🌐 Amazon VPC Explained: Building a Secure Network in AWS
Introduction When I started learning AWS, I initially focused on services such as EC2 and S3. But after working with AWS infrastructure, I realized that launching a server is only one part of cloud computing. How does that server communicate with other resources, and how do we control its network access? This is where Amazon VPC (Virtual Private Cloud) comes in. In this article, I'll explain the fundamental components of Amazon VPC and how they work together to build a secure and organized network in AWS.
☁️ What is Amazon VPC?
Amazon Virtual Private Cloud (Amazon VPC) allows you to create a logically isolated virtual network within AWS.
Think of a VPC as your own private network in the AWS cloud.
Inside a VPC, you can control things such as:
- IP address ranges
- Subnets
- Routing
- Internet connectivity
- Network security
- Communication between resources
A simple architecture looks like this:
1
2
3
4
5
6
7
8
9
10
11
AWS Region
│
VPC
│
┌──────────┴──────────┐
│ │
Public Subnet Private Subnet
│ │
EC2 Server Application
│ │
Internet Gateway Database🏗️ Main Components of a VPC
A VPC is not just one service. Several networking components work together.
1. CIDR Block
When creating a VPC, we define an IP address range using CIDR notation.
For example:
1
10.0.0.0/16This defines the IP address range available inside the VPC.
We can then divide this larger network into smaller subnets.
For example:
1
2
3
4
5
6
7
VPC: 10.0.0.0/16
├── Public Subnet
│ 10.0.1.0/24
│
└── Private Subnet
10.0.2.0/24Understanding CIDR is important because subnet design depends on it.
2. Subnets
A subnet is a smaller network inside a VPC.
Subnets allow us to organize resources and control how they communicate.
There are generally two common types:
🌐 Public Subnet
A public subnet contains resources that need direct connectivity to the internet through an Internet Gateway.
Example:
1
2
3
4
5
6
7
Internet
↓
Internet Gateway
↓
Public Subnet
↓
EC2A web server or load balancer can be placed in a public subnet depending on the architecture.
🔒 Private Subnet
Private subnets are commonly used for resources that should not receive direct inbound internet traffic.
For example:
1
2
3
4
5
6
7
8
9
10
Public Subnet
│
↓
Application
│
↓
Private Subnet
│
↓
DatabaseThis architecture adds an additional security layer.
3. Internet Gateway
An Internet Gateway (IGW) provides a path for communication between a VPC and the internet.
For example:
1
2
3
4
5
6
7
EC2
↓
Route Table
↓
Internet Gateway
↓
InternetHowever, simply attaching an Internet Gateway to a VPC does not automatically make every subnet public.
The subnet also needs an appropriate route in its route table.
4. Route Tables
A route table determines where network traffic should go.
For example, a public subnet may have a route like:
1
2
3
4
Destination Target
10.0.0.0/16 local
0.0.0.0/0 Internet GatewayThe
0.0.0.0/0 route represents traffic destined for the internet.So the flow becomes:
1
2
3
4
5
6
7
8
9
EC2
↓
Route Table
↓
0.0.0.0/0
↓
Internet Gateway
↓
InternetThis is one of the key concepts that helped me understand why a subnet is considered public.
5. NAT Gateway
Now let's consider a private subnet.
Suppose an application running in a private subnet needs to download updates from the internet.
We don't necessarily want to give that resource direct inbound internet connectivity.
A NAT Gateway can allow resources in a private subnet to initiate outbound connections to the internet.
Example:
1
2
3
4
5
6
7
8
9
Private EC2
↓
Private Route Table
↓
NAT Gateway
↓
Internet Gateway
↓
InternetThe important idea is:
Private resources can access the internet for outbound communication without being directly reachable from the internet.
6. Security Groups
A Security Group acts as a virtual firewall for resources such as EC2 instances.
For example, we might allow:
1
2
3
SSH → Port 22
HTTP → Port 80
HTTPS → Port 443We should avoid opening unnecessary ports.
For example, instead of allowing SSH from anywhere:
1
0.0.0.0/0we should restrict access to trusted IP addresses whenever possible.
7. Network ACLs
A Network ACL (NACL) provides another layer of network traffic control at the subnet level.
One important difference is:
Security Group → Resource level
Network ACL → Subnet level
NACLs are stateless, meaning inbound and outbound traffic rules are evaluated separately.
Security Groups are stateful, meaning return traffic for an allowed connection is automatically allowed.
🔐 Putting Everything Together
A simple production-style architecture can look like this:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
Internet
│
↓
Internet Gateway
│
┌────────┴────────┐
│ │
Public Subnet Public Subnet
│ │
ALB NAT Gateway
│ │
└────────┬────────┘
↓
Private Subnet
│
Application
│
↓
Private Subnet
│
DatabaseEach component has a specific responsibility.
🧠 What I Learned
While learning VPC, one thing became clear:
Networking is the foundation of cloud infrastructure.
EC2, databases, load balancers, and other AWS services need networking to communicate securely.
The most important concepts I focused on were:
✅ VPC and CIDR blocks
✅ Public and private subnets
✅ Route tables
✅ Internet Gateway
✅ NAT Gateway
✅ Security Groups
✅ Network ACLs
✅ Public and private subnets
✅ Route tables
✅ Internet Gateway
✅ NAT Gateway
✅ Security Groups
✅ Network ACLs
Understanding how these components connect is much more useful than memorizing each service individually.
🚀 Beginner Tips for Learning VPC
If you're starting with AWS networking, don't try to learn everything at once.
I recommend this order:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
VPC
↓
CIDR
↓
Subnets
↓
Route Tables
↓
Internet Gateway
↓
Security Groups
↓
NAT Gateway
↓
Network ACLsAfter understanding these concepts, try building a small architecture yourself.
For example:
VPC → Public Subnet → EC2 → Private Subnet → Database
That's where the concepts really start making sense.
Conclusion
Amazon VPC is one of the most important AWS services to understand if you want to move beyond basic cloud usage and start working with real infrastructure.
It gives us control over network isolation, routing, connectivity, and security.
For me, learning VPC helped connect many AWS concepts that I had previously studied separately. Instead of seeing EC2, subnets, route tables, and gateways as individual topics, I started understanding how they work together as one network architecture.
Keep learning. Keep building. Keep experimenting. ☁️🚀
#AWS #AmazonVPC #CloudComputing #AWSNetworking #CloudSecurity #DevOps #AWSCloud #Networking #LearningAWS #CloudEngineer
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article