Q: Explain AWS VPC Subnets NAT Gateway Internet Gateway architecture with packet flows.
Master aws vpc subnets nat gateway internet gateway architecture: CIDR planning, public vs private subnets, Internet Gateway routing, NAT Gateway egress, and Multi-AZ resilience.
Want to master this scenario in a live sandbox? Stephane Maarek's AWS Certified DevOps Engineer Professional Masterclass on Udemy covers this exact problem with hands-on terminal drills.
🛠️ Production Runbook & Step-by-Step Resolution
Direct Answer: A secure aws vpc subnets nat gateway internet gateway architecture is the foundational networking layer for all cloud workloads. In an interview, I explain how VPCs isolate resources, what technically differentiates a public subnet from a private subnet, how Internet Gateways handle public traffic, and why NAT Gateways are required for private workload egress.
Virtual Private Cloud (VPC) & CIDR Sizing Fundamentals
A Virtual Private Cloud (VPC) is a logically isolated virtual network dedicated to your AWS account. It is defined by a primary IPv4 CIDR block (typically an RFC 1918 private block such as 10.0.0.0/16, providing 65,536 private IP addresses).
- Non-Overlapping CIDRs: Production CIDRs must never overlap with on-premises networks or peered VPCs to allow seamless VPC Peering or Direct Connect.
- Regional Scope: A VPC spans all Availability Zones within an AWS Region.
Subnets: Public vs Private vs Isolated Tiers
Subnets divide the VPC CIDR across specific Availability Zones. The technical difference between a Public and a Private Subnet is determined entirely by its associated Route Table.
# Public Subnet Route Table:
# Destination Target
# 10.0.0.0/16 local
# 0.0.0.0/0 igw-0123456789abcdef0
# Private Subnet Route Table:
# Destination Target
# 10.0.0.0/16 local
# 0.0.0.0/0 nat-0123456789abcdef0- Public Subnet: Has a route pointing
0.0.0.0/0directly to an Internet Gateway (IGW). Instances receive public IPs and can accept inbound connections from the internet (e.g. ALBs, NAT Gateways, Bastion hosts). - Private Subnet: Has a route pointing
0.0.0.0/0to a NAT Gateway. Instances cannot be reached directly from the internet but can initiate outbound internet calls (e.g. backend APIs, Kubernetes worker nodes). - Isolated / Database Subnet: Has NO route to
0.0.0.0/0; can only communicate internally within the VPC (e.g. RDS databases, Redis clusters).
Internet Gateway (IGW): 1:1 NAT & Bi-Directional Public Access
An Internet Gateway (IGW) is a horizontally scaled, highly available VPC component that imposes no bandwidth bottlenecks. It serves as the bridge between the VPC and the public internet.
- Stateless 1:1 NAT: When an instance with a public IP transmits packets to the internet, the IGW translates the private IP to the public IPv4 address and vice versa.
- Bi-Directional Traffic: Allows both inbound client connections (to ALBs) and outbound internet communication.
NAT Gateway: Outbound-Only Internet Access for Private Workloads
Workloads in private subnets (e.g. microservices downloading security patches or calling external Stripe APIs) need outbound internet access without exposing their ports to inbound attacks. An AWS Managed NAT Gateway provides this unidirectional translation.
# NAT Gateway placement requirements:
# 1. Must be deployed inside a PUBLIC subnet
# 2. Must be allocated an Elastic IP (EIP)
# 3. Private subnet route table must point 0.0.0.0/0 to the nat-gateway-id- Unidirectional Security: Instances in private subnets can initiate outbound TCP/UDP requests, but external internet hosts cannot initiate connections back to private instances.
- Managed Scalability: AWS manages uptime, scaling bandwidth automatically up to 100 Gbps.
AWS VPC Subnets NAT Gateway Internet Gateway Traffic Flow Matrix
Complete packet flow comparison across public, private, and isolated VPC subnet tiers in the aws vpc subnets nat gateway internet gateway architecture:
- VPC Foundation: An isolated software-defined network defined by an IPv4 CIDR (e.g. 10.0.0.0/16) spanning all Availability Zones in a region.
- Subnet Tiers: Public subnets route 0.0.0.0/0 to an Internet Gateway; Private subnets route 0.0.0.0/0 to a NAT Gateway; Database subnets have no internet routes.
- Internet Gateway (IGW): Highly available, managed gateway providing 1:1 bidirectional NAT for public instances and load balancers.
- NAT Gateway: Deployed in a public subnet with an Elastic IP, enabling private workloads to make outbound calls (patches, APIs) while blocking inbound traffic.
- Multi-AZ Design: Always provision one NAT Gateway per AZ in production to prevent single-AZ outages from taking down cluster egress.
- Cost Safeguard: Use free VPC Gateway Endpoints for S3 and DynamoDB to keep high-throughput storage traffic off expensive NAT Gateways.
Senior hiring managers and bar raisers evaluate how you prioritize during outages. Avoid these common anti-patterns:
- Deploying a NAT Gateway inside a private subnet A NAT Gateway must reach the Internet Gateway directly; deploying it in a private subnet leaves it with no internet route, severing connectivity.
- Using a single NAT Gateway across all Availability Zones in production If that specific AZ suffers an outage, private subnets in all other healthy AZs lose outbound internet access immediately.
- Routing high-bandwidth S3 backups through NAT Gateways NAT Gateway charges $0.045 per GB processed; streaming 50TB of S3 backups costs $2,250 in unnecessary NAT fees versus $0 with a VPC Endpoint.
- Choosing overlapping CIDR blocks when setting up initial VPCs Overlapping CIDR blocks make future VPC Peering, Transit Gateway, and Direct Connect routing impossible without complex NAT proxies.