AWS Virtual Private Cloud
Amazon VPC (Virtual Private Cloud) provides logical network isolation inside AWS. It allows you to define your own private IP address space, segment resources into subnets, and control how traffic flows in and out of your environment. Understanding VPC design is essential for building secure and well-structured AWS architectures.
The VPC Foundation: Your Virtual Data Center
Before you can design any network in AWS, you must first understand the container that holds it all. An Amazon VPC is a logically isolated section of the AWS network where you launch resources such as EC2 instances, RDS databases, and load balancers. When you create a VPC, you define an IP address range using CIDR notation, such as 10.0.0.0/16. This range becomes your private network space, and all subnets and resources draw IP addresses from this defined range.
The VPC provides isolation at the network level. Resources inside one VPC cannot communicate with resources in another unless explicitly configured, forming the foundation of secure cloud networking.
IP addressing within a VPC uses private IPv4 ranges defined by RFC 1918 (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16). Your CIDR block determines the total number of available IP addresses (a /16 block provides 65,536 addresses, while a /24 provides 256). Choosing the correct range is an architectural decision. If the block is too small, future expansion becomes difficult; if excessively large, IP space may be wasted or conflict with on-premises networks in hybrid architectures.
Segmenting the Network by Access and Function
Once the VPC is defined, the next step is dividing it into smaller segments called subnets, each with a specific purpose and access level.
A subnet is a subdivision of the VPC’s IP address range that exists within a single Availability Zone. Subnets allow you to organize resources by function or security requirements, creating network segmentation that improves security, fault isolation, and architectural clarity.
- A public subnet has a route to an Internet Gateway, allowing resources to receive traffic from and send traffic to the public internet, provided security group rules allow it. Typical resources include web servers and load balancers that must be accessible to end users. For an EC2 instance to be publicly accessible, it must reside in a public subnet and have a public IP address or Elastic IP associated with it. Public accessibility increases exposure, so security controls must be carefully configured.
- A private subnet does not have a direct route to the Internet Gateway. Resources cannot receive inbound traffic directly from the internet, making private subnets suitable for internal application servers, databases, and backend services. For example, an Amazon RDS database should reside in a private subnet to prevent direct internet access. If instances require outbound internet access, a NAT Gateway can be configured in a public subnet to enable secure outbound communication.
Each subnet resides in a single Availability Zone. To design highly available systems, you must create subnets in multiple Availability Zones. For instance, a resilient web application might include two public subnets in separate AZs for load balancers and two private subnets for backend services. This ensures that if one AZ becomes unavailable, resources in another continue operating.
Route Tables and Internet Gateway
Subnets alone do not enable communication, they need route tables to direct traffic and gateways to connect beyond the VPC.
Every subnet is associated with a route table that determines how traffic is directed. By default, traffic within the VPC can flow between subnets. Additional routes determine whether traffic can exit the VPC through an internet gateway or other gateways. Route configuration defines whether a subnet is public or private, a public subnet’s route table includes a rule directing internet-bound traffic to the Internet Gateway, while a private subnet’s route table does not.
An internet gateway is a VPC component that enables communication between resources in the VPC and the public internet. It is horizontally scaled and highly available by design, requiring no manual scaling or maintenance. Attaching an Internet Gateway to a VPC allows resources with appropriate routing and public IP addresses to communicate externally. Without an Internet Gateway, the VPC remains isolated from the internet.
Even with an internet gateway attached, traffic remains governed by security groups and network ACLs. Inbound internet traffic must be explicitly allowed through security group rules, by default, security groups deny inbound traffic. Outbound traffic is typically allowed by default but can be restricted if required. Connectivity requires alignment of route tables, Internet Gateway configuration, and security policies.
Architectural Patterns and Security Implications
With the core components in place, we can now examine how they work together in real-world architectures and why proper design matters for security.
A three-tier application is a common pattern that illustrates VPC design clearly.
- The presentation layer (web servers) resides in public subnets.
- The application layer resides in private subnets.
- The database layer resides in separate private subnets.
- The Internet Gateway allows user traffic to reach the web tier.
- The web tier communicates with the application tier internally, and the application tier communicates with the database tier within private networking boundaries.
This design prevents direct database exposure while maintaining necessary communication paths.
Improper subnet configuration can unintentionally expose internal resources. Placing a database in a public subnet increases risk significantly. Correct VPC design reduces exposure before application-level security controls are even applied, network isolation is the first security boundary. Understanding subnet placement is critical for building secure, well-architected AWS solutions.
My name is Naeem ul Haq. I’ve been working with AWS since its early days and have deep expertise across its evolving ecosystem.
