A Virtual Private Cloud is the network boundary around many AWS workloads. The console makes it possible to create one quickly, but the useful knowledge is understanding why a packet can or cannot travel from one component to another.
CIDR is the address plan
The VPC receives one or more CIDR ranges, such as 10.20.0.0/16. Subnets divide that space into smaller ranges. Plan enough room for growth, avoid overlap with networks you may connect later, and remember that managed services can consume more IP addresses than a simple node count suggests.
Changing a poor address plan after many environments and hybrid connections exist is expensive.
Subnets belong to one Availability Zone
A subnet cannot span Availability Zones. A multi-AZ application therefore needs separate subnets in each zone. Public and private are architectural labels based mainly on routing, not special subnet types selected by AWS.
A public subnet has a route to an internet gateway. A private subnet does not have a direct route to that gateway. Resources also need appropriate addresses and security rules before they can communicate.
Route tables answer where traffic goes
Every subnet is associated with a route table. The most specific matching route wins. The local route handles traffic inside the VPC. Other routes can point to an internet gateway, NAT gateway, transit gateway, virtual private gateway, VPC peering connection, or network interface.
When troubleshooting, read the route from source to destination and then read the return path. One-sided routing is a common source of confusing timeouts.
Internet gateways and NAT gateways solve different directions
An internet gateway gives eligible resources a path for internet traffic. An internet-facing load balancer commonly uses public subnets and accepts inbound connections through listeners and security groups.
A NAT gateway lets private resources initiate outbound IPv4 connections while preventing unsolicited inbound internet connections from reaching those private addresses. Place a NAT gateway in a public subnet and route private subnet internet-bound traffic to it. For resilient production designs, consider a NAT gateway per Availability Zone and route each private subnet locally.
Security groups are stateful
Security groups attach to network interfaces and evaluate allowed traffic. Return traffic for an allowed connection is automatically permitted. Use security group references between tiers, such as allowing an application group to receive traffic only from the load balancer group.
Network ACLs are stateless
Network ACLs operate at the subnet boundary and have ordered allow and deny rules. Because they are stateless, both directions and ephemeral ports matter. Default security groups are often sufficient for normal tier isolation. Use custom NACLs when a subnet-level control or explicit deny requirement justifies the complexity.
VPC endpoints keep service traffic private
Gateway and interface endpoints provide private paths to supported AWS services. They can reduce NAT usage and keep traffic off public endpoints. Endpoint policies, security groups, DNS, and service-specific behavior still need review.
A clean three-tier flow
The browser reaches an ALB in public subnets. The ALB reaches application targets in private subnets. The application reaches a database in isolated or private data subnets. Private compute reaches approved AWS services through endpoints and uses NAT only for necessary internet egress.
Open the public and private subnet architecture and trace that flow. Then compare the hybrid Transit Gateway architecture to see how multiple networks connect without flattening their boundaries.
