VPC: Your Private Network in the Cloud

Prerequisites​

Before diving into VPC, it's helpful to understand the basics of IP Addresses, Subnets, and CIDR notation. You can learn more about these concepts in our Computer Networks section.

Key Terminologies​

VPC​

A Virtual Private Cloud (VPC) is essentially your own private network hosted within AWS. Think of it as a private space where you can place your resources (like EC2 instances) in a secure and isolated environment. This setup ensures that only authorized users and services have access to your network.

Subnet​

A subnet is a smaller network segment within a VPC. You can think of it as a separate room within your private office:

• Public Subnet: Devices in this subnet can access the internet and are accessible from the internet.

• Private Subnet: Devices here can only communicate within the VPC, providing an extra layer of security.

Gateway​

A gateway connects different networks, enabling communication between them. For example, it can connect the private network of a company to the internet or another private network.

Internet Gateway​

An Internet Gateway is a special type of gateway that connects a VPC to the internet, allowing public access to resources (like web servers) in your VPC.

NAT Gateway​

A NAT (Network Address Translation) Gateway enables devices in a private subnet to access the internet while preventing direct inbound connections from the internet. It acts as a one-way gate for outbound traffic.

Use Case Examples​

1. Exposing Your Application to the World​

Suppose you want to host a web application on an AWS EC2 instance and need it to be accessible over the internet. Here’s how you can set up your VPC:

1. Create a VPC: Start by creating a VPC using a CIDR block (e.g., 10.0.0.0/16), which can support up to 65,534 devices.

2. Create a Public Subnet: This subnet will be used to allow internet access.

3. Add an Internet Gateway: Attach an Internet Gateway to your VPC to enable internet communication.

4. Set Up Routing: Configure a route table to direct traffic through the Internet Gateway to the internet.

Public Route Table

This setup ensures that if the destination IP is within the VPC (10.0.0.0/16), the traffic stays internal. Otherwise, it is routed to the internet through the Internet Gateway.

To further secure your application, you can apply security groups to the EC2 instance to only allow specific traffic types, such as HTTP and HTTPS.

2. Updating Packages on a Private Database Server​

If you have a private database server that needs to access the internet (e.g., for software updates) but should not be directly accessible from the internet, you can use a NAT Gateway. This setup allows outbound internet access while blocking inbound traffic.

1. Create a NAT Gateway: From the AWS VPC dashboard, create a NAT Gateway.

2. Create a Private Route Table: Configure a route table to direct traffic from the private subnet through the NAT Gateway.

   Private Route Table

   Destination	Target
   10.0.0.0/16	local
   0.0.0.0/0	nat-gtw-id

3. Associate the Route Table with the Private Subnet: Make sure the private route table is associated with the private subnet to ensure proper traffic flow.