# VPC & Networking

> zop.dev provisions a VPC with 3 subnet tiers (public, private and database) spread across availability zones, with an internet gateway, NAT gateways and route tables wired for each tier. The number of NAT gateways is the single decision that drives the ongoing cost.

Source: https://zop.dev/integrations/provision/aws/vpc-networking
Updated: 2026-08-19

---

An Amazon VPC is the isolated network foundation every other AWS resource lives in. zop.dev lays out a production-grade, three-tier network for you, so teams get secure segmentation between public-facing, application, and database workloads without hand-writing routing tables.

## A VPC with public, private, and database subnets

VPC, three subnet tiers (public, private, db), internet gateway, Elastic IP, NAT gateway, three route tables with routes and associations, and an allow-TLS security group.

## The subnets map and automatic NAT egress

```text
Single subnets map input: vpc_cidr, public_subnets_cidr[], private_subnets_cidr[], db_subnets_cidr[], availability_zones[]. NAT egress is wired automatically for the private and db tiers.
```

## Routing and the TLS security group come along

Three-tier routing and TLS security group are created automatically alongside the VPC.

## The three-tier split

Public subnets hold anything needing an inbound route from the internet: load balancers,
bastions. Private subnets hold compute with outbound-only access through NAT. Database subnets
hold datastores with no internet route at all.

That third tier is the one people skip when building by hand, and it is the one that matters
most in a security review: a database subnet with no route to an internet gateway cannot be
exposed by a misconfigured security group, because there is no path.

## NAT gateways are the cost decision

Each NAT gateway costs roughly $32 a month before any data crosses it, plus a per-GB processing
charge. One per availability zone is the resilient pattern and the expensive one. A three-AZ
VPC starts at about $96 a month with zero traffic.

For a development VPC a single NAT gateway shared across zones cuts that to a third. It creates
a zonal dependency, which is the correct tradeoff in an environment where an AZ failure means
someone fixes it on Monday.

Once provisioned, this is also the most common finding on the idle-NAT-gateway rule.

## VPC endpoints are the cheaper path for AWS services

Traffic to S3 and DynamoDB does not need to leave AWS. A gateway VPC endpoint routes it
directly, costs nothing, and removes that traffic from the NAT gateway's per-GB charge entirely.

For a workload that reads heavily from S3, this single change usually saves more than the NAT
gateway costs.

## What you get by default

`vpc_cidr`, `public_subnets_cidr[]`, `private_subnets_cidr[]` and the database tier, with routing
and a TLS security group created automatically for each.