Skip to content
reetwizamatya:~$

SAA-C03 · VPC and Networking

Exam domain: Design Secure Architectures (30%)

Almost every SAA-C03 scenario touches VPCs. Have the packet path memorized.

The mental model

Section titled “The mental model”
flowchart LR
  igw[Internet Gateway] --- pubrt[Public Route Table]
  pubrt --- pub[Public subnet: 10.0.1.0/24]
  pub --- nat[NAT Gateway]
  nat --- privrt[Private Route Table]
  privrt --- priv[Private subnet: 10.0.11.0/24]
  priv --- ec2[EC2 workloads]
  ec2 -.->|VPC endpoint| s3[(S3)]
  • Subnets live inside one AZ. High availability = replicate the pattern across ≥ 2 AZs.
  • Route tables are associated with subnets — they decide where outbound packets go.
  • Public subnet = route to IGW. Private subnet = route to NAT for outbound-only.

Public vs private subnet — the definition

Section titled “Public vs private subnet — the definition”

NAT Gateway vs NAT instance

Section titled “NAT Gateway vs NAT instance”
ConcernNAT GatewayNAT instance
Managed by AWS✅❌ (you patch it)
Throughput45 Gbps burstLimited by instance type
CostPer-hour + per-GBEC2 hourly (cheaper for low tx)
HARedundant within an AZManual (script your failover)

VPC endpoints — Gateway vs Interface

Section titled “VPC endpoints — Gateway vs Interface”

Gateway endpoint

Route-table entry. Free. Available only for S3 and DynamoDB. Best for keeping S3 traffic off the internet without paying for NAT egress.

Interface endpoint

Powered by AWS PrivateLink — an ENI in your subnet with a private IP. Works with most services (SSM, KMS, SNS, ECR, custom services). Hourly + per-GB.

Transit Gateway — the hub

Section titled “Transit Gateway — the hub”

TGW replaces the “peer every VPC to every other VPC” nightmare with a hub-and-spoke topology.

flowchart TB
  TGW((Transit Gateway))
  VPCa[VPC A: shared services]
  VPCb[VPC B: prod]
  VPCc[VPC C: non-prod]
  DX[Direct Connect gateway]
  onprem[On-prem DC]
  VPCa --- TGW
  VPCb --- TGW
  VPCc --- TGW
  TGW --- DX
  DX --- onprem

Route table decision cheat sheet

Section titled “Route table decision cheat sheet”
flowchart LR
  P{Destination}
  P -->|Local VPC CIDR| local[local]
  P -->|Internet, from public subnet| igw[igw-…]
  P -->|Internet, from private subnet| nat[nat-…]
  P -->|S3 or DDB| gwep[Gateway endpoint prefix list]
  P -->|Other VPCs / on-prem| tgw[tgw-attach-…]

SG vs NACL

Section titled “SG vs NACL”
  • Stateful. Return traffic auto-allowed.
  • Attached to ENIs. Multiple SGs per ENI, evaluated as a union.
  • Rules are allow-only.