Amazon VPC: Your Private Cloud Network

Learning outcomes

By the end of this lesson, you will be able to:

1. Explain what an Amazon VPC is and why it exists.
2. Distinguish between public and private subnets.
3. Describe the role of an Internet Gateway (IGW) and a NAT Gateway.
4. Explain how route tables direct traffic within a VPC.
5. Sketch the standard two-tier VPC architecture used in most AWS deployments.

---

What is a VPC?

A Virtual Private Cloud (VPC) is a logically isolated section of the AWS cloud where you launch resources in a virtual network you define. Think of it as your own private data center inside AWS — except you don't manage any physical hardware.

Every AWS account comes with a default VPC in each Region, pre-configured so you can launch resources immediately. But in production, teams create custom VPCs with intentional network designs.

---

CIDR blocks — your IP address range

When you create a VPC, you assign it a CIDR block — a range of private IP addresses. For example, 10.0.0.0/16 gives you 65,536 IP addresses.

You don't need to calculate CIDR math for the CCP exam. Just know:

• A larger prefix (like /16) means more IP addresses.
• A smaller prefix (like /24) means fewer IP addresses (256).
• The VPC's CIDR block is the pool from which all subnets draw their IPs.

---

Subnets: public vs private

A subnet is a subdivision of your VPC's IP range, placed in a single Availability Zone. Subnets come in two flavors:

Public subnets

A subnet is "public" when its route table has a route sending 0.0.0.0/0 (all internet-bound traffic) to an Internet Gateway. Resources here can have public IP addresses and communicate directly with the internet.

Use for: Web servers, load balancers, bastion hosts.

Private subnets

A subnet is "private" when it has no direct route to an Internet Gateway. Resources here cannot be reached from the internet.

Use for: Databases, application servers, internal microservices.

---

Internet Gateway (IGW)

An Internet Gateway is a horizontally scaled, redundant VPC component that allows communication between your VPC and the internet.

• Attach one IGW per VPC.
• Add a route in the subnet's route table: 0.0.0.0/0 → igw-xxxxxxxx.
• Resources in that subnet need a public IP (or Elastic IP) to send and receive internet traffic.

Without an IGW, nothing in your VPC can reach the internet — and nothing on the internet can reach your VPC.

---

NAT Gateway

A NAT Gateway (Network Address Translation) lets resources in a private subnet access the internet for outbound requests — like downloading software updates or calling external APIs — without allowing inbound connections from the internet.

Key points:

• Lives in a public subnet (it needs internet access itself).
• Private subnet route table points 0.0.0.0/0 → nat-xxxxxxxx.
• Traffic flows: Private instance → NAT Gateway → IGW → Internet.
• One-way only: the internet cannot initiate connections back to private instances through the NAT Gateway.

---

Route tables

A route table is a set of rules (routes) that determine where network traffic is directed. Every subnet must be associated with exactly one route table.

---

Putting it all together

Here's the standard two-tier VPC architecture you'll see everywhere in AWS:

┌─────────────────────────────────────────────────┐
│  VPC (10.0.0.0/16)                              │
│                                                 │
│  ┌─────────────────┐   ┌─────────────────┐      │
│  │  Public Subnet   │   │  Public Subnet   │     │
│  │  (AZ-a)          │   │  (AZ-b)          │     │
│  │  Web Server      │   │  Web Server      │     │
│  │  NAT Gateway     │   │                  │     │
│  └────────┬─────────┘   └────────┬─────────┘     │
│           │                      │               │
│           ▼                      ▼               │
│  ┌─────────────────┐   ┌─────────────────┐      │
│  │  Private Subnet  │   │  Private Subnet  │     │
│  │  (AZ-a)          │   │  (AZ-b)          │     │
│  │  Database        │   │  Database        │     │
│  └──────────────────┘   └──────────────────┘     │
│                                                 │
│           ▲                                     │
│           │                                     │
│     Internet Gateway                            │
└─────────────────────────────────────────────────┘
            ▲
            │
        Internet

• Web servers sit in public subnets with routes to the IGW.
• Databases sit in private subnets with routes to a NAT Gateway (for outbound only).
• Traffic between public and private subnets flows via the local route.

---

VPC Endpoints and PrivateLink

AWS PrivateLink provides private connectivity to AWS services and partner services without traversing the public internet. Traffic stays entirely within the AWS network.

VPC Endpoint Types:

When to use PrivateLink:

• Compliance requirements prohibit public internet traversal
• Accessing third-party SaaS through AWS Marketplace privately
• Connecting VPCs across different accounts without peering
• Hybrid scenarios requiring private access from on-premises via Direct Connect

---

Summary

---

Knowledge Check

Next lesson

Lesson 2: Security Groups vs NACLs