Cloud Parts

Virtual private clouds

Your own private, isolated network inside the cloud.

1 technology on this page ↓
Live model
What you’re watchingInternet traffic can only enter through the load balancer in the public subnet. The app servers and database have no public address, and the app servers reach the internet outbound through the NAT gateway.

How it works

A virtual private cloud is a software-defined network with an IP range you choose, like 10.0.0.0/16, split into subnets. Public subnets route to the internet; private subnets have no inbound path from it. Route tables, security groups and network ACLs decide what may talk to what, and a NAT gateway lets private machines make outbound calls without being reachable.

Think of it as

A gated campus. The lobby faces the street, the labs are deep inside behind badge-only doors, and deliveries leave through a one-way loading dock.

Reach for it when

  • Every production deployment: databases and internal services stay off the internet
  • Connecting the cloud to an office or data center over VPN
  • Separating environments or teams

Think twice when

  • Treating it as your whole security story; you still need IAM, patching and encryption
  • Overlapping IP ranges between networks you may later want to connect

A real example

Only the load balancer sits in a public subnet. The app servers and database live in private subnets, and the database accepts port 5432 only from the app servers’ security group. Apps download packages through a NAT gateway.

Technologies

Specific products, and what each does differently.

What each provider calls it

AWS
VPC
Google Cloud
VPC network
Azure
Virtual Network (VNet)
Open source & others
WireGuard, Tailscale, Calico

In code · ts

// AWS CDK: one VPC, three tiers of subnets
const vpc = new ec2.Vpc(this, "Main", {
  ipAddresses: ec2.IpAddresses.cidr("10.0.0.0/16"),
  maxAzs: 2,
  subnetConfiguration: [
    { name: "public", subnetType: ec2.SubnetType.PUBLIC },
    { name: "app",    subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
    { name: "db",     subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
  ],
});

Often confused with

Load balancersIdentity & access (IAM)Secrets managementRemote access
Where it came from2006–2023

In a company’s own data center, isolation came from wiring and switches: separate cables, then VLANs that split one switch fabric into separate networks, plus firewalls at the edges and VPNs back to the office. The first public clouds threw that away. When EC2 launched in 2006, every customer’s machines shared one flat network, protected only by per-instance security groups. Enterprises wanted the cloud’s flexibility but not that exposure, and they needed cloud machines to fit into their existing address plans and reach their data centers.

Amazon introduced the Virtual Private Cloud in August 2009: a logically isolated network with an IP range the customer picks, split into subnets and joined to the corporate network by an IPsec VPN. Making that work for many customers on shared hardware needed network virtualization, where software maps each tenant’s virtual network onto the physical one. Nicira, founded in 2007 by Martin Casado, Nick McKeown and Scott Shenker, built a business on the idea, and VMware bought it for about $1.26 billion in 2012.

The private network then became the default. AWS gave every new account a VPC from 2013 and shut down its old shared network in 2023, and Google Cloud and Azure offer the same model as VPC networks and VNets.

Why it’s built this way

An overlay on top of the physical network
Tenants choose their own addresses, which often overlap, and VLANs top out at 4,094 IDs. Wrapping each tenant’s packets in an outer header (as VXLAN does, with 16 million segment IDs) lets one physical network carry them all.
Customers choose their own private IP ranges
A cloud network has to look like an extension of the corporate one, reachable over VPN without renumbering anything.
Public and private are just routing
Copying the data center model of subnets, route tables, gateways and firewalls let network teams reuse what they already knew, instead of learning a new security model.

Timeline

  1. 2006

    EC2 launches with all customers on one shared, flat network

  2. 2007

    Nicira founded to pursue software-defined network virtualization

  3. 2009

    Amazon VPC introduced: isolated networks linked to data centers by VPN

  4. 2012

    VMware buys Nicira for about $1.26 billion

  5. 2014

    VXLAN overlay protocol documented in RFC 7348

  6. 2023

    AWS retires EC2-Classic, its last shared flat network

Sources13

Improve this page on GitHub