12.1 VPC Core Architecture, Subnetting & High Availability NAT

AWS Certified CloudOps Engineer – Associate SOA-C03

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Monitoring & Observability Infrastructure

1.1 Configuring Workload Observability 1.2 CloudWatch Agent Architecture & Deployment 1.3 Metric Alarms, Anomaly Detection & Composite Alarms

2 Chapter 2: Alarms, Dashboards & Event-Driven Remediation

2.1 CloudWatch Dashboards & Multi-Account Visibility 2.2 Notification Architecture & Alarm Invocation 2.3 Amazon EventBridge Rules, Event Buses & Troubleshooting 2.4 Automated Remediation with Systems Manager & Lambda

3 Chapter 3: Performance Optimization for Compute, Storage & Databases

3.1 EC2 & Compute Performance Optimization 3.2 Amazon EBS Performance Metrics & Volume Tuning 3.3 S3 Performance Strategies & Data Transfer 3.4 Shared Storage (EFS/FSx) & Database Performance

4 Chapter 4: Compute & Database Scalability and Elasticity

4.1 EC2 Auto Scaling Policies & Elasticity 4.2 Auto Scaling Advanced Operations: Warm Pools & Lifecycle Hooks 4.3 Dynamic Scalability Through Caching 4.4 Managed Database Scaling: RDS, Aurora & DynamoDB

5 Chapter 5: High Availability, Fault Tolerance & Load Balancing

5.1 Elastic Load Balancing (ALB/NLB) Configuration & Troubleshooting 5.2 Route 53 Health Checks & DNS Failover 5.3 Multi-AZ Architecture & Fault-Tolerant Deployments

6 Chapter 6: Backup, Data Protection & Disaster Recovery

6.1 Centralized Backup Automation & AWS Backup 6.2 Database Restore Strategies & RTO/RPO Management 6.3 Storage Versioning, Replication & Immutability 6.4 Disaster Recovery Patterns & Multi-Region Resilience

7 Chapter 7: Infrastructure as Code with CloudFormation & AWS CDK

7.1 CloudFormation Foundations & Resource Modeling 7.2 Managing Stacks, Drift Detection & Change Sets 7.3 Infrastructure as Code with AWS CDK 7.4 Identifying & Remediating Deployment Failures

8 Chapter 8: Multi-Account Provisioning, Containers & Third-Party IaC

8.1 Golden Images with EC2 Image Builder & Amazon ECR 8.2 Multi-Account & Multi-Region Resource Sharing 8.3 Deployment Strategies & Container Deployments 8.4 Third-Party Automation with Terraform & Git Workflows

9 Chapter 9: Systems Manager & Event-Driven Operations Automation

9.1 AWS Systems Manager Core Management & Run Command 9.2 Systems Manager Patch Manager & Session Manager 9.3 Event-Driven Operations Automation

10 Chapter 10: Identity, Access Management & Governance

10.1 Advanced IAM Policies, Roles & Policy Conditions 10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer 10.3 Multi-Account Security: Organizations, SCPs & Identity Center 10.4 Compliance Enforcement with AWS Config & Conformance Packs

11 Chapter 11: Data Security, Encryption & Vulnerability Management

11.1 Data Classification & Amazon S3 Security 11.2 Encryption at Rest with AWS Key Management Service (KMS) 11.3 Encryption in Transit with AWS Certificate Manager (ACM) 11.4 Secrets Management & Centralized Security Findings

12 Chapter 12: VPC Architecture, Endpoints & Network Protection

12.1 VPC Core Architecture, Subnetting & High Availability NAT 12.2 Private Network Connectivity: VPC Endpoints & Peering 12.3 Network Protection & Edge Security Auditing

13 Chapter 13: DNS, Route 53 Routing & Content Delivery

13.1 DNS Architecture & Route 53 Resolver for Hybrid Clouds 13.2 Route 53 Advanced Routing Policies & Query Logging 13.3 Global Content & Service Distribution: CloudFront & Global Accelerator

14 Chapter 14: Network Troubleshooting, Traffic Analysis & Hybrid Connectivity

14.1 VPC Configuration Troubleshooting & Analysis Tools 14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics 14.3 CloudFront Caching & Hybrid Connectivity Troubleshooting

12.1 VPC Core Architecture, Subnetting & High Availability NAT

Key Takeaways Explain This Topic AI

Amazon VPC supports IPv4 CIDR blocks between /16 and /28, permanently reserving exactly five IP addresses per subnet: the first four addresses (network, VPC router, Amazon DNS, and one held for future AWS use) plus the last address in the block (broadcast).

Subnet tiering separates workloads into Public (route to Internet Gateway), Private (route to NAT Gateway), and Isolated (local route only, no internet egress).

NAT Gateway is an Availability Zone-scoped managed resource; deploying one NAT Gateway per AZ in multi-AZ public subnets eliminates cross-AZ single points of failure and prevents inter-AZ data transfer fees ($0.01/GB).

Dual-stack VPCs support IPv6 with an AWS-allocated /56 CIDR and /64 subnets, utilizing stateful Egress-Only Internet Gateways (EIGW) to permit outbound internet access while blocking inbound internet connections.

Route tables evaluate rules using longest prefix match; the default local route is immutable, and routes to Virtual Private Gateways support dynamic BGP route propagation.

Last updated: September 2026

12.1 VPC Core Architecture, Subnetting & High Availability NAT

CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests core VPC networking skills. You must master CIDR sizing, the five reserved IP addresses per subnet, subnet tiering, route table propagation, resilient multi-AZ NAT Gateway design, and IPv6 egress architectures.

Amazon VPC Foundations: CIDR Allocation & Reserved IP Addresses

An Amazon Virtual Private Cloud (VPC) provides a logically isolated virtual network for your AWS workloads. When creating a VPC, you specify an IPv4 Classless Inter-Domain Routing (CIDR) block within defined sizing limits:

The smallest permitted IPv4 CIDR block is /28 (16 total IP addresses).

The largest permitted IPv4 CIDR block is /16 (65,536 total IP addresses).

VPCs commonly utilize private address spaces defined in RFC 1918 ( 10.0.0.0/8 , 172.16.0.0/12 , or 192.168.0.0/16 ). When an active VPC exhausts its address space, you can associate Secondary CIDR Blocks from RFC 1918, Carrier-Grade NAT (CGNAT) space ( 100.64.0.0/10 ), or customer-owned public ranges. Secondary CIDRs cannot overlap with any existing CIDR blocks in the VPC or peered VPCs.

The Five Mandatory AWS Reserved IP Addresses

In on-premises networks, only two addresses per subnet are unusable: the network wire address and the broadcast address. In Amazon VPC, AWS reserves exactly five IP addresses in every subnet across all CIDR block sizes:

Subnet Offset Example ( 10.0.1.0/24 ) Reserved Purpose

First ( .0 ) 10.0.1.0 Network Address: Defines the network boundary.

Second ( .1 ) 10.0.1.1 VPC Router (Default Gateway): Internal router interface.

Third ( .2 ) 10.0.1.2 AmazonProvidedDNS: Route 53 Resolver (VPC CIDR base + 2).

Fourth ( .3 ) 10.0.1.3 Reserved by AWS: Allocated for future AWS infrastructure use.

Last ( .255 ) 10.0.1.255 Network Broadcast Address: Reserved; broadcast is unsupported in VPC.

Usable host capacity is determined by: Usable Host IPs = 2 ( 32 − Prefix Length ) − 5 \text{Usable Host IPs} = 2^{(32 - \text{Prefix Length})} - 5 Usable Host IPs = 2 ( 32 − Prefix Length ) − 5

A /24 subnet ( 2 8 = 256 2^8 = 256 2 8 = 256 total) yields 256 − 5 = 251 256 - 5 = 251 256 − 5 = 251 usable IP addresses. A /28 subnet ( 2 4 = 16 2^4 = 16 2 4 = 16 total) yields only 16 − 5 = 11 16 - 5 = 11 16 − 5 = 11 usable addresses.

Subnet Architecture & Routing Tiering

A subnet spans a single Availability Zone (AZ) . Multi-AZ resilience requires deploying subnets across at least two AZs. CloudOps architectures enforce a three-tier subnet model:

Public Subnets: The associated route table includes a default route ( 0.0.0.0/0 ) targeting an Internet Gateway (IGW) ( igw-xxxx ). Instances require public IPv4 addresses (via auto-assign public IPv4 or Elastic IPs) to communicate with the internet.

Private Subnets: The route table directs 0.0.0.0/0 to a NAT Gateway ( nat-xxxx ) residing in a public subnet. Private instances initiate outbound requests (e.g., software patches) while blocking inbound internet traffic.

Isolated (Database) Subnets: The route table contains no route to 0.0.0.0/0 . Only the default local route and internal routes (VPC endpoints, peering) exist, completely walling off backend databases from internet egress.

Route Table Mechanics & Route Propagation

Every route table contains a default local route for the VPC CIDR (e.g., 10.0.0.0/16 → \rightarrow → local ). This local route is immutable : it cannot be deleted or overridden. Routing decisions always follow the longest prefix match rule.

When connecting a VPC to an on-premises network via AWS Site-to-Site VPN or AWS Direct Connect using a Virtual Private Gateway (VGW) , enabling Route Propagation automatically populates the route table with Border Gateway Protocol (BGP) advertised prefixes, avoiding manual static route maintenance.

High Availability NAT Gateway Design

An AWS NAT Gateway is an AZ-scoped managed service scaling automatically up to 45 Gbps . While highly available within an AZ, it does not span across zones.

Single NAT Gateway vs. Multi-AZ Pattern

Deploying a single NAT Gateway in one AZ (e.g., us-east-1a ) for the entire VPC introduces severe risks:

Single Point of Failure (SPOF): If us-east-1a fails, private subnets in all other AZs lose internet egress immediately.

Cross-AZ Data Transfer Costs: Traffic from private subnets in us-east-1b routing through us-east-1a incurs inter-AZ data transfer fees ($0.01/GB each direction = $0.02/GB round-trip) in addition to NAT data processing fees ($0.045/GB).

Architecture Failure Resilience Cost Profile Operational Suitability

Single NAT Gateway Vulnerable; AZ outage severs all VPC internet egress. Incurs inter-AZ data transfer fees ($0.01/GB). Development / non-critical environments.

Multi-AZ NAT (1 per AZ) Resilient; AZ failure isolated to affected zone. Zero inter-AZ transfer; hourly charge per NAT GW. Production standard (Well-Architected).

The production standard requires deploying one NAT Gateway per AZ in public subnets with an Elastic IP, and configuring dedicated private route tables in each AZ routing 0.0.0.0/0 to the local zone's NAT Gateway.

IPv6 Architecture & Egress-Only Internet Gateways

To resolve IPv4 address constraints, AWS supports dual-stack VPCs :

IPv6 CIDR Allocation: AWS assigns a fixed, globally unique /56 IPv6 CIDR block.

Subnet Allocation: Subnets receive a fixed /64 CIDR block ( 2 64 2^{64} 2 64 addresses).

Public Routability: All assigned IPv6 addresses are globally unique and publicly routable. AWS does not support or use NAT for IPv6.

Egress-Only Internet Gateway (EIGW)

To protect private IPv6 workloads, AWS provides the Egress-Only Internet Gateway (EIGW) :

Enables instances in private subnets to initiate outbound IPv6 traffic to the internet.

Prevents external internet hosts from initiating inbound IPv6 connections.

Stateful: automatically allows return traffic for established outbound flows.

Private subnet route tables direct default IPv6 traffic ( ::/0 ) to the EIGW ( eigw-xxxx ).