Skip to content

AWS VPC — Virtual Private Cloud

Amazon Virtual Private Cloud (VPC) is your own private, isolated section of the AWS network. All AWS resources you create (EC2, RDS, Lambda in VPC, etc.) live inside a VPC.

In Azure terms: AWS VPC = Azure Virtual Network (VNet)

ConceptDescription
VPCIsolated virtual network with a CIDR block (e.g., 10.0.0.0/16)
SubnetA sub-range of the VPC CIDR, tied to a specific AZ
Route TableRules that determine where network traffic is directed
Internet Gateway (IGW)Connects public subnets to the internet
NAT GatewayLets private subnet resources make outbound internet calls
Security GroupStateful firewall at the instance/ENI level
Network ACL (NACL)Stateless firewall at the subnet level
VPC PeeringPrivate connection between two VPCs (same or different accounts)
Transit GatewayHub for connecting many VPCs and on-prem networks
Public SubnetPrivate Subnet
Route to internetVia Internet GatewayVia NAT Gateway (outbound only)
ResourcesLoad balancers, bastion hostsEC2 app servers, RDS databases
Receives inbound internetYesNo
Has public IPsTypically yesNo

Every AWS account has a default VPC per region with:

  • CIDR 172.31.0.0/16
  • A public subnet in each AZ
  • An attached Internet Gateway
  • Default route table routing all traffic to the IGW

Avoid using the default VPC for production. Create a custom VPC with proper subnet isolation.

VPC: 10.0.0.0/16
├── Public Subnet (10.0.1.0/24) — Load Balancers, Bastion
│ └── Internet Gateway
├── Private Subnet (10.0.2.0/24) — Application Servers (EC2)
│ └── NAT Gateway → Internet (outbound only)
└── Database Subnet (10.0.3.0/24) — RDS, ElastiCache
└── No internet access
FeatureSecurity GroupNetwork ACL
Operates atInstance (ENI) levelSubnet level
StateStateful — return traffic auto-allowedStateless — must allow inbound AND outbound
DefaultDeny all inbound, allow all outboundAllow all inbound and outbound
RulesAllow only (no explicit deny)Allow and Deny
EvaluationAll rules evaluatedRules evaluated in order by rule number
OptionDescription
Internet GatewayPublic internet access for the VPC
NAT GatewayOutbound internet for private subnets (AWS-managed, highly available)
VPC PeeringPrivate, non-transitive connection between two VPCs
Transit GatewayHub-and-spoke model for connecting 100s of VPCs + on-prem
AWS Direct ConnectDedicated private line from your data center to AWS
VPN GatewayIPsec VPN tunnel over public internet
AWS PrivateLinkSecurely access AWS services or your services from a VPC without public IPs
FeatureAWS VPCAzure VNet
Core unitVPCVirtual Network (VNet)
SubnetsMust be in a single AZSpan the region (not AZ-specific)
PeeringVPC PeeringVNet Peering
Hub-and-spokeTransit GatewayAzure Virtual WAN / Hub VNet
Private endpointsVPC Endpoint (PrivateLink)Private Endpoint
On-prem connectionDirect ConnectExpressRoute
VPNAWS VPN GatewayVPN Gateway
DNSRoute 53 Resolver / VPC DNSAzure Private DNS
Security at subnetNetwork ACL (stateless)Network Security Group (stateful)
Security at resourceSecurity Group (stateful)Network Security Group
Terminal window
# Create a VPC
aws ec2 create-vpc --cidr-block 10.0.0.0/16 \
--tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=my-vpc}]'
# Create a subnet
aws ec2 create-subnet \
--vpc-id vpc-0abc123 \
--cidr-block 10.0.1.0/24 \
--availability-zone us-east-1a
# Create an Internet Gateway and attach
aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway \
--vpc-id vpc-0abc123 \
--internet-gateway-id igw-0abc123
# Create a security group
aws ec2 create-security-group \
--group-name web-sg \
--description "Web server security group" \
--vpc-id vpc-0abc123
# Allow HTTP inbound
aws ec2 authorize-security-group-ingress \
--group-id sg-0abc123 \
--protocol tcp \
--port 80 \
--cidr 0.0.0.0/0