What's changed: In-scope coverage: added service mesh/discovery/device VPN (App Mesh/Cloud Map/Client VPN)
1.1VPC and IP Addressing Design
Understand the foundation of network design—VPC, CIDR, subnets, non-overlapping address planning, and multi-AZ. The initial design dictates later scalability and connectivity.
AWS networking starts with a VPC (virtual private cloud). A VPC is assigned an IP range via a CIDR block (e.g., 10.0.0.0/16) and divided into subnets.
1.1.1CIDR and address planning
- Choose CIDR carefully up front: a VPC primary CIDR cannot be changed later (you can add secondary CIDRs). Size generously and leave room to grow.
- Avoid overlap with on-prem: overlapping CIDRs break routing over peering and hybrid connections.
- Subnets are per-AZ: a subnet belongs to one AZ. Spread across multiple AZs for availability.
- IPv6 optional: you can add IPv6 to a VPC/subnet if needed (dual-stack).
Common on ANS-C01: a VPC primary CIDR cannot be changed (only added to), never overlap CIDRs with on-prem or other VPCs, and a subnet = one AZ; use multi-AZ for availability. Eliminate overlapping CIDRs at design time.
AWS reserves 5 IPs per subnet (the first four and the last). Very small /28 subnets leave very few usable IPs—plan accordingly.
ANS-C01 addressing probes "CIDR planning that won’t break future connectivity." A VPC primary CIDR is immutable; when short, add secondary CIDRs (within non-overlapping RFC1918 ranges). The biggest pitfall is overlapping CIDRs—if ranges collide with on-prem, other VPCs, acquisitions, or SaaS peers, routing cannot work over peering/Transit Gateway/VPN/Direct Connect, so the norm is to centrally plan and allocate address space with IPAM (IP Address Manager). To connect to an unavoidably overlapping peer, work around it with PrivateLink (CIDR-independent) or NAT for overlap (private NAT/double NAT). Subnets are per-AZ, and AWS reserves 5 IPs per subnet (.0 network, .1 router, .2 DNS, .3 reserved, last broadcast-equivalent). DNS is controlled via the VPC Route 53 Resolver (.2 resolver) and the enableDnsSupport/enableDnsHostnames attributes; for on-prem name resolution use Resolver inbound/outbound endpoints. IPv6 can be added dual-stack (/56 to the VPC, /64 to subnets); IPv6 is generally globally unique so needs no NAT, with egress-only via an Egress-Only IGW. The key is to plan non-overlapping CIDRs with IPAM and design up front for room to grow, multi-AZ, DNS, and IPv6.
| Design item | Rule/means | Key point |
|---|---|---|
| Primary CIDR | Immutable; add secondary | Size generously up front; no overlap |
| Avoid overlap | Plan centrally with IPAM | Overlap breaks hybrid/peering |
| Connect overlapping peer | PrivateLink / private NAT | CIDR-independent workaround |
| Subnet/DNS/IPv6 | Per-AZ; Route 53 Resolver; dual-stack | 5 reserved IPs; IPv6 needs no NAT (EIGW) |
Scenario: Multiple teams created VPCs independently, CIDRs overlap, and Transit Gateway interconnection fails—plan for future growth too. → Centrally manage org address space with IPAM, defining non-overlapping pools/allocation rules. Re-CIDR (rebuild) the overlapping VPCs, or work around for now with PrivateLink for per-service connectivity. Vend new VPCs from IPAM with a generous primary CIDR plus secondary headroom, multi-AZ subnets, and IPv6 dual-stack if needed.
FAQ: What if the CIDR runs out? Since the primary CIDR is immutable, add a secondary CIDR and create new subnets there (you can’t expand existing subnets). Choose non-overlapping ranges; planning with IPAM from the start avoids exhaustion and overlap. To connect to an unavoidably overlapping peer, work around with PrivateLink or private NAT.
Exam trap: "Expand the primary CIDR because the VPC is tight" is wrong—the primary CIDR is immutable; you can only add (secondary CIDRs). Also, creating a VPC with a CIDR that overlaps on-prem means later VPN/Direct Connect/peering routing fails, forcing a rebuild. Eliminate overlap at design time with IPAM.
1.1.2Section summary
- Foundation = VPC + CIDR + subnets; size CIDR generously, no overlap
- Availability = spread subnets across multiple AZs
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You are designing a new VPC that will connect to on-prem via VPN/Direct Connect. What matters most in addressing?
Q2. After creating a VPC as 10.0.0.0/16, you want to change that primary CIDR block itself. Which is correct?
Q3. For high availability, how should subnets be placed?