Amazon VPC Explained: Understanding AWS Networking

A beginner-friendly introduction to Amazon VPC, covering subnets, route tables, internet gateways, security groups, and how AWS resources communicate securely.

Aditya Bheke

Published Oct 9, 2026

Last modified Oct 9, 2026

Amazon VPC Explained: Understanding AWS Networking

Introduction

Networking is an important part of cloud computing. Applications need a way to communicate with users, databases, APIs, and other services while keeping resources secure.

Amazon VPC, or Amazon Virtual Private Cloud, allows you to create a logically isolated network within AWS.

What is Amazon VPC?

A VPC is a virtual network that you create in AWS.

Within a VPC, you can control how your AWS resources communicate with each other and with the internet.

For example:

1
2
3
4
5
6
7
Internet
   ↓
Internet Gateway
   ↓
VPC
   ↓
EC2 Instance

A VPC gives you control over important networking components such as IP addresses, subnets, routing, and security.

What is a Subnet?

A subnet is a smaller network inside a VPC.

Subnets are associated with a specific Availability Zone within an AWS Region.

A VPC can contain multiple subnets.

For example:

1
2
3
4
5
6
7
VPC
│
├── Public Subnet
│   └── Web Server
│
└── Private Subnet
    └── Database

This separation can help organize resources and improve security.

Public and Private Subnets

A public subnet is generally used for resources that need a route to the internet.

A private subnet is generally used for resources that should not be directly reachable from the public internet.

A common architecture is:

1
2
3
4
5
6
7
8
9
10
11
Internet
    ↓
Load Balancer
    ↓
Public Subnet
    ↓
Application
    ↓
Private Subnet
    ↓
Database

This architecture keeps databases and other sensitive resources away from direct internet access.

Internet Gateway

An Internet Gateway allows communication between resources in a VPC and the public internet when the appropriate routing and addressing configuration is in place.

For example:

1
2
3
4
5
6
7
EC2 Instance
     ↓
Route Table
     ↓
Internet Gateway
     ↓
Internet

An Internet Gateway is attached to a VPC.

Route Tables

A route table contains rules that determine where network traffic should go.

For example:

1
2
3
4
Destination       Target

10.0.0.0/16       Local
0.0.0.0/0         Internet Gateway

The local route allows communication within the VPC, while the default route can send internet-bound traffic toward an Internet Gateway.

Security Groups

Security groups act as virtual firewalls for resources such as EC2 instances.

They control which inbound and outbound traffic is allowed.

For example, a web server might allow:

1
2
3
HTTP   → Port 80
HTTPS  → Port 443
SSH    → Port 22

Only the necessary ports should be exposed.

Network ACLs

A Network Access Control List, or NACL, provides another layer of network traffic control.

Unlike security groups, NACLs operate at the subnet level.

A simplified structure is:

1
2
3
4
5
6
7
8
9
VPC
 ↓
Subnet
 ↓
Network ACL
 ↓
Resource
 ↓
Security Group

Security groups are stateful, while network ACLs are stateless.

IP Addresses in a VPC

Resources inside a VPC can use private IP addresses for communication.

For example:

1
2
3
4
5
6
7
8
Web Server
Private IP: 10.0.1.10

Application Server
Private IP: 10.0.2.10

Database
Private IP: 10.0.3.10

Private IP addresses allow resources to communicate within the VPC without exposing them directly to the public internet.

A Simple Web Application Architecture

Consider a three-tier application.

1
2
3
4
5
6
7
8
9
10
11
                Internet
                    ↓
             Load Balancer
                    ↓
             Public Subnet
                    ↓
            Application Servers
                    ↓
             Private Subnet
                    ↓
                Database

The load balancer receives requests from users.

Application servers process the requests.

The database stores application data.

Keeping the database in a private subnet reduces its exposure to the public internet.

Why VPC is Important

VPC provides control over:

Network architecture
IP addressing
Subnets
Routing
Internet connectivity
Network security

Understanding VPC is essential because many AWS services operate within or interact with VPC networking.

What I Learned

The most important concept I learned is that a VPC is the foundation for networking many AWS workloads.

Understanding VPCs, subnets, route tables, Internet Gateways, security groups, and NACLs makes it much easier to understand how cloud applications communicate.

Conclusion

Amazon VPC provides the networking foundation for many AWS applications.

Instead of placing every resource directly on the public internet, developers can design networks with public and private components and control how traffic flows between them.

For beginners, understanding the relationship between VPC → Subnet → Route Table → Security Group provides a strong foundation for learning AWS networking.

Builder Center

Amazon VPC Explained: Understanding AWS Networking

Aditya Bheke

Amazon VPC Explained: Understanding AWS Networking

Introduction

What is Amazon VPC?

What is a Subnet?

Public and Private Subnets

Internet Gateway

Route Tables

Security Groups

Network ACLs

IP Addresses in a VPC

A Simple Web Application Architecture

Why VPC is Important

What I Learned

Conclusion

Tags