Amazon Virtual Private Cloud

A service for building your own private network inside AWS.

A service that creates logically isolated networks on AWS. Combines subnets, route tables, Internet Gateway, NAT Gateway, and more.

• Network isolation for web applications
• Splitting public and private subnets
• Placing RDS and EC2 in private networks

• Subnets are created per Availability Zone
• Control traffic with Security Groups and NACLs
• Internet Gateway provides internet connectivity

• Use subnets across multiple AZs for high availability
• Use NAT Gateway for outbound traffic from private subnets
• VPC endpoints optimize connectivity to AWS services

Amazon VPC is a service that creates a logically isolated network space (a virtual private cloud) within an AWS account. The address space is defined by a CIDR block (such as 10.0.0.0/16), within which multiple subnets (public subnets and private subnets) are partitioned and placed per availability zone. Routing between subnets is controlled by route tables, the exit to the internet is provided by an Internet Gateway, and outbound communication from private subnets is realized through a NAT Gateway. By combining these building blocks, a structure similar to on-premises network designs can be reproduced on AWS. Communication control is performed in two layers: Security Groups (instance-level, stateful, allow-only rules) and Network ACLs (subnet-level, stateless, supporting both allow and deny rules). Security Groups define, in an allow-list style, where traffic may enter and exit an instance, while Network ACLs handle coarser control at the subnet level. The two are used together, with a common configuration combining fine-grained control via Security Groups and broader blocking via Network ACLs. In practice, a typical design builds a three-tier web architecture on a VPC, placing the ALB in public subnets, EC2 or ECS in private subnets, and RDS in database subnets. To connect multiple VPCs, VPC Peering is used, while Transit Gateway aggregates multiple accounts and multiple VPCs, and VPC Endpoints (Gateway type or Interface type) provide private access to AWS services. Creation of the VPC itself, subnets, route tables, the Internet Gateway, Security Groups, and Network ACLs is free of charge, while charges accrue for NAT Gateways, VPC Endpoints, and data transfer. In CLF-C02, the division of roles among the basic VPC components (subnets, route tables, IGW, NAT, Security Groups, Network ACLs) is repeatedly asked.

• What is Amazon Virtual Private Cloud (AWS Official Documentation)
• Amazon Virtual Private Cloud (AWS Official)

Last updated: 2026-06-01