Virtual Private Cloud Setup

A Virtual Private Cloud — VPC — gives you a private, isolated section of a cloud provider's network. Instead of sharing a flat public network with other customers, you get your own logically separated network environment. You define the IP address ranges, subnets, routing rules, and gateways. It is the foundation of a secure cloud architecture.

The Office Building Analogy

Think of the cloud provider's network as a large office building. Without a VPC, every tenant shares the same open floor plan — anyone can walk to any desk. With a VPC, each company gets its own locked floor. Visitors must check in at a specific entry point. Internal movement between rooms is controlled. Your neighbor on the next floor cannot reach your servers any more than they can walk through your locked door.

Core Components of a VPC

CIDR Block (IP Address Range)

When you create a VPC, you assign it an IP address range using CIDR notation (e.g., 10.0.0.0/16). This defines how many IP addresses are available inside your VPC. All resources you create inside the VPC get IP addresses from this range.

Subnets

Subnets divide your VPC into smaller network segments. Each subnet gets a portion of the VPC's IP address range. You place resources in subnets based on their security requirements — public-facing resources in public subnets, and sensitive resources in private subnets.

Internet Gateway

An Internet Gateway connects your VPC to the public internet. Resources in public subnets route outbound traffic through the Internet Gateway. Without an Internet Gateway, nothing in your VPC can reach the internet — and nothing from the internet can reach your VPC.

NAT Gateway

A NAT (Network Address Translation) Gateway lets resources in private subnets initiate outbound internet connections — for example, to download software updates — without exposing those resources to inbound internet traffic. The NAT Gateway sits in a public subnet and acts as an intermediary.

VPC Architecture Diagram:
----------------------------------------------------
           [ Internet ]
                |
        [ Internet Gateway ]
                |
   [ Public Subnet: 10.0.1.0/24 ]
   Web Server, Load Balancer
       |              |
       |         [ NAT Gateway ]
       |              |
   [ Private Subnet: 10.0.2.0/24 ]
   App Server, API Layer
           |
   [ Private Subnet: 10.0.3.0/24 ]
   Database, Storage
----------------------------------------------------
Internet traffic reaches only the public subnet.
Private subnets are not directly reachable from the internet.

Route Tables

Route tables tell your VPC how to forward network traffic. Each subnet is associated with a route table. A public subnet's route table includes a route to the Internet Gateway. A private subnet's route table routes internet-bound traffic through the NAT Gateway, not directly to the internet.

VPC Peering and Private Connectivity

VPC peering connects two VPCs so they can communicate using private IP addresses — without traffic going over the public internet. This is useful when you run multiple VPCs for different environments (development, staging, production) or different business units that need to share resources securely.

For connecting your on-premises office network to a cloud VPC, use a VPN (Virtual Private Network) connection or AWS Direct Connect / Azure ExpressRoute / Google Cloud Interconnect — dedicated private circuits that bypass the public internet entirely.

Security Best Practices for VPC Design

Never put sensitive resources (databases, internal APIs) in a public subnet.
Use separate VPCs for different environments — keep production isolated from development.
Apply security groups and Network ACLs as layered controls on all subnets and resources.
Enable VPC Flow Logs to record all accepted and rejected network traffic — this data is essential for incident investigations.
Restrict who can modify VPC configurations — only authorized network administrators should change routing rules or security groups.

VPC Flow Logs

VPC Flow Logs capture metadata about every network connection in your VPC — source IP, destination IP, port, protocol, and whether the connection was accepted or rejected. They do not capture the content of the traffic, only the connection details. Security teams use these logs to identify unusual traffic patterns, detect port scanning, and investigate incidents.

VPC Flow Log Entry Example (simplified):
-----------------------------------------
Source IP: 192.0.2.45
Dest IP:   10.0.3.12
Port:      3306 (MySQL)
Action:    REJECT
-----------------------------------------
Someone from the internet tried to reach the database directly.
The security group blocked it.
The flow log recorded the attempt.

Key Terms to Know

VPC: Virtual Private Cloud — a private, isolated network environment within a cloud provider.
CIDR: Classless Inter-Domain Routing — a method for defining IP address ranges.
NAT Gateway: Allows private subnet resources to access the internet without exposing them to inbound internet traffic.
VPC Peering: A private connection between two VPCs.
Flow Logs: Records of network connection metadata used for monitoring and investigation.

What You Learned

A VPC gives you a private, isolated network environment inside the cloud. Its core components — subnets, internet gateways, NAT gateways, and route tables — let you control exactly which resources are publicly reachable and which are completely isolated. Private subnets keep sensitive resources off the internet. VPC Flow Logs record all network activity for security monitoring and incident investigation. Separating environments into distinct VPCs limits the impact of any single breach.

Previous lesson

Back to course

Next lesson