Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

title: “VPC Fundamentals” created: 2026-07-22 updated: 2026-07-22 type: knowledge tags:

  • aws
  • certification
  • networking
  • vpc

VPC Fundamentals

What It Is

An Amazon Virtual Private Cloud (VPC) is a logically isolated virtual network within the AWS cloud. It gives you complete control over your networking environment: IP address ranges, subnets, route tables, and network gateways.

Why It Matters

Every AWS resource that needs network connectivity (EC2, RDS, Lambda in VPC mode, ECS, etc.) lives inside a VPC. Understanding VPC architecture is foundational to AWS certification and to designing secure, scalable infrastructure.

Key Concepts

VPC Characteristics

  • Spans a single Region but can cover multiple Availability Zones
  • Defined by a CIDR block (e.g., 10.0.0.0/16) — the overall IP address range
  • Provides logical isolation from other VPCs and the public Internet
  • Supports both IPv4 and IPv6

Core Components

ComponentRole
SubnetsSubdivisions of the VPC IP range, each in one AZ
Route TablesDetermine where network traffic is directed
Internet GatewayConnects the VPC to the Internet
NAT GatewayAllows private subnets outbound Internet access
Network ACLsStateless firewall at the subnet level
Security GroupsStateful firewall at the instance level

VPC Wizard

The VPC and more wizard automates creation of:

  • The VPC itself
  • Public and private subnets
  • Route tables with appropriate routes
  • An Internet Gateway (attached)
  • A NAT Gateway (in the public subnet)

Default VPC

  • AWS automatically creates a default VPC in each Region
  • CIDR: 172.31.0.0/16
  • Comes with a public subnet in each AZ, an Internet Gateway, and a default route table
  • Instances launched in the default VPC get a public IP by default

Allowed CIDR Ranges

  • Minimum: /28 (16 IP addresses)
  • Maximum: /16 (65,536 IP addresses)
  • Secondary CIDR blocks can be added after creation
  • Primary CIDR block cannot be changed after creation

Gotchas

  • A VPC is Region-scoped, not AZ-scoped
  • You can have multiple VPCs per Region (default limit: 5, soft limit)
  • VPC peering allows cross-VPC communication but CIDR blocks must not overlap
  • Resources in a VPC have no Internet access unless explicitly configured (IGW + route + public IP or NAT)

See Also

  • [[vpc-subnets]]
  • [[vpc-route-tables]]
  • [[vpc-internet-gateway]]
  • [[vpc-nat-gateway]]
  • [[vpc-network-acls]]
  • [[vpc-security-groups]]
  • [[cidr-notation]]