Introduction
If you have been learning AWS, you have probably come across the term VPC and wondered what it actually means. AWS VPC (Virtual Private Cloud) is one of the most fundamental services in AWS — and understanding it is essential for anyone working in the cloud.
In this guide, I will explain AWS VPC in the simplest way possible — no jargon, no confusion. By the end, you will clearly understand what a VPC is, why it exists, and how the key components like subnets, route tables, and gateways work together.
What is a VPC?
A Virtual Private Cloud (VPC) is your own private, isolated section of the AWS cloud. Think of it like renting a piece of land in a large city (AWS), where you build your own gated community (VPC) with its own roads, rules, and access points.
When you launch resources like EC2 instances or RDS databases in AWS, they live inside a VPC. Without a VPC, your resources would have no network to connect to.
Every AWS account comes with a default VPC already created for you in each region, so you can start launching resources immediately without setting up networking from scratch.
Key Components of a VPC
1. CIDR Block — The IP Address Range
When you create a VPC, you assign it a CIDR block — a range of IP addresses that your VPC will use. For example:
10.0.0.0/16This means your VPC can use IP addresses from 10.0.0.0 to 10.0.255.255 — giving you 65,536 possible IP addresses to assign to your resources.
2. Subnets — Dividing Your VPC
A subnet is a smaller division of your VPC’s IP address range. Think of your VPC as a city and subnets as neighbourhoods within that city.
There are two types of subnets:
- Public Subnet — Resources here can communicate directly with the internet (e.g., web servers)
- Private Subnet — Resources here cannot be accessed from the internet directly (e.g., databases)
Example subnet division:
VPC: 10.0.0.0/16
Public Subnet: 10.0.1.0/24 (for web servers)
Private Subnet: 10.0.2.0/24 (for databases)3. Internet Gateway — The Door to the Internet
An Internet Gateway (IGW) is what connects your VPC to the internet. Without an Internet Gateway attached to your VPC, none of your resources can communicate with the outside world.
You attach one Internet Gateway to one VPC. It is horizontally scalable and highly available — you do not need to manage it.
4. Route Tables — Traffic Direction
A Route Table contains rules (called routes) that determine where network traffic goes. Every subnet in your VPC must be associated with a route table.
A typical public subnet route table looks like this:
Destination Target
10.0.0.0/16 local (traffic stays within VPC)
0.0.0.0/0 igw-xxxxxxxx (all other traffic goes to internet)A private subnet route table only has the local route — no internet access.
5. NAT Gateway — Internet for Private Subnets
Resources in a private subnet sometimes need to reach the internet — for example, to download software updates — but you do not want the internet to reach them directly.
A NAT Gateway (Network Address Translation) solves this. It sits in a public subnet and allows private subnet resources to initiate outbound internet connections, while blocking all inbound traffic from the internet.
6. Security Groups — Instance-Level Firewall
A Security Group acts as a virtual firewall for your EC2 instances. It controls what traffic is allowed in (inbound) and out (outbound).
Example Security Group for a web server:
Inbound: Allow HTTP (port 80) from anywhere
Inbound: Allow HTTPS (port 443) from anywhere
Inbound: Allow SSH (port 22) from my IP only
Outbound: Allow all traffic7. Network ACLs — Subnet-Level Firewall
Network ACLs (NACLs) work at the subnet level, not the instance level. They are stateless, meaning you must explicitly allow both inbound and outbound rules. Most beginners rely on Security Groups and leave NACLs at their default (allow all) settings.
How It All Works Together
Here is a simple real-world example of how a VPC is structured for a web application:
Internet
|
Internet Gateway
|
Public Subnet (10.0.1.0/24)
|-- Web Server (EC2) ← accessible from internet
|-- NAT Gateway
|
Private Subnet (10.0.2.0/24)
|-- Database (RDS) ← NOT accessible from internet
|-- App Server (EC2) ← only accessible from web serverThe flow works like this:
- A user on the internet visits your website
- The request goes through the Internet Gateway to your Web Server in the public subnet
- The Web Server talks to the Database in the private subnet
- The Database is never directly exposed to the internet
Default VPC vs Custom VPC
| Feature | Default VPC | Custom VPC |
|---|---|---|
| Created automatically | Yes | No — you create it |
| Good for | Learning and testing | Production workloads |
| Subnets | Public subnets only | You design the structure |
| Security | Basic | Fully customizable |
Conclusion
AWS VPC is the foundation of your cloud network. Every resource you launch in AWS lives inside a VPC, so understanding how it works will make everything else in AWS much clearer.
To summarize the key components:
- VPC — Your private network in AWS
- Subnets — Divide your VPC into public and private sections
- Internet Gateway — Connects your VPC to the internet
- Route Tables — Direct traffic to the right destination
- NAT Gateway — Lets private resources access the internet safely
- Security Groups — Control traffic at the instance level
Once you are comfortable with these concepts, the next step is to create your own VPC in the AWS console and practice setting up subnets and gateways. Hands-on practice is the fastest way to truly understand VPC.