So far, we have launched servers (EC2) and stored files (S3). But where do those servers "live" at the network level? How do they communicate with each other securely and isolated from the rest of the world? The answer is the VPC, AWS's networking service. It's a topic that scares many beginners, but with the right analogies, it's perfectly understandable.

VPC stands for Virtual Private Cloud. It is your private and isolated network within AWS, where you place your resources (EC2 instances, databases…) and control how they communicate with each other and with the outside world.

Analogy: Imagine AWS is a huge city full of buildings (resources). A VPC is your own fenced plot within that city. Inside your plot, you decide how to organize the streets, which doors open to the public street, and which remain private. No one from outside enters without your permission, and what happens in your plot is isolated from others' plots.

Without a network, your servers couldn't communicate in a controlled or secure way. The VPC gives you:

1. Isolation: your resources are separated from those of other AWS customers. It's your private space.
2. Control: you decide what is public (accessible from the internet) and what is private (only accessible internally).
3. Security: you can place sensitive resources (like a database) in areas where the internet can't reach.
4. Organization: you structure your network into subnets according to their function.

Why security matters so much here: one of the worst ideas in the cloud is to make your database directly accessible from the internet. With a VPC, you place the database in a private area, so only your own servers can talk to it. If an attacker looks for your database on the internet, they simply can't find it because it has no public ingress or egress.

When you create an AWS account, it comes with a default VPC already configured in each region, ready to use. That's why you can launch an EC2 instance "without thinking about networks": you're actually using that default VPC.

However, for serious projects, it's common to create your own VPC with the structure you need, instead of using the default one. Throughout this chapter (and in Chapter 12, where you'll build it with Terraform) you'll learn how to do it.

When you create a VPC, the first thing you define is its IP address range, expressed in a notation called CIDR. Don't worry: it's simpler than it seems.

A typical CIDR range for a VPC is:

This means: "my network will use IP addresses that start with 10.0.x.x." The /16 indicates how many addresses it covers (in this case, about 65,000 addresses available for your resources).

Analogy: The CIDR range is like deciding the street numbers of your plot. 10.0.0.0/16 means "my neighborhood will have numbers from 10.0.0.0 to 10.0.255.255." Then you'll divide those numbers among different streets (subnets), which we'll see in the next subchapter.

Common private ranges (defined by internet standards for private networks):

• 10.0.0.0/16
• 172.16.0.0/16
• 192.168.0.0/16

You don't need to master CIDR now. The important thing: a VPC has an address range, and within it you'll organize everything. If you want a practical rule: use 10.0.0.0/16 for your VPC and that's it.

A VPC is like a container that holds several pieces we'll see in this chapter:

• Subnets: divisions of your VPC, public or private (subchapter 6.2).
• Internet Gateway: the door to the internet (subchapter 6.3).
• NAT Gateway: internet egress for private resources (subchapter 6.3).
• Route Tables and Network ACLs: the "traffic rules" (subchapter 6.4).
• Peering and endpoints: connections with other networks (subchapter 6.5).

Don't worry if these are just names for now: we'll break them down one by one.

Remember Chapter 3: a VPC belongs to one region and can span multiple availability zones (AZ) in that region. This is key: by spreading your subnets across several AZs, you build the high availability we saw in subchapter 3.2. We'll see this when we talk about subnets.

• A VPC is your private and isolated network within AWS: your "fenced plot" in the AWS city.
• It gives you isolation, control, security, and organization: you decide what is public and what is private.
• Your account already comes with a default VPC, but for serious projects you'll create your own.
• A VPC is defined with a CIDR range (for example 10.0.0.0/16), which is the set of IP addresses in your network.
• A VPC lives in one region and can extend across multiple AZs for high availability.

In the next subchapter, we'll divide the VPC into public and private subnets, the most important design decision for your network.