We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design and AI Engineering, by Roni Das. 984 interactive lessons.
Start LearningIntermediate · Cloud Infrastructure
Virtual Private Cloud: a logically isolated section of the cloud where you launch resources in a virtual network you define. Controls IP ranges, subnets, route tables, and gateways.
In short
A Virtual Private Cloud (VPC) is a logically isolated network you define inside a public cloud, where you control the private IP address range, subnets, routing, and which traffic is allowed in and out. It lets you run cloud resources as if they were on your own private network, even though they sit on shared physical hardware.
In short
A Virtual Private Cloud (VPC) is a logically isolated network you define inside a public cloud, where you control the private IP address range, subnets, routing, and which traffic is allowed in and out. It lets you run cloud resources as if they were on your own private network, even though they sit on shared physical hardware.
Learn it in the course
This page is the free part.
₹1,111 in India$25 everywhere elseonce, for the whole course
The System Design course covers VPC across a run of lessons, not one page. These 4 alone are about 80 minutes of step-by-step reading, every one with a quiz.
Virtual Private Cloud, your own isolated network in someone else's data center.
Connecting two VPCs so their resources can communicate using private IP addresses.
Dividing a network into isolated segments for security, organization, and efficiency.
The door between your private cloud network and the public internet.
all part of
System Design Masterclass
770 lessons · about 287 hours · 18 free to read
₹1,111in India, by UPI
$25everywhere else, by PayPal
It is really nice and good Please join the course
You own this course
Continue with VPCpay once,
yours for life
When you sign up for a cloud provider like AWS, Google Cloud, or Azure, your servers are running on machines shared with thousands of other customers. A VPC is the boundary that makes that shared hardware behave like a private network that belongs only to you. You pick a private IP range, usually something from RFC 1918 like 10.0.0.0/16, and every resource you launch gets an address inside that range.
Inside the VPC you carve the address space into subnets. A public subnet has a route to the internet through an internet gateway; a private subnet does not, so the database servers you put there cannot be reached directly from outside. Route tables decide where traffic goes, and security groups and network ACLs decide what is allowed. Nothing from another customer's account can reach your VPC unless you explicitly connect the two.
The isolation is enforced by the cloud's software-defined networking layer, not by physical cables. Two VPCs can both use 10.0.0.0/16 with zero conflict because the provider tags every packet with the VPC it belongs to and refuses to route between them by default.
A VPC is a virtual overlay network. Each VM or container gets a virtual network interface with a private IP. When a packet leaves that interface, the hypervisor wraps it in an encapsulation header (AWS uses a system built on technology similar to VXLAN) that records the source VPC, then sends it across the provider's physical backbone. At the destination host, the wrapper is stripped and the packet is delivered. Other tenants never see it because their hosts reject packets that are not tagged for their VPC.
In AWS each subnet lives in a single availability zone, so you spread subnets across zones for fault tolerance. In Google Cloud and Azure a subnet spans every zone in its region. Route tables are evaluated longest-prefix first: a more specific route like 10.0.5.0/24 wins over the default 0.0.0.0/0. A private subnet that needs outbound internet (to pull software updates, say) routes through a NAT gateway, which gives it a public IP for outgoing connections without allowing anything inbound.
Connecting VPCs is done with peering (a direct one-to-one link), a transit gateway (a hub that connects many VPCs and on-premises networks), or PrivateLink-style endpoints that expose a single service privately. None of these share routing tables automatically, which keeps the blast radius small if one network is misconfigured.
You get a default VPC the moment you create a cloud account, so the real question is how much you customize. For a hobby project a single public subnet is fine. For anything handling real user data or money, you separate tiers: load balancers in public subnets, application servers and databases in private subnets with no internet route, and tightly scoped security groups between them. This is how you keep a database off the public internet, which removes an entire class of attacks.
The cost is complexity. CIDR ranges are hard to change after the fact, so picking 10.0.0.0/16 versus 10.0.0.0/24 up front matters; too small and you run out of IPs, too overlapping and you cannot peer with another network later. NAT gateways are not free either, often costing a few cents per gigabyte processed plus an hourly charge, which surprises teams that route all private traffic through one.
The main trade-off is isolation versus reachability. The more locked down the VPC, the more deliberate plumbing (peering, endpoints, bastion hosts, VPNs) you need to let legitimate traffic through. Most outages in cloud networking come from a missing route or an over-tight security group, not from the VPC concept itself.
Picture a typical three-tier web app on AWS. You create a VPC with CIDR 10.0.0.0/16 spanning two availability zones. In each zone you make a public subnet (10.0.1.0/24, 10.0.2.0/24) holding an Application Load Balancer, and a private subnet (10.0.10.0/24, 10.0.20.0/24) holding the EC2 instances running your app, plus a database subnet for RDS.
Traffic flows like this: a user hits the load balancer over HTTPS, the load balancer forwards to an app instance in a private subnet, and the app talks to RDS over port 5432. The database security group only accepts connections from the app security group, so even another machine inside the same VPC cannot reach the database unless it is part of that app tier.
When the app needs to download a package, it routes out through a NAT gateway in the public subnet, which lets it reach the internet for outbound calls while staying unreachable from inbound traffic. The database has no internet route at all. That layered design is the standard pattern, and the VPC is what makes the layers enforceable rather than just a diagram.
Amazon Web Services
Amazon VPC is the foundational network layer; every EC2, RDS, and EKS resource launches inside one, with subnets, route tables, and security groups.
Google Cloud
GCP VPCs are global rather than zonal, so a single VPC can span subnets in multiple regions without peering.
Microsoft Azure
Azure calls the same concept a Virtual Network (VNet), with subnets and Network Security Groups controlling traffic between tiers.
Kubernetes on cloud
Managed clusters like EKS and GKE place worker nodes and pods inside a VPC, using private subnets to keep nodes off the public internet.
A VPC is the whole isolated network with one CIDR block, like 10.0.0.0/16. A subnet is a slice of that range, like 10.0.1.0/24, that lives in a single availability zone. You make subnets public or private to separate things like load balancers from databases.
Yes. The cloud's software-defined networking tags every packet with its VPC, and hosts reject traffic not meant for them. Two different customers can use the exact same private IP range with no conflict because routing between VPCs is blocked by default.
A public subnet has a route to an internet gateway, so resources there can be reached from and reach the internet. A private subnet has no such route, so it stays unreachable from outside. Private subnets reach the internet outbound only through a NAT gateway.
Use VPC peering for a simple one-to-one link, a transit gateway when you need a hub connecting many VPCs and on-premises networks, or a PrivateLink endpoint to expose a single service. Their CIDR ranges must not overlap for peering to work.
A NAT gateway is a managed service that holds public IPs and tracks connection state for everything in your private subnets. Providers charge an hourly fee plus a per-gigabyte data processing rate, which adds up when all private traffic funnels through one.
VPC Peering
Connecting two VPCs so their resources can communicate using private IP addresses
Subnets
Dividing a network into isolated segments for security, organization, and efficiency
Internet Gateway
The door between your private cloud network and the public internet
Site-to-Site VPN
Permanently connecting your office network to your cloud VPC over encrypted tunnels
Transit Gateway
A central hub that connects hundreds of VPCs and on-premises networks without N-squared peering
Cloud Region
A geographic area containing one or more data centers (availability zones). Choosing the right region reduces latency and satisfies data residency requirements.
Zero Trust
A security model that never trusts any request by default, even from inside the network. Every request must be authenticated, authorized, and encrypted regardless of origin.
Availability Zone
An isolated data center within a cloud region, with independent power, cooling, and networking. Deploying across multiple AZs protects against single-facility failures.
Virtual Machine
A software emulation of a physical computer running its own OS on shared hardware. Heavier than containers but provides stronger isolation.
Hypervisor
Software that creates and manages virtual machines by abstracting physical hardware. Type 1 (bare-metal) runs directly on hardware; Type 2 runs on an OS.
Auto Scaling
Automatically adding or removing compute instances based on current demand. Scales out during traffic spikes and scales in during quiet periods to save cost.
This page explains the idea. The "VPC" lesson builds it up step by step, with diagrams. It is part of the System Design Masterclass course, which has 770 lessons. 18 of them are free to read. You pay once and keep it for life, with no subscription.
Open the VPC lessoncourse 1
From absolute beginner to principal engineer, drawn step by step.
Asked about VPC in an interview?
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
