Virtual Private Cloud (VPC)
An isolated virtual network inside a public cloud where you control IP ranges and routing.
Last reviewed: July 25, 2026
What is a VPC?
A VPC is your private slice of cloud network infrastructure. You define IP CIDR blocks, subnets, route tables, gateways, and security rules — similar to a traditional data center LAN, but software-defined.
Building blocks
| Component | Purpose |
|---|---|
| Subnet | Segment VPC by availability zone or tier (public/private) |
| Internet Gateway | Public subnet access to/from internet |
| NAT Gateway | Private subnets outbound internet without inbound |
| Security Group / NACL | Firewall rules at instance and subnet level |
| Peering / Transit Gateway | Connect VPCs or on-premises via VPN/Direct Connect |
Public vs private subnets
- Public — resources with public IPs (load balancers, bastion hosts)
- Private — app servers and databases with no direct internet ingress
Multi-account patterns
Enterprises often use one VPC per environment (dev/staging/prod) or per team, connected via hub-and-spoke networking and centralized egress.
VPC in SaaS
Vendor single-tenant offerings sometimes deploy into a VPC dedicated to one customer or peer with the customer’s VPC for private integration.
Avoiding overlap
When peering VPCs or connecting to on-prem, non-overlapping CIDR ranges (e.g., 10.0.0.0/16 vs 10.1.0.0/16) prevent routing conflicts.
Cost reality
The VPC is free; the traffic isn’t. NAT gateway data processing is the notorious line item — private subnets pulling container images or S3 data through NAT can cost thousands monthly, fixed by VPC endpoints. Cross-AZ traffic between chatty services is the other silent charge; co-locate chatty pairs or accept the tax knowingly.
What people get wrong
- 10.0.0.0/16 everywhere. Overlapping CIDRs make future VPC peering and VPN connections painful-to-impossible; plan address space like it’s forever, because it is.
- Public subnets by default. Databases with public IPs remain a leading breach cause; default private, expose only load balancers.
- Security groups nobody can explain. Rules accrete; “why is 0.0.0.0/0:22 open” should have an answer and an owner. Review quarterly.
What Makes a VPC “Virtual” and “Private”
The “virtual” in VPC refers to the fact that the network exists as a software-defined construct within the cloud provider’s physical infrastructure, rather than requiring dedicated physical network hardware — the provider’s underlying infrastructure implements the actual routing, isolation, and addressing logic, while presenting customers with what looks and behaves like a traditional private network they fully control. The “private” designation reflects that a VPC’s address space and internal traffic are isolated from other customers’ VPCs by default, even though many VPCs from different customers may run on shared underlying physical infrastructure — this isolation, combined with the customer’s own control over subnetting, routing, and security group configuration, is what makes the “virtual private cloud” abstraction functionally equivalent to owning private network infrastructure, without any of the physical hardware management that would otherwise require.
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.