Route Tables

Learn AWS route tables for deciding where subnet traffic goes, including internet gateways, NAT gateways, VPC endpoints, and peering.

Last reviewed: June 2026

·AWS CloudAWS CLI v2AWS SDKsAWS Well-Architected Framework
✅
Quick Understanding: Route Tables helps teams design, build, secure, operate, and troubleshoot AWS workloads. In enterprise projects, the important questions are ownership, blast radius, automation, observability, compliance, and cost.

🔍 What Is It?

A route table contains rules that determine where network traffic goes.

Each subnet is associated with a route table. Routes can point to local VPC networks, internet gateways, NAT gateways, VPC endpoints, Transit Gateway, peering connections, and other targets.

🎯 Why Do We Need It?

Routing decides whether a subnet is public, private, isolated, connected to another VPC, or able to reach AWS services privately.

Without correct routes, applications cannot reach dependencies or may be exposed unintentionally.

Common developer mistakes:

  • →Choosing defaults without checking security, cost, or failure behavior
  • →Treating AWS services as isolated tools instead of part of an architecture
  • →Skipping tags, alarms, IAM review, backups, and runbooks until production incidents happen
  • →Building manually in the console and then struggling to reproduce environments

🏗️ What Happens in Real Projects?

Public subnets route 0.0.0.0/0 to an internet gateway. Private app subnets route outbound internet to NAT gateways. Data subnets may have no internet route, but may use VPC endpoints for S3, CloudWatch, or Secrets Manager.

This makes route tables a core security and availability artifact.

⚙️ How It Works

When a packet leaves a resource, AWS checks the subnet's route table for the most specific matching destination.

Local VPC routes exist automatically. Additional routes determine external connectivity and private service access.

💻 Example

Route table comparison — Public, private, and isolated subnet routing.

text
Public route table:
  10.20.0.0/16 -> local
  0.0.0.0/0    -> internet gateway

Private app route table:
  10.20.0.0/16 -> local
  0.0.0.0/0    -> NAT gateway

Data route table:
  10.20.0.0/16 -> local
  S3 prefix     -> VPC endpoint

🤔 Common Confusions

❓ Does a route table allow traffic by itself?

No. Routing provides a path. Security groups, NACLs, and service policies still control access.

❓ What makes a route more specific?

The longest matching CIDR prefix wins, such as 10.20.1.0/24 over 10.20.0.0/16.

❓ Can one subnet use multiple route tables?

A subnet is associated with one route table at a time.

🚨 Common Production Issues

**Private subnet accidentally public** because default route points to an internet gateway.

**Wrong NAT route** sends traffic across AZs or to a failed dependency.

**Overlapping CIDRs** break peering and hybrid connectivity.

**Missing endpoint routes** causes service access failures or unnecessary NAT cost.

✅ Best Practices

Keep separate route tables for public, app, and data tiers

Review default routes during security reviews

Use VPC endpoints to reduce NAT dependency where suitable

Avoid cross-AZ NAT routing for resilient designs

Document hybrid and peering routes clearly

Manage routes through IaC

🏛️ Architect's Note

Senior Architect's Perspective

Route tables are where network intent becomes reality. When an outage says "the app cannot reach X", routes are one of the first places a senior engineer checks.

💬 Frequently Asked Questions

Interview: How would you explain Route Tables in a real AWS project?

Route Tables should be explained through the business workload it supports, the AWS responsibility boundary, the failure modes, the security controls, and how it is monitored and automated.

Interview: What production mistake do developers commonly make with Route Tables?

The common mistake is using the service successfully in a lab but not designing for least privilege, multi-AZ resilience, alarms, cost visibility, and repeatable infrastructure.

Can a route table make a subnet public?

Yes, if it routes internet traffic to an internet gateway and resources can use public IPs.

Do route tables replace security groups?

No. Routing and firewall controls solve different parts of network access.

🎯 Key Takeaways

1Route tables decide traffic paths
2Subnet routing determines public, private, or isolated behavior
3Routing does not replace firewall authorization
4IaC and documentation are important for network routes

🎯 Practice this topic in interviews

↗ Where this topic fits

Sources

Sources / References

Use these AWS references to verify the concept in official docs and continue into the most relevant SplashRide pages.