Stop 02 · Networking Fundamentals for CloudTopics · 5/9

Virtual Private Clouds (VPCs)

In short

Before launching any server, you need a network to put it in. Get the VPC wrong and your database ends up on the open internet. Get it right and attackers can't even reach it.

Your own logically isolated section of a cloud provider's network — where you define subnets, route tables, and gateways to control exactly how your resources communicate with each other and the internet.

The blob character stands as a guard at the gate of a walled housing society.

Think of it like this

A gated housing society

The society has a boundary wall, internal roads and one main gate with a guard. Some blocks face the main road, others sit deep inside. A VPC is your society: you draw the wall, the roads and decide who passes the gate.

Watch it happen

Inside a typical VPC

VPC 10.0.0.0/16

Internet gateway

Public subnet

Load balancer

NAT gateway

Private subnet

App servers

Database

1/5You pick a private IP range for the whole VPC. 10.0.0.0/16 gives about 65,000 addresses to split up.

The big ideas

What you need to know

Your own private network

A VPC is an isolated slice of the provider's network. Other customers can't see into it.

Subnets split it up

Each subnet is a smaller IP range inside one availability zone. Use several zones so one failure doesn't take everything down.

Route tables decide paths

A subnet is 'public' only because its route table sends 0.0.0.0/0 to an internet gateway. That one line is the difference.

Private by default

Put databases and internal services in private subnets. Expose only load balancers or bastions to the internet.

See it in code

Walk through the code

hcl

1resource "aws_vpc" "main" {2  cidr_block = "10.0.0.0/16"3}4 5resource "aws_subnet" "public_a" {6  vpc_id                  = aws_vpc.main.id7  cidr_block              = "10.0.1.0/24"8  availability_zone       = "ap-south-1a"9  map_public_ip_on_launch = true10}11 12resource "aws_subnet" "private_a" {13  vpc_id            = aws_vpc.main.id14  cidr_block        = "10.0.2.0/24"15  availability_zone = "ap-south-1a"16}

1/3The VPC gets the big /16 range. Every subnet must fit inside it.

Terraform for a VPC in Mumbai (ap-south-1) with one public and one private subnet. You'd still add an internet gateway and route tables.

Save yourself the pain

Common mistakes

Oops

Putting the database in a public subnet 'just for testing'.

Do this instead

Keep it private from day one and connect through a bastion, VPN or Session Manager. Tests have a way of becoming production.

Oops

Choosing a tiny VPC range like /24 for everything.

Do this instead

Start with something roomy like /16. Growing a VPC's range later is painful and can clash with other networks.

Your mission

Sketch and build a 2-tier VPC

~40 min

Quick check

What actually makes a subnet 'public'?

Go deeper

1Create a basic VPC with public and private subnets in a free-tier account.
2Learn the role of an internet gateway (public access) versus a NAT gateway (private outbound access).
3Diagram a VPC's route table and explain how traffic actually flows through it.