Cloud Parts

Amazon VPC

Your own isolated network in an AWS Region, split into per-zone subnets with route tables, security groups and gateways.

What it is
Virtual private clouds
Type
Managed service on AWS
Made by
Amazon Web Services
License
Proprietary
Facts checked
5 October 2026
Website

What it is

A VPC spans one AWS Region and gets an IPv4 range you pick, such as 10.0.0.0/16. You carve it into subnets, each in one Availability Zone and between /16 and /28 in size; AWS reserves five addresses in every subnet: the network address, the router, DNS, one for future use and the broadcast address. Whether a subnet is “public” is just routing: its route table sends 0.0.0.0/0 to an internet gateway. Private subnets send outbound traffic through a NAT gateway instead, or have no internet route at all.

Two filters decide what may connect. Security groups attach to network interfaces, hold allow rules only, and are stateful, so replies are let back in automatically; rules can name other security groups instead of IPs. Network ACLs attach to subnets, allow and deny in numbered order, and are stateless. The VPC itself is free. The costs come from what you add: a NAT gateway is $0.045 an hour plus $0.045 per GB processed in US East, and every public IPv4 address is $0.005 an hour. Gateway endpoints for S3 and DynamoDB are free and keep that traffic off the NAT gateway.

Why teams pick it

  • No charge for the VPC, subnets, route tables or security groups themselves
  • Security groups that reference each other express “the app tier may reach the database” without IP lists
  • Free gateway endpoints reach S3 and DynamoDB from private subnets without a NAT gateway
  • Peering, Transit Gateway, VPN and Direct Connect join VPCs to each other and to your data center

Watch out for

  • NAT gateway data processing charges are a classic surprise on the bill for chatty private workloads
  • Peering isn’t transitive and peered VPCs can’t have overlapping ranges, so plan CIDRs up front
  • Default quotas of 5 VPCs per Region and 60 rules per security group need requests to raise
  • Subnets are tied to one Availability Zone, so high availability means at least two of each tier

How it fits with other technologies

What uses Amazon VPC

A VPC with a public and a private subnet in Terraform · hcl

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "public_a" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.0.0/24"
  map_public_ip_on_launch = true
}

resource "aws_subnet" "private_a" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.10.0/24"
}

See it in a real stack

No architecture uses Amazon VPC yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2006–2025

When EC2 launched in 2006, every instance ran on one flat 10.0.0.0/8 network shared with every other customer. You got security groups and an automatically assigned public IP address, and little else. Large companies wanted to move applications into the cloud while keeping them tied to their own data centers, management tools and address plans, and isolated from everyone else’s machines.

On 25 August 2009 AWS introduced Amazon Virtual Private Cloud. A VPC was a private, isolated group of instances with an IP range you chose, split into subnets, and joined to your office network by an IPsec VPN. At first it had no internet access of its own: all outside traffic went back through the VPN. In March 2011 AWS added internet gateways, public and private subnets, route tables, NAT and network ACLs, so you could build a network that “closely resembles the one in your physical data center”, as the announcement put it.

VPC then became the default. From March 2013 AWS created a ready-made VPC for new accounts, and accounts opened after 4 December 2013 never saw the old flat network. AWS shut down the last EC2-Classic instance on 15 August 2023, a rare service retirement.

Why it’s built this way

You choose the private address range
Enterprises needed cloud machines to fit into their existing address plans and reach on-premises systems over a VPN, which a shared, AWS-assigned range couldn’t allow.
Public or private is just a route
Rather than a special subnet type, a subnet is public only if its route table points at an internet gateway. That mirrors how physical networks are built, with routers deciding what can reach the internet.
Two layers of filtering
Security groups, carried over from EC2-Classic, filter traffic per instance and gained outbound rules in VPC. Network ACLs, added in 2011, apply allow and deny rules per subnet, closer to the firewalls data center teams already ran.
A default VPC created for you
AWS wanted every EC2 user to get VPC features without first designing a network. A ready-made VPC meant existing scripts, CloudFormation templates and Auto Scaling setups kept working unchanged.

Timeline

  1. 2006

    EC2 launches on a single flat network shared by all customers

  2. 2009

    Amazon VPC introduced on 25 August, connected to data centers by IPsec VPN

  3. 2011

    Internet gateways, public and private subnets, NAT and network ACLs arrive

  4. 2013

    Default VPCs for new accounts; accounts after 4 December are VPC-only

  5. 2023

    The last EC2-Classic instance is shut down on 15 August

  6. 2024

    Block Public Access lets admins cut internet traffic to VPCs centrally

  7. 2025

    VPC encryption controls audit and enforce encryption in transit

Sources11 · facts checked 5 October 2026

Improve this page on GitHub