Amazon VPC
Amazon Virtual Private Cloud
Overview
Amazon VPC lets you build a logically isolated, customizable virtual network within your AWS account. Define your IP address range (CIDR block), divide it into subnets, and design routing, gateways, and firewalls yourself — like extending an on-premises network to the cloud. Fine-grained control over which resources are internet-facing and which stay internal. EC2, RDS, and most services run inside a VPC, making network design the foundation of security architecture.
Key Concepts
Subnets and Availability Zones
A VPC's CIDR is divided into subnets, each residing in a single AZ. Subnets with a route to an Internet Gateway are public; those without are private. Placing the same role in subnets across multiple AZs is the standard pattern for high availability.
Route Tables and Gateways
Each subnet is associated with a route table that maps destinations to next hops. A route to an Internet Gateway (0.0.0.0/0 → IGW) makes a subnet public. For private subnet resources to reach the internet outbound, route through a NAT Gateway (outbound only, no inbound).
VPC Endpoints
VPC endpoints allow private connectivity to AWS services without the internet. Gateway endpoints (S3, DynamoDB) add a route to the route table at no extra charge. Interface endpoints (PrivateLink) create an ENI in your VPC for most other services. Keeps traffic on the AWS network and eliminates NAT data processing costs.
Security Groups vs Network ACLs
Security groups operate at the instance (ENI) level, are stateful (return traffic auto-allowed), and contain allow rules only. Network ACLs operate at the subnet level, are stateless (return traffic needs explicit allow), and support both allow and deny rules in numbered order. Use both layers together for defense in depth.
On-Premises Connectivity and Peering
Site-to-Site VPN provides encrypted tunnels over the internet — quick to set up. Direct Connect provides a dedicated physical connection for stable bandwidth and low latency. VPC Peering connects two VPCs directly (1:1). Transit Gateway acts as a hub for many VPCs and on-premises networks.
Typical Use Cases
- Build a multi-tier architecture with a web tier in public subnets and a DB tier in private subnets
- Route private subnet servers through NAT Gateway for safe internet access (software updates)
- Use VPC endpoints to access S3 privately, reducing cost and attack surface
- Establish hybrid connectivity with on-premises via Direct Connect or Site-to-Site VPN
- Centralize multi-VPC and multi-account network routing with Transit Gateway
Exam Relevance
VPC is central to SAA, SAP, SOA, and security-focused exams. SAA classics: 'private subnet needs outbound internet → NAT Gateway,' 'S3 without internet → Gateway VPC endpoint.' Security group vs. NACL differences (stateful/stateless, allow-only/deny-capable, ENI/subnet scope) are high-frequency comparison questions. SAP dives into Transit Gateway large-scale connectivity, Direct Connect + VPN redundancy, CIDR design, and hybrid DNS. The skill of reading requirements ('private or public?' 'inbound needed?' 'multi-AZ?') directly determines your score.
Related Services
References
Last updated: 2026-06-24
This page is created from AWS official documentation and reviewed/edited by the operator. See our editorial & quality policy for details.