VPC - Virtual Private Cloud

What is an AWS VPC (Virtual Private Cloud)?

A VPC (Virtual Private Cloud) is an isolated virtual network within AWS. Every resource you create (EC2, RDS, Lambda in a VPC, etc.) lives inside a VPC. You control the IP address range, subnets, routing, and network access.

Each AWS account gets a default VPC per region with pre-configured public subnets. For production workloads, create a custom VPC.

Core Components

CIDR Block

The IP address range for your VPC - e.g., 10.0.0.0/16 gives 65,536 addresses. Cannot be changed after creation (but you can add secondary CIDRs).

Subnets

Subdivisions of your VPC CIDR, each tied to one AZ. Example for a 3-AZ region:

VPC: 10.0.0.0/16
  Public subnets:  10.0.1.0/24 (us-east-1a), 10.0.2.0/24 (us-east-1b), 10.0.3.0/24 (us-east-1c)
  Private subnets: 10.0.11.0/24, 10.0.12.0/24, 10.0.13.0/24
  DB subnets:      10.0.21.0/24, 10.0.22.0/24, 10.0.23.0/24

A subnet is public if it has a route to an Internet Gateway. Private subnets have no direct internet route - outbound traffic uses a NAT Gateway.

Internet Gateway (IGW)

Attaches to the VPC to allow inbound/outbound internet traffic for public subnet resources. One IGW per VPC.

NAT Gateway

Deployed in a public subnet. Allows instances in private subnets to initiate outbound internet connections (for package downloads, API calls) without being reachable from the internet. Managed service, AZ-scoped - deploy one per AZ for HA.

Route Tables

Each subnet is associated with a route table. Routes direct traffic:

• 0.0.0.0/0 -> igw-xxx (public subnets - route all internet traffic to IGW)
• 0.0.0.0/0 -> nat-xxx (private subnets - route internet traffic through NAT)
• 10.0.0.0/16 -> local (VPC-internal traffic, always present)

Security Groups

Stateful instance-level firewall. Only allow rules (no deny). Tracks connections - if inbound is allowed, response traffic is automatically allowed.

Network ACLs (NACLs)

Stateless subnet-level firewall. Supports both allow and deny rules, evaluated in order. Both inbound and outbound rules required (no connection tracking). Useful for blocking specific IPs at the subnet level.

VPC Peering

Connects two VPCs (same or different account/region) to route traffic using private IPs. Not transitive - if A peers with B and B peers with C, A cannot reach C through B.

Transit Gateway

A managed hub that connects many VPCs and on-premises networks. Supports transitive routing - replaces a mesh of VPC peerings. Essential for large multi-VPC architectures.

VPC Endpoints

Allow private connectivity to AWS services (S3, DynamoDB, etc.) without leaving the AWS network:

• Gateway endpoint: free, route-table based. Supports S3 and DynamoDB.
• Interface endpoint (PrivateLink): ENI in your subnet with private IP. Supports most AWS services. Hourly cost.

Use VPC endpoints so EC2 -> S3 traffic never traverses the internet.

Flow Logs

Capture IP traffic metadata (source/dest IP, port, protocol, accept/reject) for VPC, subnet, or ENI. Published to CloudWatch Logs or S3. Essential for security auditing and network debugging.

Interview Angle

For any system design on AWS, define the network first: VPC with public subnets (load balancers), private subnets (application servers), and isolated DB subnets (RDS). Internet-facing resources in public subnets with an IGW. Application and DB tiers in private subnets, NAT Gateway for outbound-only internet access. Security groups per tier (ALB SG -> EC2 SG -> RDS SG - each allowing only from the previous). VPC endpoints for S3/DynamoDB to keep traffic within AWS.