Phase 4: Infrastructure as Code & Cloud

VPC, Subnets & Network Design

Intermediate ~3 min read
Think of it this way A friendly analogy. Read this if the technical version feels dense. Show Hide

When you want to build something amazing online, like your own video game server or a special website, you don't want to just leave it out in the open for everyone to trip over. Imagine the whole internet, or specifically AWS (which is like a giant, bustling city where people build digital stuff), has countless buildings and spaces. Instead of just picking a random spot on the street, you get your very own private house in this city. This personal, digital house is what we call a VPC. It’s your own dedicated space, completely separate and safe from everyone else’s projects in the big AWS city. You get to decide exactly what happens inside your house, like where you put your game's brain or its player list, without anyone else interfering.

Now, inside your physical house, you don't just have one big empty room, right? You have different rooms for different things: a kitchen for cooking, a bedroom for sleeping, a living room for playing. In your digital house (your VPC), you also divide it into separate sections called "subnets." Each subnet is like a special room designed for a specific job. You might put your game's main engine in one room, and the list of all your players in another. A super cool trick is that you can build these rooms in different "wings" or "sections" of your house that are far apart, even if they're still under the same roof. This is super smart because if one wing of your house has a tiny hiccup (like a power flicker), the other wings can keep everything else running smoothly.

Just like in your real house, you control who can come and go from your digital rooms. Some rooms, like your living room, might have big windows and a front door that opens directly to the street so your friends (or internet users) can easily visit. These are like "public subnets." Other rooms, like a secret safe where you keep important game data, you'd want to keep totally private, maybe with no direct windows to the street, only accessible from inside your house. These are "private subnets." The fun part is, you get to be the architect! You decide which rooms are public, which are private, and how they connect to each other or to the outside world. This is like designing the layout and security of your very own digital home.

So, by designing your VPC and its subnets, you can build online projects that are not only super safe and secure, but also incredibly reliable. This means when you create your amazing new online game or website, you can be confident that it will always be there for your friends to play, even if one small part of your digital house has a temporary issue. You're in charge of making it robust and unbreakable!

An AWS Virtual Private Cloud (VPC) is your own isolated, virtual network in the AWS cloud, acting as a logically separated slice of AWS infrastructure where you deploy all your resources. Think of it as your personal datacenter, but entirely software-defined. Every AWS resource you provision—like EC2 instances, RDS databases, or Lambda functions (when connected to a VPC)—resides within a VPC. It's defined by a CIDR block (e.g., 10.0.0.0/16), which is a range of private IP addresses that resources within your VPC can use. The VPC provides fundamental network isolation and security, ensuring that your applications and data are separate from other AWS customers and giving you complete control over your network environment.

Within your VPC, you define subnets – logical subdivisions that exist within specific Availability Zones (AZs). This is a critical design choice for high availability and fault tolerance; you spread your application components across multiple AZs using separate subnets in each. Subnets are typically categorized as 'public' or 'private'. Public subnets have a route to an Internet Gateway, allowing resources within them to communicate directly with the internet. Private subnets, on the other hand, do not have a direct route to the Internet Gateway, making them ideal for sensitive resources like databases or internal application tiers that shouldn't be publicly accessible. Traffic within and out of subnets is controlled by Route Tables, which dictate where network traffic is directed.

For a DevOps Engineer, effective VPC and subnet design is paramount. It’s the foundational blueprint for your entire cloud infrastructure, impacting security, scalability, and resilience. A well-designed VPC spans multiple AZs, segregating resources into public-facing tiers (e.g., load balancers, web servers in public subnets) and backend private tiers (e.g., databases, application servers in private subnets). This segmentation, combined with security groups and Network Access Control Lists (NACLs), creates a robust defense-in-depth strategy. Understanding how to provision and configure VPCs and subnets is essential for building reliable, secure, and automated cloud environments, moving beyond simply deploying resources to thoughtfully architecting their network foundation.

Key Takeaways

  • A VPC is your isolated, private network in AWS, providing the foundation for all your cloud resources.
  • Subnets divide your VPC, typically by Availability Zone and by public/private access, for high availability and security.
  • Route Tables control traffic flow within and out of your subnets, determining internet access and inter-subnet communication.
  • Good network design (multi-AZ, public/private segmentation) is crucial for building secure, resilient, and scalable infrastructure.
  • DevOps engineers use Infrastructure as Code to automate the deployment and management of VPCs and subnets.

Code Example

yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: Basic VPC and Subnet for learning purposes
Resources:
  MyDevOpsVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags: [{Key: Name, Value: DevOpsVPC}]

  MyDevOpsPublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyDevOpsVPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs ''] # First AZ
      MapPublicIpOnLaunch: true
      Tags: [{Key: Name, Value: DevOpsPublicSubnet}]

How this code works

This CloudFormation template sets up a fundamental network environment in AWS. It defines a VPC named MyDevOpsVPC, which is an isolated virtual network in the cloud, much like a private network at home or office. Within this VPC, the template then creates a Subnet called MyDevOpsPublicSubnet, specifically designed to host resources that need direct internet access.

The MyDevOpsVPC is allocated a large IP address range with its CidrBlock of 10.0.0.0/16 and is configured to enable DNS resolution and hostnames. The MyDevOpsPublicSubnet is then created within this VPC using !Ref MyDevOpsVPC, receiving a smaller CidrBlock (10.0.1.0/24) from the VPC's range. It's automatically placed in the region's first available AvailabilityZone. A subtle but critical property for a public subnet is MapPublicIpOnLaunch: true. This ensures that any EC2 instance launched into this subnet automatically receives a public IP address, enabling direct internet communication without additional manual setup.

Related Articles

Hand-picked reads to go deeper on aws core services.

Back to DevOps Engineer Roadmap