VPC: Networking Basics

A VPC (Virtual Private Cloud) is your own isolated network inside AWS — a private slice of the cloud where you control the IP address ranges, the subnets, and exactly what can talk to what. Every EC2 instance you launch lives inside a VPC, whether you thought about it or not (AWS gives every account a default one).

CIDR blocks and subnets

A VPC is defined by a CIDR block — a range of IP addresses, like 10.0.0.0/16, giving you about 65,000 addresses to divide up. You split that range into smaller subnets, each living in one availability zone, and each subnet holds the actual resources (like EC2 instances):

bash terminal
aws ec2 create-vpc --cidr-block 10.0.0.0/16
aws ec2 create-subnet --vpc-id vpc-0abc123 --cidr-block 10.0.1.0/24 --availability-zone us-east-1a
Output (abridged)
VPC created: vpc-0abc123
Subnet created: subnet-0def456 (10.0.1.0/24, us-east-1a)

Public vs. private subnets

The difference between a "public" and "private" subnet isn't a special AWS setting — it comes down to routing. A subnet is public if its route table sends internet-bound traffic to an internet gateway attached to the VPC. A subnet is private if it has no such route, so nothing inside it is directly reachable from (or can directly reach) the internet.

A common, deliberate pattern: put your web servers in a public subnet so they can accept incoming traffic, and put your database in a private subnet so it's simply unreachable from the outside world, no matter what security group mistakes might happen later.

Defense in depth: a private subnet is a second layer of protection underneath security groups — even if a security group rule is accidentally too permissive, a resource in a private subnet still has no route to or from the internet at all. Relying on just one layer (just security groups, or just subnet placement) is how avoidable breaches happen.

Connecting subnets to the internet

An internet gateway lets a public subnet reach the internet directly. For a private subnet that still needs outbound access (to download updates, for instance, without accepting any inbound connections), a NAT gateway sits in a public subnet and forwards that outbound traffic on the private resource's behalf.

PreviousEC2: Virtual Servers