A VPC is an isolated network in one region

A VPC (Virtual Private Cloud) is a private IP network that belongs to one AWS account and lives in one region. Creating it gives you that network and nothing else: no path to the internet, no NAT, and no public addresses. Later lessons add those on purpose. This one is about the boundary itself, and why the default VPC is a poor place to learn it.

What you get when you create one

• A CIDR block: the range of private addresses the network is allowed to use, such as 10.0.0.0/16. Subnets are slices of this range. The next lesson splits it.
• An implicit router: traffic between addresses inside the CIDR can be delivered. You do not run that router yourself.
• A main route table: every subnet you have not pointed at another table uses this one. Route tables are their own lesson.
• A default network ACL and a default security group: the ACL allows all traffic; the default security group allows members to talk to each other. Firewalls come later. They are not what makes the VPC exist.
• DNS resolution inside the network, if you turn it on. The snippet below does.

EC2 instances, RDS, load balancers, Lambda network interfaces, and ECS tasks are launched into a subnet of this VPC. S3 and most AWS APIs are not inside it. Reaching them is a later choice: the public internet, or a VPC endpoint that stays on the Amazon network.

One region, one account

A VPC does not span regions. A network in eu-west-2 can only have subnets in the London availability zones. A copy of the same application in Ireland is a second VPC, with its own CIDR, route tables, and gateways. You connect regions later, if you need to. You do not stretch one VPC across them.

It also belongs to one account. Another account cannot place an instance in it unless you share a subnet (AWS Resource Access Manager) or connect the two networks. For this course, one account and one region is the whole boundary.

The default VPC is already finished

In each region, AWS may already have created a default VPC: 172.31.0.0/16, one public subnet per availability zone, an internet gateway, and a route that sends unknown traffic to that gateway. Launching an instance there often “just works,” because the path to the internet was built before you arrived.

That is why it is a bad classroom. The pieces you need to understand are already wired, and the layout is not one you chose. A VPC you create starts empty of that path. Instances receive private addresses and can reach each other. They cannot open a connection to the internet until you add a gateway and a route.

Names inside the network

Two flags on the VPC turn on Amazon’s DNS for the addresses you launch:

• DNS support answers queries at the VPC resolver (the .2 address of each subnet).
• DNS hostnames assigns a DNS name to instances that have a public IP, and a private name you can use from inside the VPC.

Hostnames require support. Leave both on. RDS, load balancers, and private links depend on that resolver. Turning them off does not make the network safer. It makes names stop working.

resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = { Name = "main" }
}

That is the whole network. There is no internet gateway in this file, and there should not be yet.

When the default VPC is the wrong default

• You cannot explain the path. If an instance can reach the internet and you do not know which route does it, you are in the default VPC or a copy of it.
• The CIDR collides with somewhere you will connect. 172.31.0.0/16 is common. A later VPN or peering link to another network with the same range will not route cleanly.
• Every subnet already has a public route. A database launched into “whatever subnet was first” is on a network that was built to be reachable from the internet. The security group may still block it. The route does not.

Start here: one VPC you created, in one region, with a CIDR you chose. Add the internet only in a later lesson, on the subnets that need it.