When working with AWS, one of the first services you'll encounter is the Amazon Virtual Private Cloud (VPC). Understanding VPC is essential for Cloud Engineers, DevOps Engineers, Solutions Architects, and anyone building secure and scalable cloud infrastructure.

What is AWS VPC?

Amazon VPC (Virtual Private Cloud) is a logically isolated virtual network within AWS where you can launch and manage your cloud resources securely.

Think of a VPC as your own private data center in the AWS Cloud where you control:

✅ IP Addressing

✅ Network Routing

✅ Internet Connectivity

✅ Security Policies

✅ Resource Isolation

Why Do We Need a VPC?

Without a VPC, all cloud resources would exist in a shared network environment.

A VPC allows organizations to:

• Isolate applications

• Improve security

• Control traffic flow

• Connect on-premises data centers

• Design highly available architectures

AWS VPC Architecture

AWS Region
│
└── VPC (10.0.0.0/16)
    │
    ├── Public Subnet (10.0.1.0/24)
    │      ├── Web Server
    │      └── Load Balancer
    │
    ├── Private Subnet (10.0.2.0/24)
    │      ├── Application Server
    │      └── EKS Worker Nodes
    │
    └── Private DB Subnet (10.0.3.0/24)
           └── RDS Database

Key Components of AWS VPC

1️⃣ CIDR Block

A CIDR block defines the IP address range available in the VPC.

Example:

10.0.0.0/16

This provides:

65,536 IP Addresses

2️⃣ Subnets

A subnet divides a VPC into smaller networks.

Example:

VPC: 10.0.0.0/16

Public Subnet:
10.0.1.0/24

Private Subnet:
10.0.2.0/24

Database Subnet:
10.0.3.0/24

Public Subnet

Resources have internet access.

Examples:

• Load Balancers
  Bastion Hosts
  Public EC2 Instances
  Private Subnet

Resources do not have direct internet access.

Examples:

• Application Servers
  Kubernetes Nodes
  Internal Services

• 3️⃣ Internet Gateway (IGW)

An Internet Gateway allows communication between your VPC and the Internet.

Internet
    │
    ▼
Internet Gateway
    │
Public Subnet

Without an IGW:

❌ No internet access

4️⃣ Route Tables

Route tables determine where network traffic is directed.

Example:

Public Route Table

0.0.0.0/0 → IGW

Allows internet access.

Private Route Table

0.0.0.0/0 → NAT Gateway

Allows outbound internet only.

5️⃣ NAT Gateway

Private resources often need outbound internet access.

Examples:

• OS updates
  Package downloads ,Docker image pullsA NAT Gateway enables this securely.

Private EC2
      │
      ▼
NAT Gateway
      │
      ▼
Internet Gateway
      │
      ▼
Internet

Benefits:

✅ Outbound Access

❌ No Inbound Internet Access

6️⃣ Security Groups

Security Groups act as virtual firewalls at the instance level.

Example:

Web Server

Inbound:

80  HTTP
443 HTTPS
22  SSH

Outbound:

All Traffic

Characteristics:

• Stateful
  Allow rules only

7️⃣ Network ACL (NACL)

NACLs operate at the subnet level.

Characteristics:

• Stateless
  Allow and Deny Rules

Example:

Allow HTTP
Allow HTTPS
Deny Specific IP

Security Group vs NACL

8️⃣ Elastic IP (EIP)

Static Public IP Address.

Used for:

• Bastion Hosts
  NAT Gateways

Benefits:

• Persistent IP

• Survives Instance Restart

9️⃣ VPC Peering

Connects two VPCs privately.

Example:

VPC A
  │
Peering
  │
VPC B

Use Cases:

• Multi-team environments
  Shared services

🔟 VPC Endpoints

Allow private access to AWS services without traversing the internet.

Example:

Private EC2
     │
VPC Endpoint
     │
Amazon S3

Benefits:

✅ Improved Security

✅ Reduced Latency

✅ No NAT Cost

High Availability VPC Design

Region
│
├── AZ-A
│    ├── Public Subnet
│    └── Private Subnet
│
└── AZ-B
     ├── Public Subnet
     └── Private Subnet

Benefits:

• Fault Tolerance
  High Availability
  Disaster Recovery

Real-World Production VPC

Internet
    │
ALB
    │
Public Subnets
    │
Application Layer
(Private Subnets)
    │
Database Layer
(Private Subnets)

Services:

• EC2 EKS
  ECS
  RDS
  Lambda
  ElastiCache

Step by step to create VPC

Step 1: Create VPC

Navigate:

AWS Console
→ VPC
→ Your VPCs
→ Create VPC

Select:

VPC Only

Configuration:

Name: DevOps-VPC
IPv4 CIDR: 10.0.0.0/16
Tenancy: Default

Click:

Create VPC

Step 2: Create Public Subnet

Navigate:

Subnets
→ Create Subnet

Configuration:

VPC: DevOps-VPC

Subnet Name:
Public-Subnet

Availability Zone:
ap-south-1a

CIDR:
10.0.1.0/24

Create Subnet.

Step 3: Create Private Subnet

Subnet Name:
Private-Subnet

Availability Zone:
ap-south-1b

CIDR:
10.0.2.0/24

Create Subnet.

Step 4: Enable Auto Assign Public IP

Select Public Subnet:

Actions
→ Edit Subnet Settings

Enable:

Auto Assign Public IPv4 Address

Save.

Step 5: Create Internet Gateway

Navigate:

Internet Gateways
→ Create Internet Gateway

Name:

DevOps-IGW

Create.

Step 6: Attach IGW to VPC

Select Internet Gateway.

Actions
→ Attach to VPC

Choose:

DevOps-VPC

Attach.

Step 7: Create Route Table

Navigate:

Route Tables
→ Create Route Table

Name:

Public-RT

VPC:

DevOps-VPC

Step 8: Add Internet Route

Select:

Public-RT

Routes Tab:

Edit Routes

Add:

Destination: 0.0.0.0/0
Target: Internet Gateway

Save.

Step 9: Associate Public Subnet

Subnet Associations:

Edit Associations

Select:

Public-Subnet

Save.

Step 10: Create Elastic IP

Navigate:

Elastic IPs
→ Allocate Elastic IP

Allocate.

Step 11: Create NAT Gateway

Navigate:

NAT Gateway
→ Create NAT Gateway

Configuration:

Name:
DevOps-NAT

Subnet:
Public-Subnet

Elastic IP:
Select Created EIP

Create.

Wait until:

Available

Step 12: Create Private Route Table

Navigate:

Route Tables
→ Create Route Table

Name:

Private-RT

Step 13: Add NAT Route

Routes:

Destination:
0.0.0.0/0

Target:
NAT Gateway

Save.

Step 14: Associate Private Subnet

Subnet Associations:

Private-Subnet

Save.

Step 15: Create Security Group

Navigate:

Security Groups
→ Create Security Group

Name:

Web-SG

Inbound Rules:

HTTP 80
HTTPS 443
SSH 22

Source:

0.0.0.0/0

(For production, restrict SSH to your IP.)

Step 16: Launch EC2 in Public Subnet

Navigate:

EC2
→ Launch Instance

Configuration:

AMI:
Ubuntu 22.04

Instance:
t2.micro

VPC:
DevOps-VPC

Subnet:
Public-Subnet

Security Group:
Web-SG

Launch.

Step 17: Verify Internet Connectivity

Connect:

ssh -i key.pem ubuntu@PUBLIC-IP

Run:

ping google.com

Success = Internet Gateway working.

Step 18: Launch EC2 in Private Subnet

Launch another EC2:

Subnet:
Private-Subnet

No Public IP

Connect through Bastion Host.

Verify:

sudo apt update

Success = NAT Gateway working.