Every VPC has a main route table by default.
Internet Gateways (IGW). An Internet Gateway (IGW) is a horizontally scaled, redundant VPC component that allows communication between your VPC and the public internet.
VPC Peering Basics. VPC Peering allows you to connect two VPCs together using AWS's private backbone network, enabling instances in different VPCs to communicate using private IP addresses.
Summary & Best Practices. Always plan your CIDR blocks carefully to prevent overlap during future peering, and segment your architecture into distinct public and private subnets.
