What Is a VPC?
How a Virtual Private Cloud Works
A virtual private cloud, or VPC, is a logically isolated section of a public cloud provider's network that belongs to one customer. Resources placed inside it, such as virtual servers and databases, can communicate privately with each other and reach the internet only through paths the customer configures.
A VPC is defined by a private IP address range, usually written in CIDR notation. For example, 10.0.0.0/16 provides a large block of private addresses. That range is divided into smaller ranges called subnets, and each subnet is often tied to a single availability zone within the region.
Public and Private Subnets, Route Tables and Security Groups
A public subnet has a route to an internet gateway, so resources in it can be reached from the internet if they have public addresses. A private subnet has no such route, which suits databases and internal services that should not be directly reachable. Resources in private subnets can still make outbound connections, for example through a NAT gateway, which allows traffic out but not unsolicited traffic in.
A route table holds the rules that decide where network traffic goes. Security groups are virtual firewalls attached to resources; they allow or deny traffic by protocol, port and source. Providers use different names for these tools, such as network security groups or firewall rules, but the concepts are similar.
A common pattern places a web server in a public subnet and a database in a private subnet, so that only the web tier receives traffic from the internet.
Example: A Web Application Inside a VPC
A small application might use one VPC with two public subnets for its load balancers and two private subnets for application servers and the database, with each pair placed across two availability zones. Users reach the site only through the load balancer. The database accepts connections only from the application servers' security group.
If the application needs to download updates, its private servers reach the internet through a NAT gateway rather than having public addresses of their own.
Frequently asked questions
Is a VPC the same as a VPN?
No. A VPC is a private network inside a cloud provider. A VPN, or virtual private network, is an encrypted tunnel that connects a device or office network to another network over the internet. The two are often used together, for example when an office network connects securely to resources inside a VPC.
Do I need to create my own VPC to use cloud services?
Many platforms create a default network so you can start quickly, but production systems usually benefit from defining their own VPC. This lets you control address ranges, subnets and access rules, which helps with security and with connecting to other networks later. Securing these settings is part of the customer's role under the shared responsibility model.