Networking — VPC, Subnets & Security Groups
Carve out a private, isolated network and control exactly what can reach each resource.
A VPC (Virtual Private Cloud) is your own isolated network in AWS, defined by a CIDR block (e.g. 10.0.0.0/16). You divide it into subnets, each living in one Availability Zone. Public subnets have a route to an Internet Gateway; private subnets do not, and reach the internet only through a NAT Gateway for outbound traffic. This public/private split is the foundation of a secure tiered architecture: load balancers in public subnets, application and database tiers in private ones.
A corporate office building. The VPC is the building; subnets are floors; the lobby (public subnet) faces the street while secure labs (private subnets) do not. Security guards at each room door (security groups) check IDs, and the rule that "anyone you let in can leave" is statefulness.