Crisp answer: A VPC is a logically isolated section of the AWS cloud where you launch resources in a defined IP address space. Core components are subnets, route tables, internet gateways, NAT gateways, and security groups.
VPC:
- Spans all AZs in a region
- Has a CIDR block: e.g. 10.0.0.0/16 (65,536 IPs)
- Resources inside share the network but are isolated from other VPCs by default
- One default VPC per region (created by AWS, do not use for production)
Subnets:
- Reside in a single AZ
- Carved from the VPC CIDR: 10.0.1.0/24, 10.0.2.0/24, etc.
- Public subnet: route table has a route to an Internet Gateway
- Private subnet: no route to IGW, outbound via NAT Gateway
- AWS reserves 5 IPs per subnet (first 4 and last 1)
Route tables:
- Every subnet is associated with a route table
- Routes: destination CIDR → target (IGW, NAT GW, VPC endpoint, etc.)
- Local route (10.0.0.0/16 → local) always present, cannot be removed
- Most specific route wins (longest prefix match)
Public route table:
10.0.0.0/16 → local
0.0.0.0/0 → igw-xxx ← internet access
Private route table:
10.0.0.0/16 → local
0.0.0.0/0 → nat-xxx ← outbound via NAT Gateway
10.42.0.0/16 → pcx-xxx ← VPC peering to another VPC
Internet Gateway:
- Attached to the VPC (one per VPC)
- Enables resources with public IPs to communicate with the internet
- Stateful: handles NAT for instances with Elastic IPs
- Free: no cost for the gateway itself, only for data transfer
NAT Gateway:
- Lives in a public subnet
- Allows private subnet resources to initiate outbound internet connections
- Translates private IP → NAT Gateway's public IP for outbound traffic
- Does NOT allow inbound connections from the internet (unlike IGW)
- Cost: ~$0.045/hr + $0.045/GB processed
- For HA: one NAT GW per AZ
VPC Endpoints:
- Gateway endpoints (free): S3 and DynamoDB — route table based
- Interface endpoints (paid ~$0.01/hr/AZ): other AWS services via PrivateLink
- Allow private subnet resources to reach AWS services without internet or NAT GW
Key concepts:
Elastic IP: static public IP address allocated to your account
ENI: Elastic Network Interface — virtual NIC attached to instances
VPC Peering: private connectivity between two VPCs (non-transitive)
Transit Gateway: hub-and-spoke to connect many VPCs and on-prem networks
PrivateLink: expose services privately without VPC peering or IGW
What to say in the interview:
"A VPC is your isolated network in AWS. Subnets are carved from its CIDR and sit in a single AZ. Route tables determine where traffic goes: public subnets route to an Internet Gateway, private subnets route to a NAT Gateway for outbound. For private connectivity to AWS services I use VPC endpoints — gateway endpoints are free for S3 and DynamoDB, interface endpoints use PrivateLink for everything else. In the rag-bedrock project I deployed Lambda in private subnets with five interface endpoints so it could reach Bedrock, Secrets Manager, and CloudWatch without any internet path."