Cloud Networking (VPC) Basics Cheat Sheet
Covers VPC fundamentals including subnets, route tables, security groups, NAT gateways, and peering using AWS terminology.
2 PagesIntermediateFeb 12, 2026
Core VPC Components
The building blocks of a Virtual Private Cloud.
- VPC- An isolated virtual network within a cloud region, defined by a CIDR block (e.g. 10.0.0.0/16)
- Subnet- A range of IPs within a VPC, tied to a single Availability Zone
- Public Subnet- Has a route to an Internet Gateway for direct internet access
- Private Subnet- No direct route to the internet; outbound traffic goes through a NAT Gateway
- Route Table- Set of rules determining where network traffic from a subnet is directed
- Internet Gateway (IGW)- Allows communication between VPC resources and the internet
- NAT Gateway- Lets private subnet resources initiate outbound internet traffic without being reachable inbound
Security Layers
How traffic is filtered at different layers of a VPC.
- Security Group- Stateful, instance-level firewall; allow rules only, evaluated as a whole
- Network ACL (NACL)- Stateless, subnet-level firewall; supports both allow and deny rules, evaluated in order
- VPC Peering- Direct network connection between two VPCs, non-transitive
- Transit Gateway- Hub-and-spoke connector for many VPCs and on-prem networks, supports transitive routing
- VPC Endpoint- Private connectivity to AWS services (S3, DynamoDB) without traversing the public internet
Minimal VPC in Terraform
Creating a VPC with a public subnet and internet gateway.
hcl
resource "aws_vpc" "main" { cidr_block = "10.0.0.0/16"}resource "aws_subnet" "public" { vpc_id = aws_vpc.main.id cidr_block = "10.0.1.0/24" map_public_ip_on_launch = true availability_zone = "us-east-1a"}resource "aws_internet_gateway" "igw" { vpc_id = aws_vpc.main.id}resource "aws_route_table" "public" { vpc_id = aws_vpc.main.id route { cidr_block = "0.0.0.0/0" gateway_id = aws_internet_gateway.igw.id }}
Gateway & Interface VPC Endpoints
Gateway endpoints (S3/DynamoDB) attach to route tables for free; interface endpoints use ENIs billed per hour plus data.
hcl
# Gateway endpoint (S3) — no hourly charge, added to route tableresource "aws_vpc_endpoint" "s3" { vpc_id = aws_vpc.main.id service_name = "com.amazonaws.us-east-1.s3" vpc_endpoint_type = "Gateway" route_table_ids = [aws_route_table.private.id]}# Interface endpoint (e.g. Secrets Manager) — ENI-backed, billed hourlyresource "aws_vpc_endpoint" "secrets_manager" { vpc_id = aws_vpc.main.id service_name = "com.amazonaws.us-east-1.secretsmanager" vpc_endpoint_type = "Interface" subnet_ids = [aws_subnet.private.id] security_group_ids = [aws_security_group.endpoints.id] private_dns_enabled = true}
VPC Flow Logs for Traffic Auditing
Capture accepted/rejected IP traffic metadata at the VPC, subnet, or ENI level for security analysis and troubleshooting.
bash
aws ec2 create-flow-logs \ --resource-type VPC \ --resource-ids vpc-0123456789abcdef0 \ --traffic-type ALL \ --log-destination-type s3 \ --log-destination arn:aws:s3:::my-flow-logs-bucket/vpc-logs/ \ --log-format '${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${action} ${flow-direction}'# Query rejected traffic later with Athena over the S3 destination
CIDR Planning for Multi-AZ Subnets
Subdivide a /16 VPC into per-tier, per-AZ /20 subnets to leave headroom while keeping route tables predictable.
bash
# VPC: 10.0.0.0/16 (65,536 IPs)# Public tier: 10.0.0.0/20 (AZ-a), 10.0.16.0/20 (AZ-b), 10.0.32.0/20 (AZ-c)# Private tier: 10.0.48.0/20 (AZ-a), 10.0.64.0/20 (AZ-b), 10.0.80.0/20 (AZ-c)# DB tier: 10.0.96.0/20 (AZ-a), 10.0.112.0/20 (AZ-b), 10.0.128.0/20 (AZ-c)## Rule of thumb: leave the top quarter of the /16 unallocated for a future# secondary CIDR block (e.g. for EKS pod IPs), since resizing existing# subnets in place is not possible once instances are attached.
Transit Gateway Route Table Isolation
Segment a TGW into separate route tables so, e.g., a 'prod' VPC attachment can't route to a 'dev' VPC attachment.
hcl
resource "aws_ec2_transit_gateway_route_table" "prod" { transit_gateway_id = aws_ec2_transit_gateway.main.id}resource "aws_ec2_transit_gateway_route_table_association" "prod_vpc" { transit_gateway_attachment_id = aws_ec2_transit_gateway_vpc_attachment.prod.id transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.prod.id}resource "aws_ec2_transit_gateway_route_table_propagation" "prod_vpc" { transit_gateway_attachment_id = aws_ec2_transit_gateway_vpc_attachment.prod.id transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.prod.id}# dev attachments associate/propagate to a separate route table — no# shared table means no accidental prod<->dev reachability
Advanced Networking Concepts
Constructs that come up once a VPC design moves beyond a single account/region.
- PrivateLink- Exposes a service via an Interface Endpoint/NLB without VPC peering or internet exposure, used for SaaS and internal service sharing
- VPC Sharing (RAM)- Central network account shares subnets to other accounts via Resource Access Manager, avoiding per-account VPC sprawl
- Elastic Network Interface (ENI)- The virtual NIC attached to instances; multiple ENIs enable dual-homed instances across subnets
- DNS64 / NAT64- Lets IPv6-only subnets reach IPv4-only services by synthesizing AAAA records and translating at the NAT gateway
- Route Priority (Longest Prefix Match)- The most specific matching CIDR in a route table wins, regardless of the order routes were added
- Egress-Only Internet Gateway- IPv6 equivalent of a NAT gateway: allows outbound-only internet access for IPv6 addresses
- Flow Log Traffic Mirroring- Full packet capture (not just metadata) to an ENI/NLB target for deep packet inspection, distinct from Flow Logs
Pro Tip
Size your VPC CIDR generously (a /16) even for small workloads — subnets are cheap to create but resizing a VPC's CIDR later requires painful re-architecture or secondary CIDR blocks.
Was this cheat sheet helpful?
Explore Topics
#CloudNetworkingVPCBasics#CloudNetworkingVPCBasicsCheatSheet#CloudComputing#Intermediate#CoreVPCComponents#SecurityLayers#MinimalVPCInTerraform#Gateway#Networking#Security#CheatSheet#SkillVeris
