Learn Amazon Virtual Private Cloud and understand VPCs, subnets, route tables, internet gateways, NAT gateways, security groups, network ACLs, and AWS cloud networking.
VPC Learning Path
Understand Virtual Private Clouds
Learn Subnets and CIDR
Configure Route Tables
Work with Gateways
Apply Network Security
Introduction
Amazon Virtual Private Cloud, commonly called Amazon VPC, allows you to create and configure a logically isolated virtual network within AWS.
A VPC provides control over networking components such as IP address ranges, subnets, route tables, gateways, and network security.
AWS resources such as EC2 instances, load balancers, databases, and other services can be deployed within networking architectures that use VPC components.
Core Concepts
Understanding VPCs, subnets, routing, and security controls is essential for building AWS cloud infrastructure.
Amazon VPC provides a logically isolated virtual network where you can define networking resources and control how AWS resources communicate.
Key Topics
A subnet is a range of IP addresses within a VPC. Subnets are associated with a single Availability Zone and can be configured for different workload requirements.
Key Topics
Route tables contain routing rules that determine where network traffic from a subnet or gateway should be directed.
Key Topics
AWS VPC networking can use security groups and network ACLs to control traffic between resources and networks.
Key Topics
VPC Architecture
A VPC can contain multiple subnets across Availability Zones. Public-facing resources and private workloads can be separated using subnet design, routing, and appropriate security controls.
Route tables determine traffic paths, while gateways can provide connectivity between the VPC and external networks or AWS networking services.
Simplified VPC Architecture
Internet
│
▼
┌─────────────────────────────┐
│ Internet Gateway │
└─────────────────────────────┘
│
▼
┌──────────────────────────────────────┐
│ VPC │
│ 10.0.0.0/16 │
│ │
│ ┌──────────────────────────────┐ │
│ │ Public Subnet │ │
│ │ 10.0.1.0/24 │ │
│ │ │ │
│ │ Load Balancer / Public App │ │
│ └──────────────────────────────┘ │
│ │
│ ┌──────────────────────────────┐ │
│ │ Private Subnet │ │
│ │ 10.0.2.0/24 │ │
│ │ │ │
│ │ EC2 / Application / Database │ │
│ └──────────────────────────────┘ │
│ │
└──────────────────────────────────────┘VPC Configuration
The following steps provide a simplified workflow for understanding how common VPC networking components can be configured.
Create a VPC and define an IPv4 CIDR block that provides the address space for your cloud network.
Create subnets in one or more Availability Zones based on your application architecture and workload requirements.
Create or configure route tables to control how traffic moves between resources and external networks.
Attach and configure an internet gateway when resources require direct connectivity to the internet.
Use appropriate routing and network services when private resources require controlled outbound connectivity.
Configure security groups and network ACLs according to the access requirements of your workloads.
Networking Components
AWS VPC includes networking components that can be combined to build different connectivity and security architectures.
An internet gateway enables communication between a VPC and the internet when appropriate routes and addressing are configured.
A NAT gateway can provide outbound connectivity for resources in private subnets without requiring those resources to accept unsolicited inbound connections from the internet.
Security groups act as virtual firewalls that control allowed inbound and outbound traffic for associated resources.
Network ACLs provide an additional network-level layer of traffic control for subnets.
Subnets and Routing
Subnets divide a VPC into smaller IP address ranges. Each subnet belongs to a single Availability Zone.
A route table contains rules that determine how traffic is directed. Different subnets can use different route tables based on their networking requirements.
A common architecture separates internet-facing workloads from private application and data workloads using subnet design and routing.
Example Network Design
Public Subnet
Can contain resources that require direct internet connectivity when routing and public addressing are configured.
Private Subnet
Can contain application servers, internal services, databases, and workloads that should not require direct internet access.
Security Best Practices
Network architecture and security controls should be designed according to the specific requirements of your application and infrastructure.
Place resources that do not require direct internet access in private subnets where appropriate.
Configure security group and network access rules to allow only the traffic required by your application.
Use subnets and network segmentation to separate workloads according to security and architecture requirements.
Avoid exposing administrative services unnecessarily and use controlled access methods for infrastructure management.
Regularly review security groups, network ACLs, routes, and other network configurations.
Distribute workloads across multiple Availability Zones when the application architecture requires high availability.
AWS CLI VPC Commands
# Create a VPC aws ec2 create-vpc \ --cidr-block 10.0.0.0/16 # Create a subnet aws ec2 create-subnet \ --vpc-id vpc-xxxxxxxx \ --cidr-block 10.0.1.0/24 \ --availability-zone us-east-1a # Describe VPCs aws ec2 describe-vpcs # Describe subnets aws ec2 describe-subnets # Describe route tables aws ec2 describe-route-tables
AWS CLI
The AWS Command Line Interface can be used to create and manage VPC networking resources through scripts, automation, and infrastructure workflows.
CLI commands can help you inspect VPCs, subnets, route tables, gateways, and other networking resources.
What You Will Learn
Understand how virtual networks provide connectivity and isolation for AWS resources.
Learn how subnets, CIDR ranges, route tables, and gateways work together.
Build a foundation in security groups, network ACLs, private networking, and controlled access.
Understand how AWS VPC components can be combined to build scalable and highly available cloud architectures.
Continue Learning
Learn the foundations of Amazon Web Services and understand core AWS cloud concepts.
🖥️Learn AWS virtual servers, compute infrastructure, networking, security, and instance fundamentals.
🔐Learn AWS identity, access management, users, roles, policies, permissions, and cloud security fundamentals.
Next Step
You now understand the fundamentals of Amazon VPC. Continue learning AWS services and explore how networking, compute, storage, security, and cloud architecture work together.