AWS Certified Cloud Practitioner
Amazon VPC Fundamentals
Understand what an Amazon VPC is and how its building blocks fit together: subnets, IP addressing, route tables, internet gateways, and NAT gateways.
- Define what an Amazon VPC is and how it isolates your AWS resources
- Explain the role of CIDR blocks and subnets, including the difference between public and private subnets
- Describe how route tables, internet gateways, and NAT gateways direct traffic
- Identify what the default VPC provides
Why this matters
Almost every AWS service you run on servers lives inside a network. Amazon Virtual Private Cloud (Amazon VPC) is that network. It is where your EC2 instances, databases, and load balancers get their private addresses and where you decide what can talk to what.
On the CLF-C02 exam you do not configure a VPC by hand. You need to recognize the building blocks, know what each one does, and tell a public subnet from a private one. This lesson builds that mental model so the security and connectivity lessons that follow make sense.
What a VPC is
A VPC is a logically isolated virtual network that you define in the AWS Cloud. It looks and behaves like a traditional network in your own data center, but it runs on AWS infrastructure that you can scale on demand.
"Isolated" is the key word. Your VPC is private to your account. Other AWS customers cannot see into it, and nothing reaches your resources unless you set up a path and allow it. A VPC lives in one AWS Region and can stretch across all the Availability Zones in that Region.
Subnets and Availability Zones
A subnet is a range of IP addresses inside your VPC. You launch resources, such as EC2 instances, into subnets. Each subnet sits in exactly one Availability Zone, so a single subnet never spans two zones.
Because a VPC covers a whole Region, you usually create subnets in several Availability Zones and spread your resources across them. If one zone has a problem, the resources in the other zones keep running. This is the foundation of high availability on AWS.
Subnets come in two flavors based on how their traffic is routed:
- A public subnet can reach the internet directly. Its route table sends internet-bound traffic to an internet gateway, and resources in it can have public IP addresses. Web servers and load balancers usually live here.
- A private subnet has no direct route to the internet. Databases and application servers usually live here, protected from direct exposure.
Nothing about the subnet's name, size, or zone makes it public or private. The routing does.
IP addressing and CIDR
When you create a VPC, you give it a range of IP addresses written in CIDR notation, such as 10.0.0.0/16. CIDR is just a compact way to describe a block of addresses. A smaller number after the slash means a bigger block: a /16 holds far more addresses than a /24.
Each subnet takes a slice of the VPC's range, for example 10.0.1.0/24 for one subnet and 10.0.2.0/24 for another. Most resources use private IPv4 addresses that are not reachable from the internet. A resource needs a public IPv4 address (or an IPv6 address) only when it must be reached directly over the internet.
When you connect a VPC to your own network later, the address ranges must not overlap. That is why teams plan their CIDR blocks carefully before they build.
Route tables
A route table is a set of rules, called routes, that decide where traffic goes. Each route pairs a destination (a CIDR block) with a target (where to send traffic for that destination).
Every subnet is associated with a route table. A route for the subnet's own VPC range is always present, so resources inside the VPC can talk to each other by default. To reach anything outside the VPC, you add a route that points at a gateway. For example, a route that sends 0.0.0.0/0 (all other traffic) to an internet gateway is what makes a subnet public.
Internet gateway and NAT gateway
These two components both deal with internet traffic, but they are not the same, and the exam likes to test the difference.
An internet gateway connects your VPC to the internet. It allows resources in a public subnet that have a public IP address to send and receive internet traffic in both directions. You attach one internet gateway to a VPC.
A NAT gateway lets instances in a private subnet start outbound connections to the internet, for example to download patches, while stopping the internet from starting connections back to them. You place a NAT gateway in a public subnet and point the private subnet's route table at it. Unlike the VPC and internet gateway, a NAT gateway has an hourly charge plus a data processing charge.
| Component | Direction | Where it sits | Typical use |
|---|---|---|---|
| Internet gateway | Inbound and outbound | Attached to the VPC | Public subnets reach the internet both ways |
| NAT gateway | Outbound only | In a public subnet | Private subnets reach the internet for updates, stay unreachable from it |
The default VPC
Every AWS account comes with a default VPC in each Region, already set up with subnets, a route table, and an internet gateway. This is why you can launch an EC2 instance and reach it without building a network first.
The default VPC is convenient for learning and quick tests. For real workloads, teams usually create their own VPCs so they control the address ranges, subnet layout, and routing from the start.
Exam tips
- A VPC is a logically isolated virtual network in one Region; it can span all the Availability Zones in that Region.
- A subnet lives in one Availability Zone. Spread subnets across zones for high availability.
- Public versus private is decided by routing: a route to an internet gateway makes a subnet public.
- Internet gateway = two-way internet access for public subnets. NAT gateway = outbound-only internet access for private subnets.
- There is no charge for the VPC itself, but a NAT gateway costs money per hour and per gigabyte processed.
- Plan non-overlapping CIDR ranges, especially before you connect a VPC to another network.