What is a VPC and why is it important in AWS?
Learn what an AWS VPC is, how subnets, gateways, and security groups isolate your cloud network, and why it matters for secure architecture.
Expected Interview Answer
A VPC (Virtual Private Cloud) is a logically isolated virtual network within AWS where you launch resources into an IP address range you control, giving you full command over subnets, routing, and security boundaries.
You define a CIDR block for the VPC, then carve it into public and private subnets across Availability Zones. Route tables, internet gateways, NAT gateways, security groups, and network ACLs together decide what traffic can reach each resource. A VPC gives you a private, tenant-isolated slice of the AWS network so instances are not exposed to the public internet unless you explicitly allow it.
- Network isolation between workloads and tenants
- Fine-grained control over IP ranges and subnetting
- Public/private subnet separation for security
- Layered security via security groups and network ACLs
- Private connectivity to on-prem via VPN or Direct Connect
AI Mentor Explanation
A VPC is like a private cricket ground your club leases inside a huge sports complex: the outer boundary is your CIDR block, the pitch and practice nets are subnets, and the gatekeeper deciding who walks in is your security group. Nobody wanders onto your field unless you open a gate.
Step-by-Step Explanation
Step 1
Choose a CIDR block
Pick a private IP range like 10.0.0.0/16 that gives enough addresses and avoids overlap with other networks you may peer or connect to.
Step 2
Create subnets across AZs
Split the CIDR into public and private subnets spread over multiple Availability Zones for high availability.
Step 3
Attach an internet gateway
Add an internet gateway and a route so public subnets can send and receive traffic from the internet.
Step 4
Add a NAT gateway
Place a NAT gateway in a public subnet so private-subnet instances can reach the internet outbound without being publicly reachable.
Step 5
Configure security controls
Use security groups (stateful, per-resource) and network ACLs (stateless, per-subnet) to allow only required traffic.
What Interviewer Expects
- Clear definition of network isolation in the cloud
- Understanding of CIDR blocks and subnetting
- Public vs private subnet design and NAT gateways
- Difference between security groups and network ACLs
- Awareness of multi-AZ high availability
Common Mistakes
- Confusing security groups (stateful) with network ACLs (stateless)
- Thinking a private subnet needs an internet gateway instead of a NAT gateway
- Choosing overlapping CIDR blocks that break VPC peering
- Assuming a VPC spans multiple regions (it is region-scoped)
Best Answer (HR Friendly)
“A VPC is your own private, walled-off network inside AWS. You decide which resources are public-facing and which stay hidden, and you control exactly what traffic is allowed in and out, so your cloud systems stay secure and organized.”
Code Example
# Create a VPC with a /16 CIDR block
aws ec2 create-vpc \
--cidr-block 10.0.0.0/16 \
--tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=app-vpc}]'
# Create a public subnet in one Availability Zone
aws ec2 create-subnet \
--vpc-id vpc-0abc123 \
--cidr-block 10.0.1.0/24 \
--availability-zone us-east-1a
# Attach an internet gateway to the VPC
aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway \
--vpc-id vpc-0abc123 \
--internet-gateway-id igw-0def456Follow-up Questions
- What is the difference between a security group and a network ACL?
- How does a NAT gateway differ from an internet gateway?
- How would you connect two VPCs together?
- Why must a VPC CIDR not overlap with a peered VPC?
MCQ Practice
1. Which component lets instances in a private subnet initiate outbound internet traffic without being publicly reachable?
A NAT gateway allows outbound-only internet access for private-subnet instances, while an internet gateway would make them publicly reachable.
2. Security groups in AWS are:
Security groups are stateful and attach to resources like ENIs/instances; return traffic is automatically allowed. Network ACLs are stateless and apply per subnet.
3. A VPC is scoped to:
A VPC is a regional construct; its subnets can span multiple Availability Zones within that one Region.
Flash Cards
What is a VPC? — A logically isolated virtual network in AWS where you control IP ranges, subnets, routing, and security.
Public vs private subnet — A public subnet has a route to an internet gateway; a private subnet does not and typically reaches the internet via a NAT gateway.
Security group vs network ACL — Security groups are stateful and per-resource; network ACLs are stateless and per-subnet.
VPC scope — A VPC lives in a single Region but can span multiple Availability Zones through its subnets.