VPC — Cheat Sheet (DVA-C02)
Verified against AWS documentation on 2026-10-12 · ⚠️ = changed vs older material: learn the value shown here (older practice material may say otherwise; full list in notes/vpc-guide.md#changed-vs-older-material) · ⚠️ unverified = not confirmed in AWS docs · explanations and examples: notes/vpc-guide.md.
Subnets route tables and gateways
| Topic | Current facts | Memory hook |
|---|---|---|
| Public subnet | Its route table has a route to an internet gateway (IGW) | Public is a route, not a property |
| Private subnet | No IGW route; outbound internet only through a NAT device | |
| Three-tier layout | Load balancer in public subnets; app tier in private subnets (out through NAT); RDS and ElastiCache in private data subnets | Only the front door is public |
| Internet access checklist | IGW attached + 0.0.0.0/0 (or ::/0) route to it + public IPv4, Elastic IP or IPv6 address + SG and NACL allow |
Four keys for one door |
| Internet gateway | One per VPC; horizontally scaled and redundant, no bandwidth constraint; 1:1 NAT to the public IPv4 or Elastic IP; no charge | |
| Default VPC | Has an IGW, a 0.0.0.0/0 route and auto-assigned public IPv4 in default subnets; VPCs you create have none of these |
|
| Main route table | Used by every subnet that has no explicit route table association | |
| Zonal NAT gateway | Default mode; sits in a public subnet, public type gets an Elastic IP at creation; lives in one AZ, so create one per AZ | Dies with its AZ |
| Regional NAT gateway ⚠️ | Since 19 Nov 2025 (--availability-mode regional): no public subnet, expands to AZs with ENIs (up to 60 min), one NAT ID in all routes, own route table to the IGW, up to 32 IPs per AZ, no private mode |
Follows your ENIs |
| NAT gateway behaviour | TCP, UDP, ICMP; 350 s idle timeout then RST; no security group (NACL applies); never answers ping; billed per hour + per GB | Out, never in |
| Private NAT gateway | --connectivity-type private: outbound to other VPCs or on-premises via transit gateway or virtual private gateway; no Elastic IP |
|
| NAT instance ⚠️ | Your EC2 instance: public subnet, public IP, source/destination check off, your patching and failover; AWS NAT AMI out of support since 31 Dec 2023 | DIY NAT, DIY trouble |
| Egress-only internet gateway | IPv6 outbound only; stateful; free; NACL applies, no SG | IPv6's NAT |
| VPC Block Public Access ⚠️ | Since 19 Nov 2024: account and Region switch that blocks IGW and egress-only IGW traffic (bidirectional or ingress-only), with VPC or subnet exclusions; flow logs show reject-reason BPA |
Master switch beats routes |
NAT metrics (AWS/NATGateway) |
ErrorPortAllocation > 0 = too many connections to one destination; rising IdleTimeoutCount = stale connections; ConnectionEstablishedCount < ConnectionAttemptCount = no answer |
Security groups network ACLs and flow logs
| Aspect | Security group | Network ACL |
|---|---|---|
| Level | ENI (instance, Lambda, endpoint, RDS, load balancer) | Subnet: one NACL per subnet; one NACL can serve many subnets; filters only traffic entering or leaving the subnet, not traffic within it |
| State | Stateful: replies allowed automatically | Stateless: return traffic needs its own rule |
| Rules | Allow only; CIDR, prefix list or SG ID | Allow and deny; CIDR only (no SG IDs, no prefix lists) |
| Evaluation | All rules combined | Lowest number first (1–32766), first match wins; the * deny can't be deleted |
| Defaults | New SG: no inbound, all outbound | Default NACL: allows all; new custom NACL: denies all |
| Not filtered by either | Amazon DNS (VPC base + 2), IMDS, Time Sync, DHCP, ECS task metadata, Windows license activation, VPC router reserved IPs | Same list |
| Memory hook | SG remembers and only says yes | NACL forgets and can say no |
| Flow logs | Current facts | Memory hook |
|---|---|---|
| Attach to ⚠️ | VPC, subnet or ENI; also transit gateway, transit gateway attachment, regional NAT gateway | |
| Service-created ENIs | Covered by a VPC or subnet flow log: load balancers, RDS, ElastiCache, NAT gateways | |
| Traffic filter | ACCEPT, REJECT or ALL |
|
| Destinations ⚠️ | CloudWatch Logs, S3 (text or Parquet, query with Athena), Amazon Data Firehose (CLI type still kinesis-data-firehose) |
|
| Content | Metadata only (addresses, ports, protocol, packets, bytes, action), never payload | Envelopes, not letters |
| Default format | Version 2: version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status |
|
| Useful custom fields | pkt-srcaddr/pkt-dstaddr (original IPs behind NAT), flow-direction, traffic-path, tcp-flags, reject-reason (BPA, EC) |
|
| Timing | Aggregation 10 min (default) or 1 min; delivery about 5 min to CloudWatch Logs, 10 min to S3 | Not real time |
| Not logged | Amazon DNS server, IMDS, Time Sync, DHCP, ARP, Windows activation, the VPC router's reserved IP, mirrored source traffic, endpoint ENI to NLB ENI traffic | |
| Editing | Not possible: delete and recreate to change the format or the role | |
| ACCEPT in, REJECT on the reply | The NACL lacks the ephemeral-port return rule | NACL forgot the reply |
| CloudWatch Logs permissions | Role trusted by vpc-flow-logs.amazonaws.com (log group/stream create, put, describe) + caller iam:PassRole |
|
| S3 permissions | Bucket policy for delivery.logs.amazonaws.com (s3:PutObject, s3:GetBucketAcl); the auto-attached policy overwrites the existing one |
VPC endpoints for AWS services
| Aspect | Gateway endpoint | Interface endpoint |
|---|---|---|
| Services | S3, DynamoDB | S3, DynamoDB and the large majority of other AWS services |
| Mechanism | Prefix-list (pl-…) route in associated route tables |
ENI with private IPs, one subnet per AZ, found through DNS |
| From on-premises or peered VPCs | No | Yes (VPN, Direct Connect, peering, transit gateway) |
| Network controls | Client SG egress may reference the prefix list | Endpoint SG must allow inbound 443 from callers |
| Cost | Free | Per hour per AZ + per GB |
| Memory hook | A route: free, stays home | An ENI: paid, travels |
| Topic | Current facts | Memory hook |
|---|---|---|
| Private DNS | Default service name resolves to the endpoint's private IPs; needs enableDnsSupport and enableDnsHostnames (the latter defaults to false outside the default VPC) |
Both DNS switches on |
| Without private DNS | Call vpce-…-xxxx.<service>.<region>.vpce.amazonaws.com through --endpoint-url |
|
| S3 interface private DNS ⚠️ | Supported; "private DNS only for inbound endpoint" keeps in-VPC traffic on the S3 gateway endpoint, which must exist | |
| DynamoDB interface endpoint ⚠️ | Since 19 Mar 2024; no private DNS, so set the SDK's endpoint_url |
|
| Cross-Region interface endpoints ⚠️ | Some AWS services in another Region via --service-region; callers need vpce:AllowMultiRegion; gateway endpoints stay same-Region |
|
| Endpoint policy | Resource policy with a Principal; default allows all; max 20,480 characters; filters, never grants |
A filter, not a key |
| Condition keys | aws:SourceVpce, aws:SourceVpc, aws:SourceVpcArn (supported services only, preferred there), aws:VpcSourceIp (pair it with one of the others) exist only via endpoints; aws:SourceIp is absent there |
No SourceIp through an endpoint |
| Bucket locked to one endpoint | Deny s3:* when aws:SourceVpce isn't the endpoint ID; also blocks console and on-premises access |
Lambda functions in a VPC
| Topic | Current facts | Memory hook |
|---|---|---|
Without VpcConfig |
Lambda-owned VPC: internet yes, your private resources no | |
With VpcConfig |
Hyperplane ENIs in your subnets: private resources yes, internet only through your routes | |
| Public IP | Never assigned, even in a public subnet | No public IP, ever |
| Internet pattern | Private subnets in 2+ AZs → NAT gateway (public subnet, or regional) → IGW | Private → NAT → IGW |
| AWS services without NAT | Gateway endpoints for S3 and DynamoDB; interface endpoints for SQS, SNS, Secrets Manager, KMS, STS, lambda and others |
|
| Missing path symptom | A timeout, not an error code: Task timed out after N seconds, connect ETIMEDOUT, ReadTimeoutError |
|
| Logs | Lambda itself sends them to CloudWatch Logs: no NAT or Logs endpoint needed (Lambda Managed Instances excepted) | |
| Security groups and NACLs | Function SG egress to targets; targets allow inbound from the function SG; NACLs allow 1024–65535 for TCP and UDP | |
| Dedicated tenancy | A function can't attach directly to a VPC with dedicated instance tenancy | |
| IPv6 outbound | Ipv6AllowedForDualStack=true, dual-stack subnets only, ::/0 to an egress-only IGW |
Peering VPN and Direct Connect
| Topic | Current facts | Memory hook |
|---|---|---|
| VPC peering | Two VPCs, any accounts or Regions, private IPs over the AWS backbone; no gateway, no bottleneck | A handshake between two |
| Peering setup | Request → accept within 7 days → routes in both VPCs → SG and NACL rules | Accept, then route both ways |
| Peering blockers | Any overlapping CIDR block; a second peering of the same pair; transitive paths; edge-to-edge use of the peer's IGW, NAT, VPN, DX or gateway endpoint | Peers don't lend their doors |
| Peer SG references | Same Region only; inter-Region peers use CIDRs | |
| Peering DNS option | Set per side by that VPC's owner on an active peering: the requester option lets the accepter VPC resolve the requester's public DNS hostnames to private IPs, the accepter option the reverse (both VPCs need both DNS attributes) | Each side unlocks its own names |
| Peering cost | Free to create; same-AZ transfer free; cross-AZ and cross-Region transfer charged | |
| Transit Gateway | Hub that connects many VPCs and on-premises networks transitively | Hub instead of mesh |
| Site-to-Site VPN | IPsec over the internet; 2 tunnels; virtual private gateway (one VPC) or transit gateway; quick to set up | Fast to start, rides the internet |
| Direct Connect | Physical link to a DX location; dedicated 1/10/100/400 Gbps or hosted 50 Mbps–25 Gbps; private, public and transit VIFs | A private lane, slow to build |
| DX encryption ⚠️ | Not encrypted by default: MACsec (10/100/400 Gbps dedicated) or an IPsec VPN over DX | Bring your own encryption |
| DX lead time | Port provisioned within up to 72 business hours, then the cross-connect; end-to-end time ⚠️ unverified |
Numbers to know
| Item | Value | Note |
|---|---|---|
| Subnet IPv4 size | /16 to /28 |
|
| Reserved addresses per subnet | 5 | First four and the last; a /24 leaves 251 |
| VPCs per Region | 5 | Adjustable |
| Subnets per VPC | 200 | Adjustable |
| Internet gateways per VPC | 1 | Same for egress-only internet gateways |
| Elastic IP addresses per Region | 5 | Adjustable; every public IPv4 is billed hourly (notes/ec2-mastery-guide.md §4) |
| NAT gateways per AZ | 5 | Adjustable; pending, available and deleting ones count |
| NAT gateway bandwidth ⚠️ | 5 Gbps scaling to 100 Gbps | Older material: 45 Gbps |
| NAT gateway packet rate ⚠️ | 1 million pps scaling to 10 million | Beyond that it drops packets; older material: 4 million |
| NAT connections per IP address | 55,000 per unique destination | Destination = IP + port + protocol |
| IPs per zonal NAT gateway | Up to 8 (1 primary + 7 secondary) | Public type: 2 Elastic IPs by default, raisable to 8 |
| NAT gateway idle timeout | 350 s | Then RST; send keepalives sooner |
| SG rules | 60 inbound + 60 outbound | Per SG; IPv4 and IPv6 counted separately |
| SGs per network interface | 5 | Adjustable up to 16 |
| NACL rules per direction | 20 | Adjustable up to 40 |
| Ephemeral ports of NAT gateways, ELB and Lambda | 1024–65535 | Linux 32768–61000; Windows Server 2008+ 49152–65535 |
| Flow log aggregation interval | 600 s default, 60 s option | Always 60 s or less on Nitro instances |
| Flow log delivery | About 5 min to CloudWatch Logs, 10 min to S3 | Best effort |
| Gateway endpoints | 20 per Region, 255 per VPC | Region quota adjustable |
| Interface + Gateway Load Balancer endpoints per VPC | 50 | Adjustable |
| Endpoint policy size | 20,480 characters | Not adjustable |
| Interface endpoint bandwidth | 10 Gbps per AZ scaling to 100 Gbps | |
| Connections per Lambda Hyperplane ENI | 65,000 | Shared per subnet + SG combination |
| Active peerings per VPC | 50 | Adjustable up to 125 |
| Peering request expiry | 7 days (168 h) | Not adjustable |
| VPN tunnels per connection | 2 | For redundancy |
| VPN tunnel bandwidth ⚠️ | 1.25 Gbps standard; 5 Gbps Large Bandwidth Tunnel | Large tunnels on transit gateway or Cloud WAN only |
| VPN tunnel packet rate | 140,000 pps standard; 400,000 pps large | |
| DX dedicated port speeds | 1, 10, 100, 400 Gbps | Fixed once requested |
| DX hosted connection speeds | 50 Mbps to 25 Gbps | Through a DX Partner |
| DX port provisioning | Up to 72 business hours | End-to-end lead time ⚠️ unverified |
| MACsec on DX | 10, 100, 400 Gbps dedicated | Selected locations; not on hosted connections |
| Link-local traffic per ENI | 1,024 packets per second | DNS, IMDS, NTP and Windows licensing combined; not adjustable |
Decision rules
- If you see a private-subnet resource that can't reach the internet, think
0.0.0.0/0to a NAT gateway that sits in a public subnet routed to the IGW (or a regional NAT gateway). - If you see a public IP that still gives no internet access, think missing IGW route (or VPC Block Public Access).
- If you see "only the load balancer may face the internet", think load balancer in public subnets, app and data tiers in private subnets, NAT for outbound calls.
- If you see NAT that must survive an AZ failure without per-AZ routes, think regional NAT gateway.
- If you see
ErrorPortAllocation, think too many connections to one destination: add NAT IPs and reuse connections. - If you see idle connections through NAT dropped after about six minutes, think the 350 s idle timeout and TCP keepalive.
- If you see outbound-only IPv6, think egress-only internet gateway.
- If you see "block one IP address", think a NACL deny with a lower rule number.
- If you see a request
ACCEPTand a replyREJECTin flow logs, think stateless NACL missing the return rule. - If you see flow logs that never reach CloudWatch Logs, think delivery role for
vpc-flow-logs.amazonaws.complusiam:PassRole. - If you see "find the blocking component without sending traffic", think Reachability Analyzer.
- If you see free private access to S3 or DynamoDB from inside the VPC, think gateway endpoint.
- If you see S3 or DynamoDB access from on-premises or another Region, think interface endpoint.
- If you see "the bucket accepts traffic only from our endpoint", think a deny on
aws:SourceVpce(oraws:SourceVpc). - If you see a timeout through an interface endpoint, think endpoint SG inbound 443, caller SG egress and private DNS; an
AccessDeniedmeans a policy (endpoint, resource or identity). - If you see private DNS not working on an interface endpoint, think
enableDnsSupportplusenableDnsHostnames. - If you see a VPC-attached function that lost internet access, think private subnets plus NAT; public subnets never help.
- If you see a VPC function that must reach AWS services without internet, think VPC endpoints (gateway for S3 and DynamoDB, interface for the rest).
- If you see two VPCs that must talk privately, think peering with non-overlapping CIDRs and routes on both sides; many VPCs plus on-premises all-to-all, think Transit Gateway.
- If you see a quick encrypted link over the internet, think Site-to-Site VPN; consistent private bandwidth, think Direct Connect.
- If you see Direct Connect plus an encryption requirement, think MACsec or a VPN over DX.
Memory hooks
- Public is a route, not a property: the IGW route makes a subnet public.
- NAT lets you out, never in.
- A zonal NAT gateway dies with its AZ; a regional one follows your ENIs.
- No SG on a NAT gateway, and no ping either.
- SG remembers and only says yes; NACL forgets and can say no.
- NACL: lowest number wins, first match stops.
- Flow logs are envelopes, not letters.
- ACCEPT in, REJECT out: the NACL forgot the reply.
- Gateway endpoint = a route that's free and stays home; interface endpoint = an ENI that's paid and travels.
- Both DNS switches on, or private DNS stays off.
- An endpoint policy is a filter, not a key.
- No SourceIp through an endpoint: use SourceVpce.
- Lambda in a VPC never gets a public IP: private → NAT → IGW.
- Peering is a handshake between two, not a group hug.
- Peers don't lend their doors: no edge-to-edge routing.
- VPN: fast to start, rides the internet. DX: private lane, slow to build, bring your own encryption.