Ch. 15 · AWS

AWS VPC Routes and Network Reachability

AWS VPC Routes and Network Reachability. Learn the reasoning, a practical example, common mistakes and an interview exercise.

~2 min readbeginnerupdated Oct 3, 2026

A subnet’s route table determines where traffic goes. Internet reachability also depends on addresses, gateways and security controls.

Before you start

You should understand regions, identity permissions and the responsibilities of the AWS service being discussed. Sketch request flow and failure boundaries before choosing configuration. Work through these scenarios as designs; provisioning real resources can introduce charges and requires an account-specific permissions and capacity plan.

The practical goal is to reason through this situation: A public subnet has an appropriate route, but an instance still needs suitable addressing and allowed traffic. Read the walkthrough first, then try the interview exercise before opening its answer. The important part is explaining the decision and its consequences, rather than remembering a definition alone.

Step-by-step walkthrough

Step 1: Trace destination routing

Inspect the subnet route table for the requested destination.

Step 2: Check addressing and gateways

A route must correspond to a viable address and network path.

Step 3: Inspect traffic controls

Security rules and destination behavior determine whether the connection succeeds.

Worked scenario

A public subnet has an appropriate route, but an instance still needs suitable addressing and allowed traffic.

An instance in a subnet with an internet route still lacks direct IPv4 internet connectivity if it has no suitable public addressing and no alternative NAT path. Conversely, a viable route does not authorize inbound requests. Test routing, addressing and filtering as separate layers before blaming application credentials.

Common mistake

A route alone does not authorize a connection.

Verify the behavior

Trace outbound DNS and connection attempts across the actual gateway and rule path.

Interview exercise

Troubleshoot outbound access.

Answer and reasoning

Check the route, gateway path, address type and security controls, then confirm the application destination and DNS.

Continue learning

Compare the scenario with the AWS interview questions and test your understanding with the AWS MCQs. For terminology and implementation details, consult the reference material.

More in AWS

read ✓AWS · hard

AWS DynamoDB Query vs Scan

Read by key with Query, avoid full-table Scans, and add indexes to serve the access patterns you actually have.

~2 min readread →
read ✓AWS · mid

AWS ECS vs EKS

Compare ECS and EKS for running containers on AWS, and choose by control, portability and team capability.

~2 min readread →
esc