Lesson 03 — Amazon VPC Fundamentals

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 04 – Amazon VPC & Network Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand the core components of an Amazon VPC.
Explain CIDR blocks and IP addressing.
Understand Regions and Availability Zones.
Identify the key building blocks of every VPC.
Design a basic enterprise VPC.

📚 Lesson Information

Estimated Time: 60–75 Minutes

Difficulty: Beginner

Prerequisites: Lesson 02 – Why Virtual Private Clouds (VPCs)?

Hands-on Lab: No

Assignment: No

💼 Business Value

Every enterprise application begins with a network.

Before deploying:

Web Applications
APIs
Databases
Kubernetes Clusters
AI Platforms

Cloud engineers first create the network where these resources will reside.

A poorly designed VPC can result in:

IP address conflicts
Difficult expansion
Poor security
Complex routing
Higher operational costs

A well-designed VPC becomes the foundation for secure cloud infrastructure.

🏢 In the Company

CloudNova Technologies is preparing to migrate several business applications to AWS.

The Cloud Architecture Team must first answer important questions:

Which AWS Region should be used?
How many Availability Zones are required?
What IP address range should be allocated?
How should the network be segmented?
How can future growth be supported?

These decisions are made before launching the first EC2 instance.

🌍 What is an Amazon VPC?

Amazon Virtual Private Cloud (Amazon VPC) is an isolated virtual network inside an AWS Region.

Within a VPC you control:

IP Address Range
Subnets
Route Tables
Internet Connectivity
Security Controls
Private Communication

Every AWS resource deployed into a VPC becomes part of your private cloud network.

🏗 Amazon VPC Architecture

AWS Region

│

Amazon VPC

│

├── Public Subnet
│
├── Private Subnet
│
├── Route Tables
│
├── Internet Gateway
│
├── NAT Gateway
│
├── Security Groups
│
└── Network ACLs

These components work together to provide secure networking.

🌎 AWS Regions

An AWS Region is a geographical location where AWS operates multiple data centres.

Examples include:

Mumbai
Singapore
London
Frankfurt
Sydney
North Virginia

Each Region is completely independent.

CloudNova selects Regions based on:

Customer location
Compliance
Disaster recovery
Latency
Business requirements

🏢 Availability Zones (AZs)

Each AWS Region contains multiple Availability Zones (AZs).

An Availability Zone is one or more physically separate data centres with independent:

Power
Cooling
Networking

Example:

ap-south-1 (Mumbai)

│

├── Availability Zone A

├── Availability Zone B

└── Availability Zone C

Enterprises deploy applications across multiple Availability Zones to improve availability and resilience.

🌐 CIDR Blocks

Every Amazon VPC requires a CIDR Block.

CIDR (Classless Inter-Domain Routing) defines the IP address range available inside the VPC.

Example:

10.0.0.0/16

This means:

Network Address: 10.0.0.0
Prefix Length: /16

The CIDR block determines how many private IP addresses are available for your resources.

🧩 Common Enterprise CIDR Blocks

CIDR Block	Typical Usage
10.0.0.0/16	Large Enterprise
10.10.0.0/16	Business Unit
172.16.0.0/16	Medium Environment
192.168.0.0/16	Small Environment

CloudNova allocates CIDR blocks carefully to avoid overlap between business units and future cloud expansions.

📍 Private IPv4 Address Ranges

AWS VPCs use private IP addresses defined by RFC1918.

The three private address ranges are:

Private Range	Example
10.0.0.0/8	10.10.1.25
172.16.0.0/12	172.20.5.40
192.168.0.0/16	192.168.10.15

These addresses are not directly reachable from the public internet.

🏗 CloudNova Enterprise Example

CloudNova chooses the following network.

Region

ap-south-1

↓

Amazon VPC

10.10.0.0/16

↓

Availability Zones

AZ-A

AZ-B

AZ-C

The architecture provides sufficient IP addresses while supporting high availability across three Availability Zones.

📦 Core Components of Every VPC

Every enterprise VPC contains several essential components.

Component	Purpose
VPC	Virtual Network
CIDR Block	IP Address Range
Availability Zones	High Availability
Subnets	Network Segmentation
Route Tables	Traffic Routing
Internet Gateway	Public Internet Access
NAT Gateway	Secure Outbound Internet Access
Security Groups	Instance Firewall
Network ACLs	Subnet Firewall

These services will be explored in detail throughout this module.

🌎 Real Enterprise Example

CloudNova is deploying a customer-facing banking application.

The architecture requires:

AWS Region

↓

Amazon VPC

10.10.0.0/16

↓

Public Subnets

↓

Application Subnets

↓

Database Subnets

Resources are distributed across multiple Availability Zones to ensure the application remains available even if one Availability Zone experiences an outage.

🔒 Security Considerations

Before creating a VPC, Cloud Security Engineers should consider:

Future business growth
IP address planning
Multi-AZ deployment
Regulatory requirements
Network segmentation
Hybrid connectivity
Disaster recovery

Good planning today prevents major redesigns later.

🚫 Common Mistakes

Avoid:

❌ Choosing a CIDR block without future planning.

❌ Deploying all resources into one Availability Zone.

❌ Overlapping IP ranges across VPCs.

❌ Creating VPCs without documentation.

❌ Ignoring future hybrid networking requirements.

✅ Enterprise Best Practices

Plan IP addressing before deployment.
Leave room for future expansion.
Deploy workloads across multiple Availability Zones.
Use meaningful VPC naming conventions.
Document CIDR allocations.
Avoid overlapping IP address ranges.
Design with security and scalability in mind.

🧪 Enterprise Mission 01 — Design a VPC

CloudNova plans to launch a new online learning platform.

Design a VPC by selecting:

AWS Region
CIDR Block
Number of Availability Zones

Explain your choices.

🧪 Enterprise Mission 02 — CIDR Planning

CloudNova expects rapid growth over the next five years.

Recommend:

A suitable CIDR block.
Why that range was selected.
How it supports future expansion.
How overlapping IP addresses can be avoided.

🧪 Enterprise Mission 03 — Availability Planning

CloudNova wants its customer portal to remain available during infrastructure failures.

Design a deployment strategy using multiple Availability Zones.

Explain how this improves resilience.

🧪 Enterprise Mission 04 — Architecture Review

Review the following architecture.

AWS Region

↓

Amazon VPC

10.10.0.0/16

↓

AZ-A

AZ-B

AZ-C

Identify:

Benefits
Potential risks
Future improvements

🏢 Enterprise Scenario

CloudNova is opening a new regional office in Europe.

The infrastructure team needs to deploy applications while ensuring:

High availability
Low latency
Regulatory compliance
Future scalability

As the Cloud Security Engineer, recommend:

Which AWS Region should be selected.
How many Availability Zones should be used.
An appropriate VPC CIDR block.
Key networking considerations before deployment.

Present your recommendation as if advising the Cloud Architecture Review Board.

📊 Knowledge Check

What is an Amazon VPC?
What is a CIDR block?
Why is IP planning important?
What is an AWS Region?
What is an Availability Zone?
Why should enterprises use multiple Availability Zones?
Name the three RFC1918 private IPv4 address ranges.
Why should CIDR blocks not overlap?
What are the core components of a VPC?
Why should enterprise networks be designed for future growth?

📋 Lesson Completion Checklist

Task	Status
Understood Amazon VPC fundamentals	☐
Learned Regions and Availability Zones	☐
Understood CIDR blocks	☐
Reviewed CloudNova network design	☐
Completed enterprise missions	☐
Finished the knowledge check	☐

💡 Key Takeaways

After completing this lesson, you should understand:

Amazon VPC is the foundation of networking in AWS.
Every VPC requires careful planning of Regions, Availability Zones and CIDR blocks.
Proper IP address planning prevents future networking challenges.
Multi-AZ deployments improve resilience and availability.
Enterprise VPC design should prioritise scalability, security and future growth.

🚀 Next Lesson

➡️ Lesson 04 — Public & Private Subnets