VPC - Virtual Private Cloud
GCP VPC is a global resource spanning all regions. Subnets are regional, and VMs in different regions can communicate over the same VPC without peering.
What is a Google Cloud VPC (Virtual Private Cloud)?
GCP VPC (Virtual Private Cloud) is your isolated virtual network. The key difference from AWS VPC: GCP VPCs are global - a single VPC spans all regions. Subnets are regional, but a VM in us-central1 and a VM in europe-west1 can be in the same VPC and communicate privately without VPC peering.
Core Components
Subnets
Regional resources with a primary CIDR range. Each VM gets an IP from its subnet. You can also add secondary ranges to a subnet for GKE pod and service IP allocation.
Subnet modes:
- Auto mode: Google automatically creates one subnet per region (10.128.0.0/9 range, pre-allocated per region)
- Custom mode: you define all subnets manually. Always use custom mode for production - auto mode can conflict with on-premises ranges.
Routes
GCP has implicit routes:
0.0.0.0/0 -> default-internet-gatewayfor default VPC (remove for private subnets)- Subnet routes created automatically for each subnet
- Custom static or dynamic routes via Cloud Router
Firewall Rules
GCP firewall rules are VPC-wide, not subnet-bound. Rules apply to instances by network tags or service accounts - more flexible than AWS security groups.
Allow rule: target=tag:web-server, source=tag:load-balancer, port=8080
Firewall rules are stateful (responses automatically allowed). Priority 0-65535 (lower = higher priority).
Internet Access
- Public IP on the instance -> direct internet access
- Cloud NAT: managed NAT gateway for instances without public IPs. Regional, highly available, no single VM to manage.
Shared VPC
In GCP organisations with multiple projects, Shared VPC allows a host project to own the VPC and service projects to use its subnets. All networking is centralised in the host project; application teams work in service projects with no VPC management.
Equivalent to AWS RAM (Resource Access Manager) for VPC subnet sharing.
VPC Peering
Connect two VPCs (same or different organisation) using private IPs. Non-transitive - like AWS VPC peering. For hub-and-spoke, use Network Connectivity Center (equivalent to AWS Transit Gateway).
Private Google Access
Enable on a subnet so instances without public IPs can reach Google APIs (Cloud Storage, BigQuery, etc.) over Google's private network without internet traversal. The equivalent of AWS Gateway VPC Endpoints for S3/DynamoDB.
VPC Flow Logs
Enable per-subnet to capture metadata about network flows (source/dest IP, port, bytes). Sent to Cloud Logging or BigQuery. Essential for security auditing and network performance analysis.
GCP VPC vs AWS VPC
| GCP VPC | AWS VPC | |
|---|---|---|
| Scope | Global (one VPC, all regions) | Regional (per-region VPC) |
| Cross-region | Same VPC, no peering needed | Requires TGW or peering |
| Firewall | Tag/service-account based, VPC-wide | Security groups (per-instance) + NACLs (per-subnet) |
| NAT | Cloud NAT (managed) | NAT Gateway (managed, per-AZ) |
| DNS | Cloud DNS | Route 53 private hosted zone |
Interview Angle
The GCP VPC global nature is a key differentiator - one VPC for a multi-region deployment simplifies architecture versus AWS where you need TGW to connect regional VPCs. For production: custom mode VPC, subnets per region/environment, Cloud NAT for private instances, Shared VPC for multi-project organisations, firewall rules using tags (not IPs - IPs change, tags don't).