Amazon VPC

What is Amazon VPC?

Amazon Virtual Private Cloud (Amazon VPC) gives you full control over your virtual networking environment, including resource placement, connectivity, and security. It is the foundational layer for your EC2 instances, RDS databases, and most other AWS services.

**Core Concept:** Think of a VPC as your own private data center within the AWS public cloud. You define the IP address range (CIDR), subnets, route tables, and network gateways.

Hands-on: Create a VPC

Follow these steps to create a production-ready VPC using the VPC and more wizard in the AWS Console.

1
Open VPC Dashboard

Go to the AWS Console and search for VPC. Click Create VPC.
2
Select Wizard

Under Resources to create, select VPC and more. This option automatically creates subnets, route tables, and gateways.
3
Configure Settings

Name tag RunGenAiVPC

IPv4 CIDR 10.0.0.0/16

Availability Zones 2

Public subnets 2

Private subnets 2

NAT gateways In 1 AZ (Cost optimized)
4
Create

Click Create VPC. AWS will provision ~15 resources in background. Once complete, click View VPC.

VPC Architecture

                    graph TB
                        subgraph VPC ["Amazon VPC (10.0.0.0/16)"]
                            direction TB
                            
                            subgraph AZ1 ["Availability Zone A"]
                                direction TB
                                PubSub1["Public Subnet\n(10.0.1.0/24)"]
                                PrivSub1["Private Subnet\n(10.0.2.0/24)"]
                            end
                            
                            subgraph AZ2 ["Availability Zone B"]
                                direction TB
                                PubSub2["Public Subnet\n(10.0.3.0/24)"]
                                PrivSub2["Private Subnet\n(10.0.4.0/24)"]
                            end

                            IGW[Internet Gateway]
                            NAT[NAT Gateway]
                            
                            IGW <--> PubSub1
                            IGW <--> PubSub2
                            
                            PubSub1 -.-> NAT
                            PrivSub1 --> NAT
                            PrivSub2 --> NAT
                        end
                        
                        Internet((Internet)) <--> IGW

Standard 2-AZ Architecture with Public and Private Subnets

Core Components

Subnets

Logical subdivisions of an IP network. Public Subnets have a route to the Internet Gateway. Private Subnets do not.

Route Tables

A set of rules (routes) that determine where network traffic from your subnet or gateway is directed.

Internet Gateway

A horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet.

NAT Gateway

Allows instances in a private subnet to connect to the internet (e.g., for updates) but prevents the internet from initiating connections to them.

Security Groups

Acts as a virtual firewall for your EC2 instances to control incoming and outgoing traffic. Stateful inspection.

Network ACLs

An optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. Stateless.

Best Practices

Use Multiple Availability Zones
Always span your VPC across at least 2 AZs with redundant subnets for high availability.
CIDR Planning
Choose a CIDR range large enough to scale (e.g., /16) and avoid overlapping with on-premise networks.
Public vs Private
Place resources like Databases and App servers in Private Subnets. Only Load Balancers and Bastions should be in Public.

Advanced Connectivity

VPC Peering

Connect two VPCs (even across accounts) to route traffic privately.

Transit Gateway

A central hub that connects VPCs and on-premise networks.

PrivateLink

Expose services to other VPCs privately without peering.

VPN & Direct Connect

Connect your on-premise data center to your VPC.