Busca en todas las páginas de la documentación
A VPC is easy to stand up and easy to get subtly wrong - an overlapping CIDR that blocks a future merge, a public route table that exposes a subnet you meant to keep private, a NAT gateway quietly billing for traffic that should have used a free endpoint.
Walk this list once now, then use it as a review checklist before shipping any code that creates or modifies VPC networking.
/16 per VPC leaves room; do not cram everything into a /24.10.0.0.0/8 (or 172.16.0.0/12) with a documented scheme so no two teams collide.Create the VPC with a planned block and tag it from the start.
# --- Python (boto3) ---
import boto3
ec2 = boto3.client("ec2", region_name="us-east-1")
ec2.create_vpc(
CidrBlock="10.20.0.0/16", # documented, non-overlapping block
TagSpecifications=[{"ResourceType": "vpc",
"Tags": [{"Key": "Name", "Value": "prod-vpc"},
{"Key": "Environment", "Value": "production"}]}],
)// --- TypeScript (AWS SDK v3) ---
import { EC2Client, CreateVpcCommand } from "@aws-sdk/client-ec2";
const ec2 = new EC2Client({ region: "us-east-1" });
await ec2.send(new CreateVpcCommand({
CidrBlock: "10.20.0.0/16", // documented, non-overlapping block
TagSpecifications: [{ ResourceType: "vpc",
Tags: [{ Key: "Name", Value: "prod-vpc" },
{ Key: "Environment", Value: "production" }] }],
}));enableDnsHostnames off by default; flip it with ModifyVpcAttribute.MapPublicIpOnLaunch on a private-tier subnet.0.0.0.0/0 -> igw route to the main table, or every unassociated subnet silently becomes public.local route is automatic and immutable; do not try to add or remove it.ReplaceRoute, not delete-and-recreate, to avoid a gap.Wire public routing explicitly and leave the main table alone.
# --- Python (boto3) ---
import boto3
ec2 = boto3.client("ec2", region_name="us-east-1")
rt = ec2.create_route_table(VpcId="vpc-0abc123")
rt_id = rt["RouteTable"]["RouteTableId"]
ec2.create_route(RouteTableId=rt_id,
DestinationCidrBlock="0.0.0.0/0", GatewayId="igw-0def456")
ec2.associate_route_table(RouteTableId=rt_id, SubnetId="subnet-0public1")// --- TypeScript (AWS SDK v3) ---
import {
EC2Client, CreateRouteTableCommand, CreateRouteCommand, AssociateRouteTableCommand,
} from "@aws-sdk/client-ec2";
const ec2 = new EC2Client({ region: "us-east-1" });
const rt = await ec2.send(new CreateRouteTableCommand({ VpcId: "vpc-0abc123" }));
const rtId = rt.RouteTable?.RouteTableId;
await ec2.send(new CreateRouteCommand({
RouteTableId: rtId, DestinationCidrBlock: "0.0.0.0/0", GatewayId: "igw-0def456",
}));
await ec2.send(new AssociateRouteTableCommand({ RouteTableId: rtId, SubnetId: "subnet-0public1" }));0.0.0.0/0 on management ports like SSH or RDP.1024-65535) since NACLs are stateless.Reference the source group instead of an IP range.
# --- Python (boto3) ---
import boto3
ec2 = boto3.client("ec2", region_name="us-east-1")
ec2.authorize_security_group_ingress(
GroupId="sg-0db222",
IpPermissions=[{
"IpProtocol": "tcp", "FromPort": 5432, "ToPort": 5432,
"UserIdGroupPairs": [{"GroupId": "sg-0web111",
"Description": "Postgres from web tier"}],
}],
)// --- TypeScript (AWS SDK v3) ---
import { EC2Client, AuthorizeSecurityGroupIngressCommand } from "@aws-sdk/client-ec2";
const ec2 = new EC2Client({ region: "us-east-1" });
await ec2.send(new AuthorizeSecurityGroupIngressCommand({
GroupId: "sg-0db222",
IpPermissions: [{
IpProtocol: "tcp", FromPort: 5432, ToPort: 5432,
UserIdGroupPairs: [{ GroupId: "sg-0web111", Description: "Postgres from web tier" }],
}],
}));ReleaseAddress.REJECT flow logs on sensitive subnets for cheap security and troubleshooting visibility.Because peering and Transit Gateway cannot route between VPCs with overlapping ranges, and you cannot easily re-address a live VPC. Choosing distinct blocks up front keeps future connectivity possible.
Large enough to grow into - a /16 per VPC is a common default. You cannot shrink a CIDR and expanding it is limited, so err toward roomy.
Any subnet you do not explicitly associate uses the main table. If it has an internet route, every such subnet is silently public. Keep it private and associate an explicit public table where you want it.
Reference other security groups between tiers so access follows instances rather than IP addresses, and only use CIDRs for external sources you must name.
No. Security groups are stateful, so responses to allowed inbound traffic are permitted automatically. Only add egress rules to restrict outbound-initiated traffic.
Use one gateway per AZ to avoid cross-AZ charges, offload S3 and DynamoDB traffic to free gateway endpoints, and release Elastic IPs you no longer use.
A NAT gateway is AZ-scoped. One shared gateway is a single point of failure and forces cross-AZ traffic that bills extra. Per-AZ gateways are both more resilient and cheaper at scale.
Reverse of creation: disassociate and delete custom route tables, detach and delete gateways, delete NAT gateways and release EIPs, delete subnets, then the VPC - after clearing any lingering ENIs and endpoints.
At least REJECT logs on sensitive subnets are cheap and invaluable for security and debugging. Use ALL to S3 where you need forensics, scoping volume with subnet-level logs.
Tier subnets across at least two AZs, put a NAT gateway in each AZ, and spread load balancers and instances across the AZs so one zone's failure does not take the workload down.
Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).
Revisado por Chris St. John·Última actualización: 23 jul 2026