Amazon VPC Network Design - Subnet Architecture and NAT Gateway Optimization
Learn how to design public/private subnet separation, layered security group management, and reduce NAT Gateway costs with Gateway VPC Endpoints.
VPC Overview
VPC is a service that lets you build a logically isolated virtual network on AWS. You define an IP address range with a CIDR block and control the network using subnets, route tables, security groups, and network ACLs. By separating public and private subnets, you establish a security boundary between internet-facing resources and internal resources.
Subnet Design and NAT Gateway
Public subnets have a route to the internet gateway and host ALBs and NAT Gateways. Private subnets have no direct route to the internet and host EC2, RDS, and Lambda. NAT Gateways provide outbound connectivity from private subnets (for package updates, API calls, etc.) but incur hourly and data processing charges. For access to S3 and DynamoDB, use VPC Endpoints (gateway type, free of charge) to bypass the NAT Gateway and reduce costs. VPC Flow Logs record ENI-level traffic to CloudWatch Logs or S3, enabling detection of unauthorized access and investigation of connectivity issues.
Security Group and NACL Design
Security groups are stateful, instance-level firewalls that define allow rules only. The recommended design is to separate security groups by layer - application (ALB), business logic (EC2/ECS), and data (RDS) - and reference security group IDs for inter-layer communication. Network ACLs are stateless, subnet-level firewalls that can define both allow and deny rules. They are used for explicitly blocking access from specific IP ranges or for coarse-grained control at the subnet level. Enable VPC Flow Logs to analyze traffic denied by security groups and NACLs, and periodically review your rules for gaps or excess. To deepen your knowledge of network design, specialized books on Amazon can be a helpful resource.
NAT Gateway Cost Optimization
NAT Gateways incur data processing charges (approximately $0.062 per GB) and hourly charges (approximately $0.062/hour), and costs can spike rapidly in environments with heavy outbound traffic. The most effective cost reduction is to configure Gateway VPC Endpoints (free) for S3 and DynamoDB so that traffic bypasses the NAT Gateway. For frequently accessed AWS services like ECR, CloudWatch Logs, and STS, set up Interface VPC Endpoints to reduce NAT Gateway data processing volume. In a multi-AZ configuration with a NAT Gateway in each AZ, there are no cross-AZ data transfer charges, but the hourly charge applies per NAT Gateway. Use Cost Explorer to track NAT Gateway costs monthly and quantitatively evaluate the savings from adding VPC Endpoints.
Summary
VPC provides multi-layered network security through subnet separation, security groups, and network ACLs. Separate security groups by application layer, business logic layer, and data layer, and analyze traffic with VPC Flow Logs. Establish free private connectivity to S3 and DynamoDB with Gateway VPC Endpoints and optimize NAT Gateway data processing costs.