reference deployment

Modular and Scalable VPC Architecture on AWS

Flexible networking foundation for AWS Cloud infrastructures

This Quick Start provides a networking foundation based on AWS best practices for your AWS Cloud infrastructure. It builds a virtual private network (VPC) environment with public and private subnets where you can launch AWS services and other resources.

Use this Quick Start as a building block for your own deployments. You can scale it up or down as needed, and add other infrastructure components and software layers to complete your AWS environment.


This Quick Start was developed by AWS.


AWS Service Catalog administrators can add this architecture to their own catalog.  

  •  What you'll build
  •  How to deploy
  •  Cost and licenses
  •  What you'll build
  • Use this Quick Start to build a VPC environment with the following features on AWS:

    • Up to four Availability Zones for high availability and disaster recovery. Availability Zones are geographically distributed within a region and spaced for best insulation and stability in the event of a natural disaster. We recommend that you maximize your use of Availability Zones to isolate a data center outage.
    • Separate subnets for unique routing requirements. We recommend using public subnets for external-facing resources and private subnets for internal resources. For each Availability Zone, this Quick Start provisions one public subnet and one private subnet by default.
    • Additional layer of security. We recommend using network access control lists (ACLs) as firewalls to control inbound and outbound traffic at the subnet level. This Quick Start provides an option to create a network ACL protected subnet in each Availability Zone. These network ACLs provide individual controls that you can customize as a second layer of defense.
    • Independent routing tables configured for every private subnet to control the flow of traffic within and outside the VPC. The public subnets share a single routing table, because they all use the same internet gateway as the sole route to communicate with the internet.
    • Highly available NAT gateways instead of NAT instances. NAT gateways offer major advantages in terms of deployment, availability, and maintenance.
    • Spare capacity for additional subnets, to support your environment as it grows or changes over time.



  •  How to deploy
  • To deploy this Quick Start, follow the steps in the deployment guide, which includes these steps. The stack takes about 5 minutes to launch.

    1. Sign in to your AWS account. If you don't have an account, sign up at
    2. Launch the Quick Start.
    3. Add other services or applications.

    To customize your deployment, you can choose the number of Availability Zones you want to use for resource distribution, reconfigure the subnet segmentation and sizing for the VPC, and create additional private subnets with custom network ACLs.

    Amazon may share user-deployment information with the AWS Partner that collaborated with AWS on the Quick Start.  

  •  Cost and licenses
  • You are responsible for the cost of the AWS services used while running this Quick Start reference deployment. There is no additional cost for using the Quick Start.

    The AWS CloudFormation template for this Quick Start includes configuration parameters that you can customize. Some of these settings, such as instance type, number of Availability Zones, and amount of data that flows through the NAT device, will determine the cost of deployment. For pricing details, see the Amazon EC2 pricing and Amazon VPC pricing pages.