What Is Amazon Virtual Private Cloud

Amazon Virtual Private Cloud (VPC) is a service that creates a logically isolated network in AWS. It offers a form of security for cloud computing resources, as it prevents just anyone from having access. AWS VPC offers traffic mirroring, security groups, network access control lists, IP addressing, network managers and flow logs, among other features.

AWS Virtual Private Cloud allows you to create a virtual network similar to a physical network in a data center. It lets you control the IP address, security, subnetting, traffic and so on, isolating the network as needed.

Creating an AWS VPC primarily involves defining an IP address range (a CIDR block) and creating a private or public subnet. Depending on the architecture of your cloud environment, you may also set up endpoints and gateways when creating the VPC.

You can use AWS VPC for simple websites, but if you really want to put it to work, use it for multi-tier web applications or when creating a hybrid cloud environment.

Cloud Storage Courses

Check out our cloud storage courses and grab a limited-time offer.
Registration available now!

Enroll Now

Amazon VPC itself comes at no extra charge. However, components like network address translation (NAT) gateways, public IP addresses and IP address managers are charged at an hourly rate. We’ll cover all of this in our guide.

What Is Amazon Virtual Private Cloud (AWS VPC)?

Amazon’s virtual private cloud service, AWS VPC, offers an isolated network in the AWS public cloud environment. It is an example of a private cloud deployment but can also be considered a hybrid cloud deployment since it features the scalability of the public cloud. AWS VPC virtual networks are like physical networks, but they come with the added advantages of flexibility and scalability.

An AWS VPC can be either private or public depending on the internet access. When private, the VPC does not have a public subnet, which is a subnet associated with an internet gateway. However, public VPCs do have public subnets.

The core purpose of an AWS VPC is logical isolation: It isolates your resources in AWS, preventing unauthorized network access. In addition to isolation, it lets you manage communication among the resources in the VPC and with the internet.

What Is Default AWS VPC?

When you create an account, Amazon Web Services (AWS) creates a default VPC for your account in all AWS regions. With this, you can launch AWS resources and build your cloud infrastructure right away.

A default VPC is a beginner’s quick start to using AWS; it eases people
into using AWS without having in-depth networking experience.

AWS’ default VPC is public since it comes with a public subnet in each region’s availability zone. When you launch AWS resources like EC2 instances in a default VPC, they get a public IP address.

Of course, the public subnet in a default VPC connects to the internet through an internet gateway, so every default VPC has an internet gateway. Default VPCs also come with access control lists (ACLs) and security groups, which control traffic to and from the network.

The upside of default AWS VPCs is the simplicity and ease they offer first-time users, particularly beginners. Instead of worrying about the intricacies of configuring a VPC, they can jump into deployment straight away.

What Is a Non-Default AWS VPC?

A non-default AWS VPC is basically a custom VPC — it does pretty much the same thing as a default VPC, but you tweak it to your taste.

Non-default AWS VPCs give you a high level of control over your network, allowing you to configure the IP address range, security group, access control list (ACL), route table, public or private subnets and so on. For internet or external network access, they may also have gateways and endpoints.

The upside of non-default AWS VPCs is that they can offer more security than a default VPC if configured correctly.

What Are the Features of AWS VPC?

The main features of AWS virtual private clouds are flow logs, the IP address manager (IPAM), IP addressing, ingress routing, the network access analyzer, the network manager, network access control lists, the reachability analyzer, security groups, traffic mirroring and lattice. Each feature helps increase security in different ways, which we discuss in detail below.

Flow Logs

Flow logs record the flow of traffic across network interfaces in a VPC. These records are valuable for troubleshooting, cost optimization, compliance reporting, and security and monitoring analysis.

flow

Flow logs can record all types of IP traffic, but you can configure
them to log only “accept” or “reject” traffic.

IP Address Manager (IPAM)

The IP address manager (IPAM) is like a central repository of all IP addresses used in the VPC. It tracks and manages IP address allocation in the network, preventing conflicts while simplifying IP addressing.

IPAM

The IP address manager ensures IP addressing in your VPC
follows your preferred IP allocation rules.

IP Addressing

IP addressing involves assigning IPv4 or IPv6 addresses to network interfaces in the VPC and subnet. It fosters identification and communication between the components and resources of a VPC. When it comes to AWS VPC, you can use IP addresses provided by AWS. Alternatively, you may bring your own IP address.

ip

IP addressing in a VPC involves identification, just like it
does in any networking environment.

Ingress Routing

With ingress routing, you can direct traffic from a gateway to the network interface of a target resource in your VPC. This gives you a higher level of control over traffic in the VPC. It can also promote security, as you can route traffic to a checkpoint resource before it reaches its final destination.

routing

Ingress routing gives you control of the flow of traffic
within the VPC through a route table.

Network Access Analyzer

The network access analyzer feature monitors network access to the VPC, helping you maintain security and compliance by identifying unauthorized access and access patterns.

net analyzer

The network access analyzer is useful when trying to detect
unauthorized access that may have gone unnoticed.

Network Manager

The network manager provides a suite of network management tools, including IP management, connectivity management, and troubleshooting and monitoring tools. These help ensure the smooth running of the network.

network manager

The network manager offers networking features like
cloud WAN and a reachability analyzer.

Network Access Control List

A network access control list (ACL) is a firewall for the subnets in a VPC. It offers an extra layer of security by controlling the flow of traffic to and from the subnets.

nacl

Network ACLs are subnet-level firewalls without the granularity
and statefulness of security groups.

Reachability Analyzer

The reachability analyzer assesses the reachability between resources in a VPC. When resources cannot reach each other, the analyzer shows you why. However, when resources are reachable, the analyzer provides details of the virtual path between the resources.

reach

Reachability checks that a source resource and a destination
resource are reachable via the path between them.

Security Groups

Like network ACLs, security groups are firewalls. However, unlike network ACLs, security groups control incoming and outgoing resource traffic, not subnet traffic. Security groups provide traffic control to resources in a VPC, preventing unwanted access.

sg

You can assign one security group to multiple instances
and multiple security groups to one instance.

Traffic Mirroring

The traffic mirroring feature basically replicates the traffic of an EC2 instance’s network interface. The replicated traffic is passed on to an out-of-band inspection tool, which analyzes the traffic for flaws, troubleshoots issues, ensures compliance and gains insight into network patterns.

mirror

Traffic mirroring copies traffic for security, content and performance inspection.

Lattice

The lattice feature connects, secures and monitors applications within a VPC. It enhances connectivity between services while improving security and offering insight into the communication between services.

lattice

The lattice feature fosters a secure connection between services,
automatically managing the underlying connection.

How Does AWS VPC Work?

AWS VPC works by creating a virtual network that is cut off from other virtual networks in AWS. This ensures the resources and data in each account are secure and private.

For efficient routing and organization, VPCs are grouped into subnets, which are smaller networks within the larger virtual network. The subnets can be either private or public; public subnets having direct internet access, while private subnets don’t.

A public subnet in an AWS VPC connects to the internet through the VPC’s internet gateway. That said, you can also make resources in a private subnet internet accessible using a NAT gateway or a NAT instance.

VPCs have an IP address range (also known as a CIDR block), which defines the possible addresses of the resources within the network. The subnets also have IP ranges that fall within the VPCs’ IP address range.

Network access control lists (ACLs) and security groups are some components with which VPCs secure their resources. Though both have similar traffic control functions, their scope and usage differ. For one, ACLs control traffic into the subnets, while security groups control traffic into the resources.

Route tables determine the direction in which traffic flows within a VPC. They contain a table of target IDs matched to destination IP addresses. This matching means that traffic to a destination IP address is directed to the target resource with the specified ID.

What Is the Architecture of AWS VPC?

VPC

AWS creates its default VPCs using the 172.31.0.0/16 CIDR block.

AWS VPCs are regional services; they act as the container for all the resources and network components in a specific region in an AWS account. They are subdivided into subnets, which can exist in one or more availability zones.

When not associated with an internet gateway, the subnets are private. However, when they are associated with an internet gateway, the subnets are public, meaning they have internet access.

Basic VPC architecture includes a route table, security group and network access control list. The route table describes the direction of traffic from a subnet, while the security group and network ACL secure the VPC’s resources. The security group acts as a stateful firewall for resources within a subnet, and the network ACL is like a stateless firewall for subnet traffic.

Depending on your needs, an AWS VPC’s architecture may also include endpoints, peering connections, NAT gateways, carrier gateways, site-to-site VPN connections and more.

What Are the Components of AWS VPC?

The main components of AWS VPC are subnets, route tables, internet gateways, network ACLs and security groups. We discuss the roles of these components below.

Subnets

Subnets are smaller network groups within a VPC, like network subdivisions. They streamline the separation of resources based on networking and security requirements. Each subnet in a VPC has its own IP address range, which is a subset of the VPC’s CIDR block, and resources deployed into the subnet will have private IP addresses within that range.

Depending on the presence of an internet gateway, a subnet can be either public or private. Private subnets are not associated with an internet gateway, so they have no access to the internet. On the contrary, public subnets can access the internet thanks to their internet gateway.

Route Tables

A route table is a tabular set of rules called routes that directs the flow of traffic in a VPC. Each subnet in a VPC is attached to a route table, which determines how resources in the subnet send traffic inside and outside the VPC.

Network ACLs

Network access control lists (ACLs) control a subnet’s network traffic flow. A network ACL is a stateless firewall, so it requires explicit declaration of the rules to ensure everything is in place.

When defining rules in a network ACL, you’ll specify the network protocol, port, traffic type and source IP, and then choose to either allow or deny traffic that matches the provided parameters. You’ll also provide a rule number, which describes the order of priority of the rules in the ACL. Generally, lower rule numbers take precedence over higher numbers.

Security Groups

Security groups control an instance’s network flow. Unlike network ACLs, they are stateful, so return traffic is implicitly allowed.

Rule definition in security groups involves protocols, ports, traffic types and sources. However, the source in a security group can be either an IP or a security group ID. In addition, you do not have to choose “allow”or “deny”– any rule not specified is denied.

What Is a Security Group in AWS VPC?

A security group in AWS VPC is the firewall of a VPC’s resources. It contains rules that control the flow of network traffic to and from the resources.

Security groups control traffic based on protocol, source and port range. In other words, a security group can allow or deny network traffic based on the network protocol, port or source of the traffic. The source identifier can be an IP address, an IP address range or a security group ID.

When using security groups, we can specify different rules for inbound and outbound connections. That said, security groups are stateful; they allow for return traffic for each connection. Unlike security groups, access control lists are not stateful.

You can associate multiple security groups with a resource. Similarly, you can associate multiple resources with a security group.

In default VPCs, security groups allow all outgoing connections but restrict all incoming connections. However, you can update the security group in a default VPC to allow incoming traffic as needed.

What Is AWS Private Global Network?

AWS Global Network is a service that consolidates networking infrastructure across multiple environments, including AWS and on-premises networks. Think of it as a container for networks that you would normally manage separately. AWS global networks come in handy when dealing with complex networks across multiple regions or accounts.

AWS Global Network promotes visibility by providing a dashboard with geographic and topological representations of the network objects. It also enables centralized management with multi-account monitoring systems and consistent access policies.

Though it offers some management functions, AWS Global Network cannot modify network resources such as virtual private clouds (VPCs). You have to modify said resources following the usual steps.

How Do AWS VPCs Access the Internet?

VPC resources access the internet directly using their internet gateways. At the same time, incoming internet traffic gains access to the VPC through the internet gateway. Of course, both incoming traffic and outgoing traffic are subject to the rules of the security groups and access control lists.

Apart from an internet gateway, VPC resources can access the internet using a NAT gateway. NAT gateways are a network translation service that routes traffic from resources in a private subnet to the internet.

NAT gateways exist in public subnets and serve as an intermediary between private subnets and the internet. They’re the better option when you want your private subnet to retain its privacy while having access to the internet.

In place of NAT gateways, you can use NAT instances, which are public EC2 instances that route traffic from private subnets to the internet using IP forwarding.

How Do AWS VPCs Access a Corporate or Home Network?

AWS VPCs access corporate or home networks using AWS Direct Connect, AWS Site-to-Site VPN, AWS VPN CloudHub, transit gateways and VPC peering.

AWS direct connect is a service that connects an AWS VPC to a corporate or home network over the AWS network. It differs from other options because the traffic between the remote network and the VPC is isolated from the internet.

AWS Site-to-Site VPN connects an AWS VPC to a remote network with IPsec VPN over the internet. Similarly, AWS VPN CloudHub connects an AWS VPC over the internet to multiple remote networks with IPsec VPNs. In other words, AWS VPN CloudHub is basically multiple site-to-site VPN connections.

Transit gateways connect multiple VPCs through a hub-and-spoke model before those VPCs are connected to a remote network. You can facilitate the final connection to the remote network using Direct Connect, Site-to-Site VPN or both.

Your VPC can access a corporate or home network in another VPC using VPC peering. VPC peering can exist between two VPCs in the same region or different regions, and resources in both VPCs can communicate as if they were in the same network.

What Are the Methods to Create and Manage AWS VPCs?

The main methods to create and manage an AWS virtual private cloud are the AWS management console, AWS SDK, the AWS command line interface (CLI) and the query API. Here’s how each one works:

AWS Management Console

The AWS management console is a web-based visual interface through which you can manage your AWS resources. Follow these steps to create and manage an AWS VPC from the management console:

  1. Log In to the Management Console

    Log in to AWS using your account ID, IAM user name and password.

    sign in
  2. Enter the VPC Control Panel

    Search for “VPC” in the search bar and choose “VPC” from the results.

    choose
  3. Create a New VPC

    From the ensuing VPC dashboard, select “create VPC.” To manage the VPC, click on any of the components and configure them as desired.

    create vpc
AWS SDK

AWS SDKs (software development kits) are programmatic tools that grant you access to create and manage AWS services using a programming language such as Python, Java or JavaScript. AWS has SDKs across various programming languages, including Boto3 (Python), AWS SDK for Java, AWS SDK for JavaScript and AWS SDK for C++. 

To create or manage a VPC with any of the SDKs, you need some knowledge of the corresponding programming language. Once you’ve got that down, the SDK tool resources page offers comprehensive guides on how to use the SDKs.

AWS Command Line Interface

The AWS command line interface (CLI) allows for the creation and management of AWS resources using a text-based interface.

How to Create a VPC Using AWS CLI

To create a non-default AWS VPC from the CLI, run the aws ec2 create-vpc command. When running the command, you may specify one of many options to customize the VPC. Some of those options include the following:

  • –cidr-block: Use this option to specify the IPv4 address range of the VPC.
  • –region: This option defines the region in which you create the VPC.
  • –ipv4-ipam-pool-id: Specify an IPAM pool ID when you want to use the CIDR from an IPAM pool.

Besides the VPC itself, you can create subnets, route tables, routes, internet gateways, security groups and network ACLs from the command line. Here’s a list of the commands and their corresponding components:

  • aws ec2 create-subnet creates subnets.
  • aws ec2 create-route-table creates route tables.
  • aws ec2 create-route creates a route in a route table.
  • aws ec2 create-internet-gateway creates an internet gateway.
  • aws ec2 create-security-group creates a security group.
  • aws ec2 create-network-acl creates a network access control list.

There are CLI commands for many other VPC components, but we only listed the most essential ones here.

How to Manage a VPC Using AWS CLI

The AWS CLI can manage a VPC using various commands, including the following:

  • aws ec2 delete-vpc deletes a VPC.
  • aws ec2 associate-vpc-cidr-block associates an IP address range with a VPC.
  • aws ec2 create-default-vpc creates a default VPC.
  • aws ec2 disassociate-vpc-cidr-block removes an IP address range from a VPC.
  • aws ec2 modify-vpc-endpoint changes attributes of a VPC endpoint.
  • aws ec2 allocate-ipam-pool-cidr allocates CIDR blocks from an IPAM to another IPAM pool or resource.
Query API

The query API allows for the creation of AWS resources using HTTP requests. Like AWS CLI, it is a low-level approach to resource creation.

An HTTP request to create a VPC with a specific IP address range uses the “CreateVpc”action. However, when deleting a VPC, it uses the“DeleteVpc”action. Other queries for managing VPCs include ModifyIpam, ModifyVpcAttribute, CreateSubnet and AssociateRouteTable.

What Are the Use Cases of AWS VPC?

The main use cases of AWS Virtual Private Cloud are securing simple websites and blogs, creating hybrid connections and hosting multi-tier web applications. Here’s how AWS VPC makes these use cases possible:

  • Securing simple websites and blogs: Using security groups, AWS VPC controls traffic to and from a server in a subnet. This ensures such websites or blogs have appropriate security positioning.
  • Creating hybrid connections: With VPC components like Site-to-Site VPN and AWS Direct Connect, you can readily connect a VPC to on-premises infrastructure, creating a hybrid cloud environment.
  • Hosting multi-tier web applications: When dealing with multi-tier web applications that have sensitive resources, like databases, ensure such resources are restricted from public access. At the same time, you want to ensure that public resources remain public. VPCs make this possible with security groups, private subnets and public subnets.

What Is the Pricing Structure of AWS VPC?

AWS VPC comes at no extra cost. However, you’ll accrue charges for components like the NAT gateway, public IPs, the IP address manager, traffic mirroring, the network access analyzer and the reachability analyzer.

The IP address manager, the NAT gateway, traffic mirroring and public IPs have hourly rates. However, the network analysis components (network access analyzer and reachability analyzer) are charged per analysis.

What Are the Alternatives to AWS Virtual Private Cloud?

The main alternatives to AWS Virtual Private Cloud are Microsoft Azure Virtual Network, Google VPC, DigitalOcean Virtual Private Cloud and IBM Cloud VPC. Here’s how each one compares to AWS VPC.

  • Google VPC: Like AWS VPC, Google Cloud VPC creates isolated virtual networks on the Google Cloud Platform (GCP). However, it is global, not regional like AWS VPC. In addition, subnets in Google VPC are regional, not zonal like AWS.
  • Microsoft Azure Virtual Network: Microsoft Azure Virtual Network provides logically isolated networks in the Microsoft Azure public cloud infrastructure. Azure Virtual Network’s seamless integration with active directory streamlines access management for the virtual network.
  • DigitalOcean Virtual Private Cloud: DigitalOcean Virtual Private Cloud offers the same primary purpose as AWS VPC. However, DigitalOcean Virtual Private Cloud offers a simpler interface and may not scale to the same extent as AWS VPC.
  • IBM Cloud VPC: IBM Cloud VPC creates virtual networks in IBM Cloud. Though similar to AWS VPC, it offers better support for bare-metal servers.

What Is the Main Difference Between VPC and Private Cloud?

The main difference between VPC and a private cloud is that a VPC represents a virtual network, while a private cloud is a cloud computing deployment model. 

VPCs are virtual versions of physical networks isolated from the internet. Since they are virtual resources, you do not have control over the underlying hardware. However, you have a high degree of control over the network configuration.

On the other hand, when running a private cloud, you typically have total control of the underlying infrastructure, except for the management and maintenance, which are outsourced. That said, a VPC is primarily considered a form of private cloud.

Is AWS a Private Cloud?

AWS is a public cloud provider since it delivers external cloud resources to third-party clients. However, it also offers private cloud services, including AWS VPC.

What Is the Main Difference Between a VPC and a VPN?

A VPC is an isolated virtual network in a public cloud. It offers privacy, security and scalability while streamlining network management in the cloud.

On the other hand, a VPN, or virtual private network, is a secure tunnel between computing devices or networks on the internet. VPNs ensure secure data transfer, as they provide a private, encrypted route for data being sent over the internet.

Final Thoughts

AWS VPC facilitates network privacy and security in AWS Cloud, while its subnets ensure logical segmentation of your resources. If you’re looking to extend your public cloud resources to an on-premises environment, AWS VPC components like Site-to-Site VPN and Direct Connect simplify the process.

What has your experience been like with AWS VPC? Did we overlook anything you wanted us to discuss? We’d love to hear from you, so leave a comment below. As always, thank you for reading.

FAQ: Virtual Private Cloud (VPC)

  • Amazon Virtual Private Cloud is an isolated virtual network deployed to an account in the AWS public cloud computing platform.

  • A VPC in AWS is a service that creates isolated virtual networks in your account.

  • Amazon Virtual Private Cloud is best described as a service that creates non-overlapping virtual networks in the AWS public cloud.

  • Yes, Amazon offers private cloud services. Some of its offerings include AWS Direct Connect and Site-to-Site VPN.


Let us know if you liked the post. That’s the only way we can improve.