VPC
Virtual Private Cloud: a logically isolated section of the cloud where you launch resources in a virtual network you define. Controls IP ranges, subnets, route tables, and gateways.
What is VPC?
In short
A Virtual Private Cloud (VPC) is a logically isolated network you define inside a public cloud, where you control the private IP address range, subnets, routing, and which traffic is allowed in and out. It lets you run cloud resources as if they were on your own private network, even though they sit on shared physical hardware.
What a VPC actually is
When you sign up for a cloud provider like AWS, Google Cloud, or Azure, your servers are running on machines shared with thousands of other customers. A VPC is the boundary that makes that shared hardware behave like a private network that belongs only to you. You pick a private IP range, usually something from RFC 1918 like 10.0.0.0/16, and every resource you launch gets an address inside that range.
Inside the VPC you carve the address space into subnets. A public subnet has a route to the internet through an internet gateway; a private subnet does not, so the database servers you put there cannot be reached directly from outside. Route tables decide where traffic goes, and security groups and network ACLs decide what is allowed. Nothing from another customer's account can reach your VPC unless you explicitly connect the two.
The isolation is enforced by the cloud's software-defined networking layer, not by physical cables. Two VPCs can both use 10.0.0.0/16 with zero conflict because the provider tags every packet with the VPC it belongs to and refuses to route between them by default.
How it works under the hood
A VPC is a virtual overlay network. Each VM or container gets a virtual network interface with a private IP. When a packet leaves that interface, the hypervisor wraps it in an encapsulation header (AWS uses a system built on technology similar to VXLAN) that records the source VPC, then sends it across the provider's physical backbone. At the destination host, the wrapper is stripped and the packet is delivered. Other tenants never see it because their hosts reject packets that are not tagged for their VPC.
Subnets in most clouds live in a single availability zone, so you spread subnets across zones for fault tolerance. Route tables are evaluated longest-prefix first: a more specific route like 10.0.5.0/24 wins over the default 0.0.0.0/0. A private subnet that needs outbound internet (to pull software updates, say) routes through a NAT gateway, which gives it a public IP for outgoing connections without allowing anything inbound.
Connecting VPCs is done with peering (a direct one-to-one link), a transit gateway (a hub that connects many VPCs and on-premises networks), or PrivateLink-style endpoints that expose a single service privately. None of these share routing tables automatically, which keeps the blast radius small if one network is misconfigured.
When to use one and the trade-offs
You get a default VPC the moment you create a cloud account, so the real question is how much you customize. For a hobby project a single public subnet is fine. For anything handling real user data or money, you separate tiers: load balancers in public subnets, application servers and databases in private subnets with no internet route, and tightly scoped security groups between them. This is how you keep a database off the public internet, which removes an entire class of attacks.
The cost is complexity. CIDR ranges are hard to change after the fact, so picking 10.0.0.0/16 versus 10.0.0.0/24 up front matters; too small and you run out of IPs, too overlapping and you cannot peer with another network later. NAT gateways are not free either, often costing a few cents per gigabyte processed plus an hourly charge, which surprises teams that route all private traffic through one.
The main trade-off is isolation versus reachability. The more locked down the VPC, the more deliberate plumbing (peering, endpoints, bastion hosts, VPNs) you need to let legitimate traffic through. Most outages in cloud networking come from a missing route or an over-tight security group, not from the VPC concept itself.
A concrete example
Picture a typical three-tier web app on AWS. You create a VPC with CIDR 10.0.0.0/16 spanning two availability zones. In each zone you make a public subnet (10.0.1.0/24, 10.0.2.0/24) holding an Application Load Balancer, and a private subnet (10.0.10.0/24, 10.0.20.0/24) holding the EC2 instances running your app, plus a database subnet for RDS.
Traffic flows like this: a user hits the load balancer over HTTPS, the load balancer forwards to an app instance in a private subnet, and the app talks to RDS over port 5432. The database security group only accepts connections from the app security group, so even another machine inside the same VPC cannot reach the database unless it is part of that app tier.
When the app needs to download a package, it routes out through a NAT gateway in the public subnet, which lets it reach the internet for outbound calls while staying unreachable from inbound traffic. The database has no internet route at all. That layered design is the standard pattern, and the VPC is what makes the layers enforceable rather than just a diagram.
Where it is used in production
Amazon Web Services
Amazon VPC is the foundational network layer; every EC2, RDS, and EKS resource launches inside one, with subnets, route tables, and security groups.
Google Cloud
GCP VPCs are global rather than zonal, so a single VPC can span subnets in multiple regions without peering.
Microsoft Azure
Azure calls the same concept a Virtual Network (VNet), with subnets and Network Security Groups controlling traffic between tiers.
Kubernetes on cloud
Managed clusters like EKS and GKE place worker nodes and pods inside a VPC, using private subnets to keep nodes off the public internet.
Frequently asked questions
- What is the difference between a VPC and a subnet?
- A VPC is the whole isolated network with one CIDR block, like 10.0.0.0/16. A subnet is a slice of that range, like 10.0.1.0/24, that lives in a single availability zone. You make subnets public or private to separate things like load balancers from databases.
- Is a VPC actually isolated from other customers?
- Yes. The cloud's software-defined networking tags every packet with its VPC, and hosts reject traffic not meant for them. Two different customers can use the exact same private IP range with no conflict because routing between VPCs is blocked by default.
- What is the difference between a public and a private subnet?
- A public subnet has a route to an internet gateway, so resources there can be reached from and reach the internet. A private subnet has no such route, so it stays unreachable from outside. Private subnets reach the internet outbound only through a NAT gateway.
- How do I connect two VPCs?
- Use VPC peering for a simple one-to-one link, a transit gateway when you need a hub connecting many VPCs and on-premises networks, or a PrivateLink endpoint to expose a single service. Their CIDR ranges must not overlap for peering to work.
- Why do NAT gateways cost money if traffic is just outbound?
- A NAT gateway is a managed service that holds public IPs and tracks connection state for everything in your private subnets. Providers charge an hourly fee plus a per-gigabyte data processing rate, which adds up when all private traffic funnels through one.
Learn VPC hands-on
This page explains the idea. The full lesson lets you step through the ring as servers join and leave, read the implementation, and check yourself with a quiz. It is one of 760+ lessons in the System Design Masterclass, from your first API call to distributed consensus. Eleven Foundation lessons are free, no signup. Lifetime access is ₹499 in India or $7.99 worldwide, one payment, no subscription.
Related lessons
Lessons that touch on VPC as part of a larger topic.
VPC Peering
Connecting two VPCs so their resources can communicate using private IP addresses
intermediate · cloud infrastructure
Subnets
Dividing a network into isolated segments for security, organization, and efficiency
intermediate · cloud infrastructure
Internet Gateway
The door between your private cloud network and the public internet
intermediate · cloud infrastructure
Site-to-Site VPN
Permanently connecting your office network to your cloud VPC over encrypted tunnels
intermediate · cloud infrastructure
Transit Gateway
A central hub that connects hundreds of VPCs and on-premises networks without N-squared peering
intermediate · cloud infrastructure
See also
Related glossary terms you might want to look up next.
Cloud Region
A geographic area containing one or more data centers (availability zones). Choosing the right region reduces latency and satisfies data residency requirements.
Zero Trust
A security model that never trusts any request by default, even from inside the network. Every request must be authenticated, authorized, and encrypted regardless of origin.
Availability Zone
An isolated data center within a cloud region, with independent power, cooling, and networking. Deploying across multiple AZs protects against single-facility failures.
Virtual Machine
A software emulation of a physical computer running its own OS on shared hardware. Heavier than containers but provides stronger isolation.
Hypervisor
Software that creates and manages virtual machines by abstracting physical hardware. Type 1 (bare-metal) runs directly on hardware; Type 2 runs on an OS.
Auto Scaling
Automatically adding or removing compute instances based on current demand. Scales out during traffic spikes and scales in during quiet periods to save cost.