Amazon Virtual Private Cloud
Your private network on AWS
A virtual private network you define (IP range, public/private subnets, route tables, gateways); EC2, RDS… live inside it.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsCLF · SAA · DVA · SOA
Think of it asLike a fenced plot of land: you divide it into lots (subnets) and place the gates (gateways).
Where does VPC fit?
Calls VPC
VPCA real example, step by step
- You're building infrastructure for a web app and want the database never to be exposed to the internet.
- You create a VPC with the 10.0.0.0/16 range and split it into public and private subnets across 2 AZs.
- The load balancer sits in the public subnets; app servers and the database sit in private subnets with no public IPs.
- Private instances download patches through a NAT Gateway and write to S3 through a gateway VPC endpoint, never over the internet.
- A security group lets the database accept connections only from the app servers on port 5432; everything else is blocked.
When to use it
✓ Use it when
Always: every resource that runs in a network needs a VPC.
Common uses
- Private network for every EC2, RDS, ECS workload
- Separate public subnets (ALB) from private ones (app, database)
- Connect back to on-prem via VPN or Direct Connect
VPC, ELB or WAF?
| VPC |  ELB |  WAF | |
|---|---|---|---|
| What it does | Private network: subnets, routes, firewalls | Receives and spreads traffic to the app | Filters malicious HTTP requests |
| Protects at | The network layer (IPs, ports) | Not mainly a security tool | The application layer (HTTP) |
| Main tools | Security groups, network ACLs | Health checks, listeners | Web ACLs, managed rules |
| Cost | VPC is free; NAT and endpoints cost | Hourly + capacity used | Per ACL, rule and request |
What does it cost?
- Pricing model: VPC, subnets, route tables, security groups: free. Billed: NAT Gateway (~$0.045/hour + $0.045/GB processed), public IPv4 (~$0.005/hour per IP), interface endpoints (~$0.01/hour per AZ), cross-AZ data transfer (~$0.01/GB each way).
- Free tier: The VPC itself is free.
NAT Gateway is the classic trap: containers/Lambda downloading data from S3 through NAT → use a Gateway Endpoint (free) for S3 and DynamoDB; public IPs cost money too.
Security groups are stateful with allow rules only; network ACLs are stateless with allow and deny rules. Private instances need the internet → a NAT Gateway in a public subnet. Call S3/DynamoDB without the internet → a gateway VPC endpoint.
Try real exam questions
1A company runs a web application on multiple Amazon EC2 instances in a VPC. The application needs to write sensitive data to an Amazon S3 bucket. The data cannot be sent over the public internet. Which solution will meet these requirements?
- ACreate a gateway VPC endpoint for Amazon S3. Create a route in the VPC route table to the endpoint.
- BCreate an internal Network Load Balancer that has the S3 bucket as the target.
- CDeploy the S3 bucket inside the VPC. Create a route in the VPC route table to the bucket.
- DCreate an AWS Direct Connect connection between the VPC and an S3 regional endpoint.
Show answer
Correct answer: A
Create a gateway VPC endpoint for S3 and add a route in the route table: EC2 writes to S3 without going over the internet. You can't put an S3 bucket inside a VPC, and an NLB can't target S3.
2You need to set up security for your VPC and you know that Amazon VPC provides two features that you can use to increase security for your VPC: Security groups and network access control lists (ACLs). You start to look into security groups first. Which statement below is incorrect in relation to security groups?
- AAre stateful: Return traffic is automatically allowed, regardless of any rules.
- BEvaluate all rules before deciding whether to allow traffic.
- CSupport allow rules and deny rules.
- DOperate at the instance level (first layer of defense).
Show answer
Correct answer: C
The incorrect statement is “support allow rules and deny rules”. Security groups only have allow rules; deny rules belong to network ACLs.
Frequently asked questions
What is the difference between a public and a private subnet?
A public subnet has a route to an Internet Gateway, so resources with a public IP can reach the internet directly. A private subnet has no such route; instances inside reach the internet through a NAT Gateway and can't be reached directly from the internet.
What is the difference between a security group and a network ACL?
A security group is attached to individual resources, only has allow rules and is stateful (return traffic is allowed automatically). A network ACL applies to a whole subnet, has both allow and deny rules and is stateless, so both directions must be opened.
Does a VPC cost anything?
The VPC itself, subnets and security groups are free. You pay for NAT Gateways (per hour and per GB), public IPv4 addresses, interface VPC endpoints, VPN, Transit Gateway and data that crosses AZs or goes out to the internet.
What do AWS exams ask about VPC?
Designing public and private subnets across multiple AZs, NAT Gateways, security groups versus NACLs, VPC endpoints to reach S3 or DynamoDB without the internet, VPC peering and Transit Gateway to connect VPCs, and Flow Logs to inspect traffic.