Amazon VPC Network Design - Subnet Architecture and NAT Gateway Optimization
Learn how to design public/private subnet separation, layered security group management, and reduce NAT Gateway costs with Gateway VPC Endpoints.
VPC Overview
VPC is a service that lets you build a logically isolated virtual network on AWS. You define an IP address range with a CIDR block and control the network using subnets, route tables, security groups, and network ACLs. By separating public and private subnets, you establish a security boundary between internet-facing resources and internal resources.
Subnet Design and NAT Gateway
Public subnets have a route to the internet gateway and host ALBs and NAT Gateways. Private subnets have no direct route to the internet and host EC2, RDS, and Lambda. NAT Gateways provide outbound connectivity from private subnets (for package updates, API calls, etc.) but incur hourly and data processing charges. For access to S3 and DynamoDB, use VPC Endpoints (gateway type, free of charge) to bypass the NAT Gateway and reduce costs. VPC Flow Logs record ENI-level traffic to CloudWatch Logs or S3, enabling detection of unauthorized access and investigation of connectivity issues.
Security Group and NACL Design
Security groups are stateful, instance-level firewalls that define allow rules only. The recommended design is to separate security groups by layer - application (ALB), business logic (EC2/ECS), and data (RDS) - and reference security group IDs for inter-layer communication. Network ACLs are stateless, subnet-level firewalls that can define both allow and deny rules. They are used for explicitly blocking access from specific IP ranges or for coarse-grained control at the subnet level. Enable VPC Flow Logs to analyze traffic denied by security groups and NACLs, and periodically review your rules for gaps or excess.
NAT Gateway Cost Optimization
NAT Gateways incur data processing charges (approximately USD 0.062 per GB) and hourly charges (approximately USD 0.062/hour), and costs can spike rapidly in environments with heavy outbound traffic (as of August 2026). The most effective cost reduction is to configure Gateway VPC Endpoints (free) for S3 and DynamoDB so that traffic bypasses the NAT Gateway. For frequently accessed AWS services like ECR, CloudWatch Logs, and STS, set up Interface VPC Endpoints to reduce NAT Gateway data processing volume. In a multi-AZ configuration with a NAT Gateway in each AZ, there are no cross-AZ data transfer charges, but the hourly charge applies per NAT Gateway. Use Cost Explorer to track NAT Gateway costs monthly and quantitatively evaluate the savings from adding VPC Endpoints.
CIDR Design and Address Planning
What matters at the outset of VPC design is planning the address range (CIDR). With future expansion and connections to other VPCs and on-premises environments in mind, allocate address spaces that do not overlap while securing sufficient size. If CIDRs overlap, you can no longer route traffic correctly when you connect networks through peering or VPN. Managing address allocation across the entire organization and distributing ranges to each VPC and subnet in a planned way prevents connectivity problems later on. Because a cramped design at the outset requires rebuilding when you expand, a plan with room to spare becomes the foundation of a network that lasts.
Availability and Multi-AZ Design
The basic principle for a production network is a design that creates no single point of failure. Prepare subnets that span multiple Availability Zones, and place a configuration with the same role in each zone. This way, even if a failure occurs in a zone, you can continue the service in a different zone. By also placing the NAT that handles outbound traffic redundantly in each zone, you can prevent communication outages during a zone failure. By distributing load balancers and instances across zones and making the configuration zone-aware, you can ensure high availability. Because redundancy also involves a balance with cost, design an appropriate level according to your requirements.
Connectivity Options
Connecting a VPC to other networks broadens the range of its uses. To connect a few VPCs one-to-one, peering is easy, but as their number grows, management becomes cumbersome. To consolidate many VPCs and on-premises environments, Transit Gateway, which functions as a hub, is suitable. If you want to connect securely only to specific services, PrivateLink lets you do so without exposing your entire network. For connections to on-premises environments, use VPN or dedicated lines. It is important to choose these means appropriately and combine them according to the number of parties you connect to and the security and performance you require.
Monitoring and Troubleshooting
Because network problems are difficult to isolate, put mechanisms for visibility in place in advance. If you record communication logs, you can see which traffic was allowed or denied, which helps you investigate why connections fail. If you use a tool that analyzes path reachability, you can identify where packets fail to arrive because of misconfigurations. Because traffic control consists of two layers, stateful security groups and network ACLs that apply per subnet, isolate which of them is blocking the traffic. Having means in place to verify configurations against actual traffic supports stable network operations.
Summary
VPC provides multi-layered network security through subnet separation, security groups, and network ACLs. Separate security groups by application layer, business logic layer, and data layer, and analyze traffic with VPC Flow Logs. Establish free private connectivity to S3 and DynamoDB with Gateway VPC Endpoints and optimize NAT Gateway data processing costs.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon VPC official page
- Amazon EC2 official page
- AWS PrivateLink official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.