ACKF logoACKF
Networking and Content Delivery

Amazon VPC

View on GitHub

Amazon VPC

Amazon VPC provides a logically isolated virtual network in an AWS Region where you launch AWS resources. It delivers CIDR-based addressing, subnets, route tables, and network security primitives to control traffic and connectivity within and between AWS environments.

🗂 Resource Category

Networking and Content Delivery • Security, Identity, and Compliance

🧠 Exam Memory Hook

Think: "Isolated virtual network + subnets, route tables, and security controls = Amazon VPC"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and maintains the physical network infrastructure, regional VPC control plane, and underlying routing fabric that enable VPCs; AWS is responsible for the availability and security of the physical infrastructure and the managed control plane and patches those components.

Customer responsibilities: The customer configures VPC CIDR blocks, subnets, route tables, internet gateways, NAT gateways, VPC endpoints, security groups, network ACLs, peering or Transit Gateway attachments, VPN/Direct Connect configurations, and monitors traffic and access; the customer secures guest operating systems, applications, and data running in resources deployed into the VPC, and maintains those resources.

Patching responsibilities: AWS patches and maintains the physical infrastructure and the VPC control plane; for compute resources deployed into a VPC (for example Amazon EC2), AWS patches the hypervisor and underlying infrastructure while the customer patches guest operating systems, application runtimes, libraries, dependencies, and customer-deployed applications; managed runtime patching is not applicable to the network service itself.

🏗 Typical Architecture

💡 Top 5 Features

  • Provision logically isolated virtual networks using configurable CIDR ranges and subnets.
  • Control routing with route tables, route propagation, and internet/NAT gateway attachments for subnet-level connectivity.
  • Apply virtual network security using stateful security groups and stateless network ACLs at instance and subnet levels.
  • Create private connectivity to AWS services using VPC endpoints (interface and gateway) without traversing the public internet.
  • Establish VPC-to-VPC or on-premises connectivity using VPC peering, AWS Transit Gateway, and VPN/Direct Connect attachments.

✅ Top 5 Use Cases

  • Host multi-tier applications with public-facing web tier in public subnets and private application and database tiers in private subnets.
  • Provide secure private access to AWS services from within a VPC using VPC endpoints to avoid internet egress.
  • Connect multiple VPCs and on-premises networks for hybrid cloud architectures using Transit Gateway or VPN/Direct Connect.
  • Segment and isolate tenant or workload networks within an account using multiple VPCs, subnets, and security controls.
  • Control and monitor network traffic flows and perform forensics using VPC Flow Logs alongside logging and monitoring services.

🏗 Architecture Placement

Amazon VPC is a regional, account-level virtual network that contains AWS resources such as EC2 instances, load balancers, and managed databases; internet traffic typically enters via an Internet Gateway and internal or cross-account traffic arrives via peering or Transit Gateway attachments. Resources inside the VPC use route tables, security groups, and NACLs to control traffic and can use VPC endpoints to reach AWS services privately. VPCs are created per AWS account and region and connect to on-premises networks via VPN or Direct Connect when configured.

🎯 Commonly Used With

- Amazon EC2
- AWS Transit Gateway
- Amazon Route 53
- AWS Identity and Access Management
- Amazon CloudWatch

🌍 5 Real-World Examples

  • Banking: deploy a three-tier application where web servers run in public subnets and customer data stores run in private subnets to enforce network isolation and compliance controls.
  • Healthcare: isolate electronic health record systems in private subnets with tightly scoped security groups and VPC endpoints to access storage without public internet exposure.
  • Retail: host an e-commerce frontend in public subnets behind an ALB while backend order processing and databases run in private subnets with restricted outbound access.
  • Telecommunications: interconnect multiple VPCs across accounts using Transit Gateway to provide shared services and centralised routing for operational teams.
  • Education: provide research clusters in dedicated VPCs with controlled internet egress and VPC endpoints to access data lakes stored in Amazon S3.

🎓 AWS Exam Clues

  • Use security groups for instance-level, stateful filtering and network ACLs for subnet-level, stateless filtering.
  • Choose VPC endpoints to access AWS service APIs privately without sending traffic over the public internet.
  • Use Transit Gateway when you need scalable many-to-many connectivity between multiple VPCs and on-premises networks instead of numerous peering links.
  • Design subnets across Availability Zones for high availability and place stateful resources behind appropriate routing and NAT where required.
  • VPC is regional and provisioned per account, so cross-account or cross-region connectivity requires peering, Transit Gateway, or other bridging solutions.

📝 Quick Revision

Amazon VPC is the regional, account-scoped virtual network that hosts AWS resources and controls routing, subnet placement, and network security. Use it for network isolation, private connectivity, and controlling internet or on-premises access; plan subnets, AZ placement, security group rules, and monitoring with VPC Flow Logs.

🏷 Keywords

VPC • CIDR • Subnet • Route table • Internet Gateway • NAT Gateway • Security Group • Network ACL • VPC Endpoint • VPC Peering • Transit Gateway • VPC Flow Logs