Learn
AWS
Networking & content delivery
VPC

AWSGCP laterAzure later

VPCAmazon Virtual Private Cloud

Networking & content deliveryCore service · full depthChecked against AWS docs · 15 Sept 2026

Your own private network in AWS: its address range, a subnet in each Availability Zone, and the rules for what reaches what.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalHIGHDeveloper – AssociateLOWSysOps Administrator – AssociateHIGHSecurity – SpecialtyHIGHData Engineer – AssociateLOW

Where VPC takes you6 steps, all open

I know the problem it solves
I can picture it
I know how it scales
I know when to choose it
I can use it in a design
I can answer an exam question

What & why

The network everything else is launched into

A VPC is your own logically isolated network in AWS. You choose its address range, cut it into subnets, and the instances, databases and load balancers you launch go into those subnets.

A subnet's route table decides what it is. A subnet with a route to an internet gateway is public. One without is private, and needs a NAT device to reach the internet. Anything that should not be reached from the internet belongs in a private subnet.

Security groups, network ACLs, internet gateways and gateway endpoints cost nothing extra. NAT gateways and public IPv4 addresses are charged.

Reach for it when

resources must not be reachable from the internet: private subnets
the design must survive the loss of an Availability Zone: subnets in two or more
instances must reach S3 or DynamoDB privately: a gateway endpoint
you need a record of the traffic: flow logs

Know its limits

a subnet lives in one Availability Zone and cannot span zones
peering is not transitive: A to B and A to C does not connect B and C
peered VPCs cannot have overlapping CIDR blocks
a peered VPC cannot use your internet gateway, NAT device or VPN

Mental model

An office campus

The campus has its own address plan. Each building stands on one site, and a sign at its door says where each road leads; a building with a sign to the main gate is public. A guard at every office door remembers who went out and lets their replies back in. A checkpoint at the building entrance checks everyone, both ways, against a numbered list, and remembers nobody.

The campusthe VPC and its address planCIDR block

A building on one sitea subnet in one Availability ZoneSubnet

The signs at the doorwhere traffic may goRoute table

The main gatethe way to the internetInternet gateway

The guard at an office doorremembers, allows onlySecurity group

The checkpoint at the entrancea numbered list, both ways, no memoryNetwork ACL

How it works

From an address range to a working network

Pick a rangeAn IPv4 CIDR block from /16 to /28, ideally from the private ranges. You can add more blocks later, but not resize one.
Cut subnetsEach subnet sits in one Availability Zone. AWS reserves five addresses in every subnet.
RouteEvery subnet has a route table. A route to an internet gateway makes it public; a route to a NAT device lets a private one get out.
FilterSecurity groups on each resource and network ACLs on each subnet decide what traffic is let through.

VPC or subnet size: /16 – /2865,536 to 16 addresses
Reserved per subnet: 5the first four and the last
Subnet scope: 1 AZcannot span zones
Network ACL rules: 1 – 32766lowest number first; the first match decides
Peering: 1 : 1not transitive

Security group

applies to the resources it is attached to
allow rules only
stateful: a reply to allowed traffic is always let back
all rules are evaluated together
can name another security group as the source

Network ACL

applies to a whole subnet; each subnet has exactly one
allow and deny rules
stateless: a reply needs its own rule
rules checked in number order; the first match decides
the default one allows everything, in and out

Architecture

Three tiers across two zones

Only the load balancer is in the public subnets; everything else sits in private ones, with the standby database in the second zone.

The load balancer is the only thing in the public subnets. The app servers sit in private subnets in two zones and accept traffic only from the load balancer's security group. The database is in its own private subnets and accepts traffic only from the app servers' security group. Backups reach S3 through a gateway endpoint, so they need no NAT gateway and add nothing to the bill for it.

Traffic simulation

Follow a packet from an instance to the internet and back

Security group, outbound
A new security group allows all outbound traffic until you change it.
Network ACL, outbound
The subnet's rules, lowest number first. The first match decides.
Route table
Is there a route for this destination? For the internet, it has to point at an internet gateway.
A public address
The internet gateway translates the instance's private address to its public IPv4 or Elastic IP address.
The reply: network ACL, inbound
Stateless: the reply needs a rule of its own, usually for the ephemeral ports.
The reply: security group
Stateful: a reply to traffic it let out is always let back in.

Pick a case to follow the packet through each check.

Security

Layers, and what they do not cover

Security groups first. They are the main control, and a rule can name another security group, so the database accepts only the app tier and the app tier only the load balancer. Network ACLs are a coarser second layer for a whole subnet, useful for denying a specific range of addresses.

What neither filters. Security groups and network ACLs do not filter traffic to the Amazon DNS server, DHCP, the instance metadata service or the Amazon Time Sync Service.

Flow logs record the IP traffic going to and from network interfaces, and publish it to CloudWatch Logs, S3 or Data Firehose. They are collected outside the path of your traffic, so they never slow it down.

Keep it private. Put anything that should not be reached from the internet in private subnets, and reach AWS services through VPC endpoints rather than over the internet.

Cost

What is free, and what runs by the hour

Free to use: security groups, network ACLs, internet gateways and gateway endpoints cost nothing extra.

Charged: every NAT gateway, by the hour and by the gigabyte it processes; every public IPv4 address, by the hour; and data sent over a peering connection between Availability Zones, in both directions.

Flow logs are charged as vended logs, for ingesting and storing them at their destination.

Keep traffic off the meters. A gateway endpoint takes S3 and DynamoDB traffic off the NAT gateway.

Prices change, so none are printed here. Check the VPC pricing page on aws.amazon.com.

Comparison

Four kinds of subnet, told apart by their routes

Subnet	Its route table	The internet	Use it for
Public	A route to an internet gateway	Both ways, for resources with a public address	Load balancers, NAT gateways
Private	No route to an internet gateway	Out only, through a NAT device	App servers and databases
VPN-only	A route to a Site-to-Site VPN through a virtual private gateway	None	Systems only your own network should reach
Isolated	No routes outside the VPC	None	Resources that talk only within the VPC

SAA traps

The phrase in the question, and what it means

must not be reachable from the internet, but must download patchesA private subnet with a route to a NAT gateway

Out through the NAT gateway; nothing can start a connection in.

block traffic from one malicious IP addressA network ACL deny rule

Security groups can only allow. They cannot deny.

responses to outbound requests are being droppedA network ACL with no inbound rule for the replies

Network ACLs are stateless; a security group would have let the reply back.

VPC B and VPC C are both peered with VPC A but cannot talkPeering is not transitive

Peer B and C directly, or connect all three through a transit gateway.

reach S3 from a private subnet without a NAT gatewayA gateway endpoint for S3

No extra charge; it adds a route using the S3 prefix list.

web servers should accept traffic only from the load balancerReference the load balancer's security group

The rule follows whatever the load balancer's addresses are.

how many addresses can you use in a /24 subnet251

256 minus the five AWS reserves in every subnet.

see which connections a security group rejectedVPC Flow Logs

They record the IP traffic to and from each network interface.

Scenario

Exam style, marked when you answer

A company is moving a three-tier web application into a new VPC across two Availability Zones. Customers must reach the web tier only through an Application Load Balancer. The application servers and the database must not be reachable from the internet, but the application servers must call a partner's API on the internet. Which design meets these requirements?

Practice

Fill the gap, the way the challenges work

Instances in a private subnet must write nightly backups to S3. There is no NAT gateway, and the traffic must not go out through an internet gateway. What goes in the gap?

EC2· App serverPick a service belowS3· Backups

Quick revision

The night before the exam

Size: /16 to /28, for a VPC or a subnet.
Reserved: Five addresses in every subnet: the first four and the last.
Public or private: Decided by the route table: a route to an internet gateway makes it public.
Security group: Allow only, stateful, on the resource.
Network ACL: Allow and deny, stateless, on the subnet, lowest number first.
Peering: One to one, not transitive, no overlapping CIDR blocks.
Gateway endpoint: S3 and DynamoDB, a route in the table, no extra charge.

Next: EC2Virtual machines you choose, size and run yourself: the most flexible compute on AWS, and the most work.

Open EC2

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.