VPC Design, IPv6 and Network Security

What it is

A VPC design decides how address space is allocated, which subnets face the internet, and how workloads are kept apart. At scale this is an organization-wide plan, not a per-VPC decision.

Network security adds layers on top: filtering at the instance and subnet, deep inspection between networks, and protection of web applications. IPv6 adoption reshapes both, because IPv6 addresses are globally unique and need no NAT.

How it works

Subnets, addressing and segmentation

• Public subnets route to an internet gateway and hold load balancers and NAT gateways. Private subnets hold application and data tiers and reach the internet through a NAT gateway.
• Place one NAT gateway in each AZ so the loss of one AZ does not cut outbound access for the others.
• Size subnets for growth: EKS pods and Lambda in a VPC consume IP addresses quickly.

Amazon VPC IP Address Manager (IPAM) plans, tracks and monitors IP addresses across accounts and Regions. You build a hierarchy of pools (for example by Region and environment), integrate with AWS Organizations, and let accounts allocate non-overlapping CIDRs from the pools.

IPAM allocation rules control the size and tagging of allocations, and its monitoring flags overlapping or unmanaged CIDRs. Planning without overlaps keeps future peering, Transit Gateway and hybrid routing possible.

Segmentation separates environments or trust levels. Use separate VPCs and accounts for hard boundaries, Transit Gateway route tables to control which VPCs can reach each other, and subnets with route tables inside a VPC.

Filtering: security groups and network ACLs

Use security groups for most access control and reference groups instead of IP ranges. Use a network ACL deny rule to block a specific CIDR quickly at the subnet edge.

Inspection and application protection

A common multi-account pattern sends traffic between VPCs and to the internet through a central inspection VPC attached to Transit Gateway. Turn on appliance mode on that attachment so both directions of a flow use the same AZ and the same stateful firewall.

Flow Logs capture metadata such as addresses, ports, action and bytes, not packet payloads. Use Traffic Mirroring when payload inspection is required.

IPv6 and dual stack

• A dual-stack VPC adds an IPv6 CIDR alongside IPv4, so resources can use both during migration. Add IPv6 to subnets, route tables, security groups and load balancers.
• Every IPv6 address is globally routable. An egress-only internet gateway lets instances start outbound IPv6 connections while blocking inbound ones, which is the IPv6 equivalent of a NAT gateway's role.
• IPv6-only subnets save IPv4 space. To reach IPv4-only services, use DNS64 on the subnet with NAT64 on a NAT gateway.
• Migrate from the outside in: dual-stack the load balancers and edge first, then the application tiers, then retire IPv4 where possible.

How the exam asks about this

• "Two hundred accounts keep creating overlapping CIDRs that block Transit Gateway routing" -> Amazon VPC IPAM pools shared across the organization with allocation rules.
• "All traffic between VPCs must pass a stateful firewall, and some flows break asymmetrically" -> central inspection VPC with Network Firewall and appliance mode on the Transit Gateway attachment.
• "The company is running out of private IPv4 space for EKS pods" -> adopt IPv6, such as an IPv6 EKS cluster in dual-stack subnets, with an egress-only internet gateway for outbound traffic.