Virtual Private Cloud (VPC)
An isolated virtual network inside a public cloud where you control IP ranges and routing.
What is a VPC?
A VPC is your private slice of cloud network infrastructure. You define IP CIDR blocks, subnets, route tables, gateways, and security rules — similar to a traditional data center LAN, but software-defined.
Building blocks
| Component | Purpose |
|---|---|
| Subnet | Segment VPC by availability zone or tier (public/private) |
| Internet Gateway | Public subnet access to/from internet |
| NAT Gateway | Private subnets outbound internet without inbound |
| Security Group / NACL | Firewall rules at instance and subnet level |
| Peering / Transit Gateway | Connect VPCs or on-premises via VPN/Direct Connect |
Public vs private subnets
- Public — resources with public IPs (load balancers, bastion hosts)
- Private — app servers and databases with no direct internet ingress
Multi-account patterns
Enterprises often use one VPC per environment (dev/staging/prod) or per team, connected via hub-and-spoke networking and centralized egress.
VPC in SaaS
Vendor single-tenant offerings sometimes deploy into a VPC dedicated to one customer or peer with the customer’s VPC for private integration.
Avoiding overlap
When peering VPCs or connecting to on-prem, non-overlapping CIDR ranges (e.g., 10.0.0.0/16 vs 10.1.0.0/16) prevent routing conflicts.
Cost reality
The VPC is free; the traffic isn’t. NAT gateway data processing is the notorious line item — private subnets pulling container images or S3 data through NAT can cost thousands monthly, fixed by VPC endpoints. Cross-AZ traffic between chatty services is the other silent charge; co-locate chatty pairs or accept the tax knowingly.
What people get wrong
- 10.0.0.0/16 everywhere. Overlapping CIDRs make future VPC peering and VPN connections painful-to-impossible; plan address space like it’s forever, because it is.
- Public subnets by default. Databases with public IPs remain a leading breach cause; default private, expose only load balancers.
- Security groups nobody can explain. Rules accrete; “why is 0.0.0.0/0:22 open” should have an answer and an owner. Review quarterly.
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.