VPC

When cloud computing first became mainstream, everyone shared the same network. Your EC2 instance sat on the same network fabric as a stranger's. You relied on security groups, firewalls, to keep traffic separated. It worked, but it felt like living in an apartment building where the only thing between you and your neighbor was a locked door.

Amazon launched VPC in 2009 and changed the model entirely. Instead of a shared network with firewalls, you get your own logically isolated network. Your own IP address range. Your own subnets. Your own route tables. Your own network gateways. It's like owning a private building with your own hallways, doors, and security system, inside Amazon's data center.

Today, VPC is not optional. Every EC2 instance, every RDS database, every Lambda function with VPC access, every EKS cluster, they all live inside a VPC. It's the foundation layer. Get the VPC design wrong, and everything built on top inherits the problem.

A VPC is a virtual network definition with several key components:

CIDR Block: The IP address range for your entire VPC (e.g., 10.0.0.0/16). Every resource inside the VPC gets an IP from this range.

Subnets: Subdivisions of the CIDR block, each tied to a specific Availability Zone. Public subnets for internet-facing resources, private subnets for internal workloads.

Route Tables: Rules that determine where network traffic is directed. Each subnet is associated with a route table.

Internet Gateway (IGW): Connects your VPC to the public internet. Attached to public subnets via route tables.

NAT Gateway: Lets private subnet resources reach the internet for outbound traffic without being exposed to inbound traffic.

Security Groups: Stateful firewalls at the instance level. Define allowed inbound and outbound traffic by port and protocol.

Network ACLs: Stateless firewalls at the subnet level. An additional layer of defense.