Micro Series: What is AWS VPC?

An AWS VPC (Virtual Private Cloud) is your logically isolated network within AWS. It defines the overall network environment in which your AWS resources, such as EC2 instances, ECS tasks, EKS nodes, and databases can communicate. When creating a VPC, you define an IP address range using CIDR notation, such as 10.0.0.0/16. You then divide this larger address space into smaller subnets. A VPC can span multiple Availability Zones (AZs) within an AWS Region, while each subnet belongs to one specific Availability Zone. This allows you to organize resources and design for availability and fault tolerance.

A key distinction is between public and private subnets. A subnet is considered public when its route table has a route to an Internet Gateway (IGW), allowing resources with appropriate public IP configuration to communicate directly with the internet. A private subnet does not have a direct route to an Internet Gateway; resources in it can still access the internet through a NAT Gateway when outbound internet access is required. Other important VPC concepts include route tables, which determine where network traffic goes; Security Groups, which act as stateful firewalls for resources such as EC2 instances; and Network ACLs (NACLs), which provide stateless traffic filtering at the subnet level.

The simplest mental model is: VPC = your overall network, subnet = a smaller network segment inside the VPC, Availability Zone = the physical AWS location where a subnet resides. Public and private subnets are then used to control how resources communicate with the internet. For example, a common architecture places a load balancer in public subnets, application servers such as EC2/ECS/EKS workloads in private subnets, and databases such as RDS in private subnets. Route tables, Internet/NAT Gateways, Security Groups, and NACLs then control how traffic moves between these components and outside the VPC.