An Amazon VPC (Virtual Private Cloud) is your own private, isolated network inside AWS. Within it you define an IP address range, split it into subnets, decide which resources are reachable from the internet and which stay protected inside, and control how traffic flows between them. It is the cloud equivalent of the network once built in a datacenter with physical switches, routers, and firewalls, but defined in software and ready in minutes.
Understanding the VPC is the starting point of almost any serious architecture on AWS: it is the foundation on which security, isolation between environments, and regulatory compliance rest.
What problem does a VPC solve?
When you move applications to the cloud, turning on servers is not enough: you need to decide who can talk to whom. A database with sensitive information should not be reachable from the internet; a load balancer should. Without a well-designed network, everything is either exposed or cut off.
The VPC solves this by giving you a logically isolated network space separate from that of any other AWS customer. Within that space you decide the topology: what is public, what is private, how development and production environments are segmented, and what rules govern each connection.
The components of a VPC
A VPC is built by combining a few pieces. These appear in practically every architecture:
- Subnets: partitions of the VPC’s IP range. Each subnet lives in an availability zone, which lets you spread load and tolerate the failure of a zone.
- Internet Gateway: the component that connects the VPC to the internet. It is highly available and scales on its own. A subnet becomes public when its route table points to it.
- NAT Gateway: lets resources in private subnets reach the internet —for updates or API calls— without being reachable from outside. It only enables outbound traffic initiated from inside.
- Route tables: define where each subnet’s traffic goes. In practice, they are what determines whether a subnet is public or private.
- Security groups and NACLs: the two access-control layers, which we cover in detail below.
Public subnet versus private subnet
The distinction between public and private subnets is one of the most important, and it does not depend on the subnet itself but on its route table:
| Public subnet | Private subnet | |
|---|---|---|
| Route to internet | Through the Internet Gateway | No direct route; outbound via NAT Gateway |
| Reachable from internet | Yes, if rules allow it | No |
| What it usually hosts | Load balancers, bastion hosts | Databases, application servers |
| Role in the architecture | Controlled entry point | Protected inner zone |
The usual pattern is a load balancer in the public subnet that receives user traffic and forwards it to the application servers and databases, which live in private subnets and are never exposed directly.
Security groups and NACLs: the two control layers
AWS offers two traffic-filtering mechanisms, and it pays not to confuse them because they operate at different levels:
| Security group | NACL (Network ACL) | |
|---|---|---|
| Level | Instance (resource) | Subnet |
| Behavior | Stateful: the response is admitted on its own | Stateless: each direction allowed explicitly |
| Rules | Allow only | Allow and deny |
| Typical use | Primary access control | Additional subnet-level layer |
A security group is stateful: if you allow an outbound connection, the inbound response is admitted automatically. It acts as a firewall around each resource. A NACL is stateless: it does not remember connection state, so each direction of traffic must be allowed separately, and it acts on the whole subnet. In most architectures, security groups are the primary control and NACLs add an extra layer of defense.
Connecting the VPC to other networks
A VPC rarely lives fully isolated. To connect it with other environments, AWS offers several options:
- VPC peering: connects two VPCs privately, useful when two networks must communicate without going out to the internet.
- Transit Gateway: acts as a hub interconnecting many VPCs and on-premises networks, ideal when the topology grows.
- VPN and Direct Connect: link the VPC to the company datacenter, a key component in hybrid cloud scenarios and during a migration.
The VPC as the foundation of security and compliance
For banking, insurance, or healthcare companies, VPC design is not a technical detail: it is the foundation on which data isolation, environment segmentation, and much of the compliance requirements rest. A well-designed network —with private subnets for data, least-privilege access, and traceability— is what lets you pass an audit with confidence.
At Caleidos we design network architecture as part of our Cloud Foundations practice, establishing the base of VPC, subnets, and access controls on which applications later grow, with the security and compliance lens that regulated sectors demand. When the starting point is an on-premises datacenter, that network design is also the first step of an orderly AWS migration.
Frequently asked questions
What is a VPC in simple terms? Your private, isolated network inside AWS: you define the IP range, split it into subnets, and control what is public and what stays protected.
Public or private subnet? It is public when its route table points to the Internet Gateway; private when it has no such route and reaches the internet, if needed, through a NAT Gateway.
Security group or NACL? The security group is stateful and acts per resource; the NACL is stateless and acts per subnet. They are used as complementary layers.
Are you designing your network on AWS?
Let’s talk about your case and we will help you design a secure, well-segmented VPC, with the right foundation to grow without rebuilding it later.
