Introduction

Introduction to Amazon VPC

ℹ️ What is Amazon VPC?
Amazon Virtual Private Cloud (Amazon VPC) is a service that lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. Within this private virtual network, you define and launch AWS resources (such as Amazon EC2, Amazon ECS/EKS, and Amazon RDS) with complete control over your network configuration.

Amazon VPC combines the familiar controls and segmentation of a traditional on-premises data center network with the extreme scalability, high availability, and hardware-accelerated performance of the AWS Nitro System.

Key Capabilities in Modern VPC Networking

With Amazon VPC, you have fine-grained control over your cloud networking topology:

  • Flexible IP Address Management: Support for primary and secondary IPv4 CIDR blocks, native IPv6 CIDR allocations, and automated management using Amazon VPC IP Address Manager (IPAM).
  • Granular Network Segmentation: Subdivision into public, private, isolated, and IPv6-only subnets across multiple Availability Zones (AZs).
  • Advanced Routing & Gateways: Complete routing control using route tables, Internet Gateways (IGW), Egress-Only Internet Gateways (for IPv6), and NAT Gateways.
  • Hybrid & Multi-VPC Interconnectivity: Seamless connections via AWS Site-to-Site VPN, AWS Direct Connect, VPC Peering, AWS Transit Gateway, and AWS Cloud WAN.
  • Modern Application Networking: Service-to-service connectivity and governance without network complexity using Amazon VPC Lattice.
  • Multi-Layer Zero-Trust Security: Defense-in-depth via stateful Security Groups, stateless Network ACLs (NACLs), AWS Network Firewall.

VPC Architecture & IP Addressing Fundamentals

🔒 Isolation & Scope
Each VPC is logically isolated from other virtual networks in the AWS Cloud. A VPC spans all Availability Zones (AZs) within that Region.

1. IP Address Ranges (CIDR Blocks)
  • Size Boundaries: An individual IPv4 CIDR block can range from /16 (65,536 addresses) down to /28 (16 addresses).
  • Primary & Secondary CIDR Association: While a VPC’s primary CIDR block cannot be modified after creation, you can expand your VPC by associating up to 4 IPv4 secondary CIDR blocks.
  • Non-Overlapping Requirement: VPC CIDR blocks must not overlap with connected on-premises subnets, peered VPCs, or transit networks.
2. Modern IPv4 Economics & IPv6 Strategy

⚠️ Public IPv4 Pricing Shift
Starting February 1, 2024, AWS charges for all public IPv4 addresses ($0.005/hour per IP). This industry shift makes modern network architecture practices essential:

  • Private-First Topologies: Keeping workloads in private subnets and routing outbound traffic through shared NAT Gateways or IPv6 egress.
  • AWS PrivateLink / VPC Endpoints: Communicating directly with AWS services privately without needing public IPs or traversing the public internet.
  • IPv6-Only & Dual-Stack Subnets: Leveraging IPv6 (/56 allocation per VPC, /64 per subnet) with NAT64 and DNS64 to eliminate public IPv4 address overhead.
3. Amazon VPC IP Address Manager (IPAM)

💡 Automated IP Governance
VPC IPAM allows organizations to plan, track, and monitor IP address allocations across multiple AWS accounts and Regions under AWS Organizations, eliminating CIDR conflicts and spreadsheets.

Every AWS account and Region includes a Default VPC configured with a CIDR block of 172.31.0.0/16 and a public subnet in each Availability Zone for immediate testing.

💡 Pro Tip
For production environments, always create Custom VPCs. Custom VPCs allow you to implement the Principle of Least Privilege, define multi-tier subnet architectures (e.g., Public, Application, Database), avoid CIDR conflicts with corporate networks, and enforce zero-trust security controls.

VPC Security & Observability Ecosystem

  1. Security Groups: Stateful virtual firewalls operating at the instance/ENI level, evaluating rules before traffic enters or exits.
  2. Network ACLs (NACLs): Stateless subnet-level packet filters that inspect ingress and egress traffic based on numbered rules.
  3. VPC Flow Logs: Capture IP traffic metadata (including accepted/rejected packets, TCP flags, and transit gateway IDs) published directly to Amazon CloudWatch Logs, Amazon S3, or Amazon Kinesis Data Firehose.
  4. VPC Reachability Analyzer: Perform automated formal verification of network connectivity paths between AWS resources without sending actual network packets.

In the upcoming sections of this workshop, we will dive deep into hands-on configurations for Subnets, Route Tables, Internet Gateways, NAT Gateways, and AWS Site-to-Site VPN connections.