Amazon VPC
Your own private slice of the AWS network, with walls you draw yourself.
Amazon VPC (Virtual Private Cloud) is the service that gives you an isolated network inside AWS. Everything you launch, an Amazon EC2 server, an Amazon RDS database, a container, lives inside a VPC, with its own range of private IP addresses that nobody else on AWS can reach.
Inside the VPC you cut subnets: smaller blocks of addresses, each tied to one Availability Zone. A public subnet has a route to the internet; a private one does not. Security groups act as a firewall around each machine, saying which ports can be reached and from where. Route tables decide where traffic goes next.
A typical setup: a load balancer in a public subnet, application servers in a private subnet, and the database in another private subnet that only those servers can talk to. Even if someone learns the database's address, there is no path to it from outside.
Every AWS account comes with a default VPC so you can start without thinking about networking, but production systems almost always design their own.
Keep in mind
- A VPC lives in one region and spans its Availability Zones.
- Public subnets can reach the internet; private ones cannot unless you add a NAT gateway.
- Security groups are per-machine firewalls: closed by default, you open only what you need.
- The default VPC is fine for experiments, not for production.
