TOPIC CLOUD
VPC your private network in the cloud
IN 10 SECONDS
A Virtual Private Cloud (VPC) is an isolated network within a cloud region. You define an IP address range (CIDR), create subnets across Availability Zones, and control traffic with route tables, network ACLs, and security groups. Nothing enters or leaves without explicit permission.
GOTCHA Security groups are stateful — if you allow inbound, the response is automatically allowed. NACLs are stateless — you need explicit rules for both directions or traffic is dropped.
HOW TRAFFIC FLOWS THROUGH A VPC
01 Internet gateway attaches to the VPC and provides a target for public subnet routes.
02 Public subnet has a route table entry pointing `0.0.0.0/0` to the IGW. Resources here can reach the internet and be reached (if security groups allow).
03 Private subnet routes to a NAT Gateway for outbound internet access but has no direct inbound path from the internet.
04 Security group acts as a stateful firewall at the ENI level — only allow rules, no deny rules. Traffic matching no rule is implicitly denied.
05 NACL a stateless firewall at the subnet level with explicit allow/deny rules for both inbound and outbound traffic.
POKE IT YOURSELF
aws ec2 describe-vpcs — list all VPCs in the region
aws ec2 describe-security-groups — inspect every security group and its rules
Drill this topic →
~80 sec read