Virtual Private Cloud — your own isolated network inside AWS. Complete beginner-friendly guide for 1st semester students.
Before VPC existed, when you launched an EC2 instance it went directly on a shared public network — visible to the internet by default. As more companies moved to AWS, this became a serious security problem.
VPC (Virtual Private Cloud) solves this: it gives you a completely isolated section of the AWS cloud where you control the networking — your own IP address ranges, subnets, routing rules, and security.
Without VPC → you're working at a public co-working space. Anyone can walk up to your desk.
With VPC → you rent an entire private floor. Only your team gets access. You control which rooms have windows (internet access) and which are internal-only. You hire security guards and set up access control at every door.
VPC = your private floor in AWS's building. The building (AWS) manages power, cooling, and physical security. You manage everything inside your floor.
When you create a VPC, you give it a CIDR block — this is the range of private IP addresses your VPC can use. Think of it as deciding "how big is my office building?"
A division of your VPC. Like a floor of your building. Each subnet lives in one Availability Zone.
The main door connecting your VPC to the public internet. Without it, nothing gets in or out.
The directory/signage system. Tells traffic "if you want the internet, go through the IGW."
Firewall at the instance level. Like a security guard at each individual office room.
Firewall at the subnet level. Like a checkpoint at the entrance to each floor.
Lets private subnet servers reach out to the internet (to download updates) without being directly exposed.
The most important concept in VPC architecture. The only difference between a public and private subnet is the route table — specifically, whether traffic can reach the Internet Gateway.
| Feature | Public Subnet | Private Subnet |
|---|---|---|
| Route to Internet? | ✅ Yes (via IGW) | ❌ No direct route |
| Directly reachable from internet? | Yes (with public IP) | No |
| What goes here? | Web servers, Load Balancers, Bastion Host | Databases, App servers, internal APIs |
| Example IP access | World can reach it | Only resources in the VPC |
Public Subnet = The ground floor reception and lobby. People from outside can walk in. Your web server (the receptionist) sits here — it talks to the public.
Private Subnet = The secure back office / server room. No windows. No direct external access. Your database (confidential files) stays here. Only internal staff (other servers inside the VPC) can access it.
| Feature | Security Group | Network ACL (NACL) |
|---|---|---|
| Level | Instance (EC2 level) | Subnet level |
| State | Stateful — return traffic auto-allowed | Stateless — must allow inbound AND outbound separately |
| Rules | Allow rules only | Allow AND Deny rules |
| Default | Deny all inbound, allow all outbound | Allow all traffic (default) |
| Analogy | Security guard at each room's door | Security checkpoint at each floor entrance |
When your AWS account is created, AWS automatically sets up a Default VPC in every region. This is why you've been able to launch EC2 instances without manually setting up networking!
CIDR: 172.31.0.0/16 · Internet Gateway attached · Public subnets in each AZ · Route table with internet route
All subnets are public. No private isolation. Good for learning, but a real application needs a custom VPC with proper separation.
In real applications, resources are separated into 3 layers — each with different security requirements. This is called 3-tier architecture.
| Concept | AWS | Azure |
|---|---|---|
| Private Network | VPC (Virtual Private Cloud) | VNet (Virtual Network) |
| Subnets | Subnets (public/private) | Subnets |
| Internet Access | Internet Gateway | No separate IGW; public IP + routing |
| Outbound only access | NAT Gateway | NAT Gateway |
| Instance-level firewall | Security Group (stateful) | Network Security Group (stateful) |
| Subnet-level firewall | Network ACL (stateless) | NSG at subnet level |
| Scope | One Region | One Region |
All links go to docs.aws.amazon.com — official AWS reference.
| Topic | AWS Docs URL |
|---|---|
| VPC Overview | vpc/what-is-amazon-vpc.html |
| Subnets (Public & Private) | vpc/configure-subnets.html |
| Internet Gateway | vpc/VPC_Internet_Gateway.html |
| Route Tables | vpc/VPC_Route_Tables.html |
| Security Groups | vpc/vpc-security-groups.html |
| Network ACLs (NACLs) | vpc/vpc-network-acls.html |
| Default VPC | vpc/default-vpc.html |
| Create a VPC (Quickstart) | vpc/create-vpc.html |