Amazon EKS Custom Subnet for Pods Configuration

SAA-C03 By islever Editorial Last updated Oct 15, 2026

Short answer

C Use the Amazon VPC CNI plugin for Kubernetes and define custom subnets in the VPC cluster for the pods to use.

Question

A company is migrating an application from an on-premises location to Amazon Elastic Kubernetes Service (Amazon EKS). The company must use a custom subnet for pods that are in the company's VPC to comply with requirements. The company also needs to ensure that the pods can communicate securely within the pods' VPC. Which solution will meet these requirements?

Configure AWS Transit Gateway to directly manage custom subnet configurations for the pods in Amazon EKS.
Create an AWS Direct Connect connection from the company's on-premises IP address ranges to the EKS pods.
Use the Amazon VPC CNI plugin for Kubernetes. Define custom subnets in the VPC cluster for the pods to use. Correct Answer
Implement a Kubernetes network policy that has pod anti-affinity rules to restrict pod placement to specific nodes that are within custom subnets.

Key Takeaways

The core concept is that the Amazon VPC CNI plugin assigns VPC IP addresses directly to pods, allowing them to behave like native EC2 instances within specific subnets.

This question addresses how to configure Amazon EKS pods to use custom VPC subnets while ensuring secure intra-VPC communication. The correct solution leverages the Amazon VPC CNI plugin for Kubernetes.

Common mistake: Learners often confuse network policies with infrastructure configuration or mistake Transit Gateway's role in pod-level subnet management, leading them to choose options A or D incorrectly.

Expert Analysis

Why the Answer Is Correct

The Amazon VPC CNI plugin for Kubernetes is the default networking plugin for EKS clusters. It allows pods to receive their own IP addresses from a specified VPC subnet, enabling direct communication between pods and other AWS resources as if they were EC2 instances. By defining custom subnets in the cluster configuration using this plugin, you satisfy the requirement for pods to reside in specific subnets and communicate securely within the VPC.

Why the Other Options Are Wrong

Option A is incorrect because AWS Transit Gateway manages connectivity between multiple VPCs and on-premises networks, not pod-level subnet assignments within an EKS cluster. Option B is incorrect because Direct Connect provides network connectivity between on-premises and AWS, but does not configure internal pod subnetting or security within the VPC. Option D is incorrect because Kubernetes Network Policies control traffic flow (allow/deny rules), while anti-affinity rules control pod scheduling placement; neither mechanism assigns VPC IPs or defines which subnets pods use.

Community Comment Notes

Community consensus strongly supports option C. As user 'officedepotadmin' noted, the plugin "allows Kubernetes pods to receive IP addresses from a VPC's subnet." User 'Sarayounisaldossary' highlighted that it provides "native integration of Kubernetes networking into AWS VPC," confirming pods act like EC2 instances. User 'LeonSauveterre' correctly distinguished that Transit Gateway handles inter-network connectivity rather than pod-level subnet configurations.

Official Reference

https://docs.aws.amazon.com/eks/latest/userguide/cni-increase-ips.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about pod networking in EKS, always consider the VPC CNI plugin first if the requirement involves IP addressing or subnet placement. Remember that Network Policies control traffic, not topology.

Frequently Asked Questions

Why can't we use Kubernetes Network Policies to assign subnets?

Network policies only filter traffic (allow/deny). They do not assign IP addresses or determine which VPC subnets pods are placed in.

Does the VPC CNI plugin support IPv6 for pods?

Yes, the VPC CNI plugin supports both IPv4 and IPv6 addressing for pods, allowing flexible subnet configuration.

More SAA-C03 FAQ →

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

officedepotadmin 👍 6 Answered C

The Amazon VPC Container Network Interface (CNI) plugin is the default network plugin for Amazon EKS. It allows Kubernetes pods to receive IP addresses from a VPC's subnet and enables pods to communicate securely within the VPC as if they were native VPC resources.
mooondooo 👍 3 Answered C

Probably C https://repost.aws/knowledge-center/eks-custom-subnet-for-pod
LeonSauveterre 👍 1 Answered C

A - AWS Transit Gateway is used to manage connectivity between multiple VPCs, on-premises networks, or other AWS services. It does not manage pod-level subnet configurations in Amazon EKS. B - This can't address the specific requirement to configure custom subnets for pods within the VPC. C - This is the recommended approach. D - Pod anti-affinity rules are used for scheduling constraints, not for subnet allocation or secure communication within the VPC.
Sarayounisaldossary 👍 1 Answered C

The Amazon VPC CNI plugin is a Kubernetes networking plugin for EKS. where it provides: a unique VPC IP address for each pod and native integration of Kubernetes networking into AWS VPC - Pods can communicate like any EC2 instance on the same subnet.
dhewa 👍 2 Answered C

C all the way.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide