Virtual Private Cloud

Definition

A Virtual Private Cloud (VPC) is a logically isolated, private network within a public cloud provider's infrastructure, giving customers control over IP address ranges, subnets, routing, and network access rules, similar to running a private data center network but on shared cloud hardware.

Overview

A VPC is the foundational networking construct for nearly every non-trivial cloud deployment. When a customer provisions resources — virtual machines, databases, load balancers — within a cloud provider, those resources live inside a VPC that defines their private IP address space (via CIDR blocks), how that space is divided into subnets (often one set of subnets per availability zone), how traffic is routed between subnets and to the internet, and what security boundaries apply. Despite running on the provider's shared physical infrastructure, a VPC is logically isolated from other customers' VPCs — traffic within one customer's VPC doesn't traverse another's network by default. Key building blocks within a VPC include public subnets (with a route to an internet gateway, for resources that need direct internet access) and private subnets (no direct route out, for databases and internal services, typically reaching the internet only via a NAT gateway for outbound-only access); route tables that determine how traffic flows between subnets and out to the internet or other networks; security groups and network ACLs that act as virtual firewalls controlling inbound/outbound traffic at the instance and subnet level; and peering or transit gateway connections that let VPCs communicate with each other, with on-premises networks (via VPN or Direct Connect), or across cloud accounts. VPCs matter because they let organizations replicate familiar enterprise network security patterns — tiered architectures (public web tier, private application tier, isolated data tier), least-privilege network access, and controlled internet egress — inside a cloud environment, rather than exposing every resource directly to the public internet. Nearly every cloud security and compliance framework assumes VPC-level network segmentation as a baseline control, making VPC design one of the first and most consequential decisions in any cloud architecture.

Key Concepts

• Logically isolated private network within a shared public cloud provider's infrastructure
• Customer-defined IP address ranges (CIDR blocks) and subnet layout
• Public subnets (internet-gateway routed) vs. private subnets (no direct inbound internet route)
• Route tables controlling traffic flow between subnets, gateways, and peered networks
• Security groups and network ACLs providing instance- and subnet-level firewalling
• VPC peering and transit gateways for connecting multiple VPCs or on-prem networks
• Subnets typically mapped to availability zones for fault-tolerant network design
• Foundational control assumed by most cloud security and compliance frameworks

Use Cases

Frequently Asked Questions

Related in Cloud