Amazon Virtual Private Cloud (VPC) is a private virtual network in AWS. You choose its address space and configure subnets, routing tables, network access control lists (NACLs), and gateways. “Private” does not mean nothing can reach the internet: connectivity depends on the routes and gateways you configure. section 5.5
Separate resources by what must be reachable. A public subnet has a route to the internet and can hold an internet-facing proxy or load balancer. A private subnet has no such route and can hold backend servers or databases. Keep systems private when they do not need direct public access; use security groups and NACLs to further control traffic. section 5.5 section 5.6
A web application network
Start with a VPC using 10.0.0.0/16. Define two public subnets—10.0.0.0/24 for a NAT gateway and 10.0.1.0/24 for a proxy—and a private backend subnet, 10.0.2.0/24. Describe the VPC and subnets with CloudFormation. Requests reach the backend through the public proxy, not directly from the internet; the NAT gateway can provide internet access from private subnets. section 5.5 section 5.6
The three-subnet diagram shows where the public proxy, NAT gateway, and private backend sit in the VPC. section 5.5
A VPC can also connect to a company network through a VPN. For example, an enterprise application can place its application servers and SQL database in separate subnets, restrict database traffic, and serve clients connected from a local data center. section 1.2.2
Account for service and availability boundaries. A Lambda function runs outside your VPC by default; to reach an internal resource, configure its VPC, subnets, and security groups, adding complexity. A VPC belongs to one region, and each subnet to one availability zone. If an EC2 instance fails over to another zone and subnet, it cannot retain the same private IP address. section 6.2.4 section 13.2.4
