Lesson 054 · AWS Learning Path

AWS 054: VPC and CIDR planning

Anil Jalela · Published Aug 18, 2025 · 7 min read

The problem

A team uses VPC and CIDR planning as a label or Console setting without proving the identity, scope, behavior, failure boundary, cost, or operational result. The configuration appears complete but the real requirement remains untested.

Final outcome

The learner will inspect, explain, test, and document VPC and CIDR planning. The submission must connect the Console and CLI view to the same AWS control, state what the evidence proves, diagnose one likely failure, and make a requirement-based architecture decision.

Learning outcomes

You will be able to:

1. explain a vpc is a regional virtual network;
2. explain ipv4 cidrs must fit aws rules;
3. explain ipv6 is not smaller ipv4;
4. explain overlap blocks simple connectivity;
5. explain ipam manages address space;

1. distinguish successful configuration from successful workload behavior;
2. preserve redacted evidence and complete the stated cleanup or retention decision.

Mental model

requirement
   -> identity and permission
   -> account, Region, and resource scope
   -> configuration or request
   -> observable state
   -> workload result
   -> failure evidence
   -> cleanup or controlled retention

Never begin with a create button or a copied command. Start with the result that must be proven and the boundary that must remain protected.

Core facts

How to reason about it

Draw the enterprise address plan before creating a VPC. Record Region, environment, owner, primary and secondary CIDRs, IPAM pool, AZ subnet ranges, connectivity domains, and future growth. A large unused CIDR is inexpensive; later overlap and renumbering are operationally expensive.

Use the following decision table as a starting point, then change the answer when the scenario changes.

Prerequisites, permissions, Region, and cost

Run this lesson as the approved non-root course identity. Begin with aws sts get-caller-identity, confirm the private account record, and set the fixed project Region before any regional query. IAM resources are global within an account, while STS endpoints and the services reached by an identity can be regional.

Use only the read or change actions required for this lesson. An AccessDenied result is evidence to analyse, not permission to switch to root or attach AdministratorAccess. Record the action, resource, principal type, request context, and smallest justified correction.

The listed cost tier is T0 - no resource creation. Free Tier eligibility and credits are account-specific. Before a mutating lab, identify every resource that can charge, estimate its duration, start a timer, and write the reverse cleanup order. A budget reports cost after billing data arrives and is not a real-time stop control.

AWS Management Console method

1. Open VPC, then Your VPCs, and inspect primary and secondary IPv4 and IPv6 CIDR associations.
2. Open VPC IPAM and review pools, allocations, utilization, and overlap findings when IPAM is configured.
3. Compare the VPC ranges with planned peering, Transit Gateway, VPN, Direct Connect, and recovery-network ranges.

For every step record the service page, selected account and Region, exact object, visible state, and why that state matters. A Console label or green status is not enough unless it is tied to the final workload outcome.

AWS CLI or API evidence

List every VPC CIDR association and compare it with planned peer and on-premises ranges.

aws ec2 describe-vpcs --query 'Vpcs[].{Vpc:VpcId,Primary:CidrBlock,AllCidrs:CidrBlockAssociationSet[].CidrBlock,Ipv6:Ipv6CidrBlockAssociationSet[].Ipv6CidrBlock}' --output table

The primary CIDR alone is not the full address space. Include every associated IPv4 and IPv6 block when checking routes and overlap.

Before running the command, replace every placeholder, explain each option, and decide whether the operation is read-only or mutating. Capture the exit code immediately. Redact account IDs, ARNs, public addresses, request identifiers, and personal data before sharing.

The CLI and Console are clients of AWS APIs. Matching state across them increases confidence, but neither substitutes for data-plane or application verification.

Practical work

Extend the AWS 013 address hierarchy into P04. Start with the private planning pool 10.0.0.0/8, allocate 10.42.0.0/16 to nw-p04-vpc, and reserve these exact subnets: 10.42.10.0/24 public A, 10.42.20.0/24 public B, 10.42.110.0/24 private A, and 10.42.120.0/24 private B. In p04-cidr-plan.md, calculate every boundary, AWS-assignable count, overlap check, remaining growth range, hybrid risk, and rejected alternative. Do not create a VPC.

The evidence package must include:

• non-root principal type, account verified privately, and Region;
• exact intended and observed state;
• one Console observation and the matching CLI or API result;
• one successful result and one denied, failed, or counterexample result;
• what each result does not prove;
• cost state and elapsed lab time;
• cleanup evidence or a named retained-state owner and next lesson.

Verification standard

Use three levels of proof:

1. Control plane: the object or policy exists with the intended configuration.
2. Data plane or behavior: the request, packet, session, storage path, or application does what the requirement states.
3. Operations: monitoring, failure diagnosis, cost, ownership, and cleanup are known.

A control-plane response can precede final readiness. Use waiters or state polling where supported, then test the actual behavior. If a request times out, do not assume it failed. Inspect state and use documented idempotency before retrying a mutation.

Troubleshooting method

Keep the original symptom and timestamp. State one hypothesis, make one reversible change, repeat the original test, and record rollback. Never open a management port to the world, expose credentials, disable TLS verification, format an unknown disk, or add broad permissions as a generic fix.

Architecture and certification decisions

Professional-level questions provide competing valid features. Identify the requirement that decides between them: human or workload identity, same-account or cross-account access, regional or zonal scope, stateful or stateless filtering, durable or ephemeral data, latency, RTO/RPO, cost, or operational ownership.

Explain why the selected option fits and why each plausible alternative fails one stated requirement. Do not rely on feature memorization or reproduce protected certification questions.

Knowledge check

1. Can a VPC contain subnets in two Regions?

Expected direction: No. A VPC is regional; each subnet belongs to one Availability Zone in that Region.

1. Why is a /16 everywhere not a complete address plan?

Expected direction: Large repeated ranges overlap when networks connect and can waste scarce private IPv4 space.

1. Does IPv6 need a NAT gateway for internet egress?

Expected direction: No. Route through an internet gateway for two-way eligibility or an egress-only internet gateway for outbound-initiated access.

1. What does IPAM add beyond a CIDR spreadsheet?

Expected direction: Central allocation rules, discovery, utilization, overlap visibility, and multi-account governance.

Cost, cleanup, and retained state

Retain only the state explicitly required by the next P04 lesson and record it in the private resource ledger.

Cleanup evidence includes the final state query, not only a successful delete response. Search related resources, other Regions used by the lab, retained storage, public IPv4 addresses, logging destinations, and service-managed dependencies. Schedule a later billing review because cost data can lag.

Completion gate

Pass when the practical artifact explains the real problem, matches Console and CLI evidence, answers every knowledge check, diagnoses one failure without broadening access, records cost, and proves cleanup or approved retention. The learner must defend one decision orally and name the requirement that would change it.

Official sources

• VPC CIDR blocks
• What is VPC IPAM?