VPC: Networking Your Resources

A VPC (Virtual Private Cloud) is your own private, isolated slice of the AWS network, where you control IP ranges, subnets, and routing for everything you launch inside it.

Subnets: public vs. private

A VPC is divided into subnets, and each subnet is either:

• Public: has a route to an Internet Gateway, so resources in it can be reached from (and reach) the public internet directly.
• Private: has no direct route to the internet, used for things that should never be directly reachable, like a database.

VPC: 10.0.0.0/16
  Public subnet:  10.0.1.0/24   (web servers, load balancers)
  Private subnet: 10.0.2.0/24   (databases, internal services)

A common, secure pattern: put your load balancer and web servers in a public subnet, and your database in a private subnet that's only reachable from inside the VPC.

Route tables and the Internet Gateway

A route table is a set of rules deciding where network traffic from a subnet gets sent. What makes a subnet "public" isn't a special setting, it's simply that its route table sends 0.0.0.0/0 (all other traffic) to an Internet Gateway attached to the VPC:

Destination      Target
10.0.0.0/16       local
0.0.0.0/0         igw-0123456789

NAT Gateway: outbound internet for private subnets

Resources in a private subnet still often need outbound internet access (to download OS updates, call an external API), without being directly reachable from the internet. A NAT Gateway, placed in a public subnet, provides exactly that: private-subnet resources route outbound traffic through it, but nothing from the internet can initiate a connection back in.

Private subnet route table:
Destination      Target
10.0.0.0/16       local
0.0.0.0/0         nat-0123456789