VPC: Your Private Slice of the Public Cloud

WHY IT EXISTS Public clouds offer massive pools of shared computing resources. But running applications requires network isolation, just as you'd have in a private data center. A VPC was created to provide this logical isolation on shared physical hardware, giving you the benefits of a private network without the cost of private hardware.

THE MENTAL MODEL Think of a public cloud provider as a giant apartment building. A VPC is your own private apartment within it. You control who gets in (network rules), how the rooms are arranged (subnets), and you have your own private address, even though you share the building's plumbing and electricity (the underlying hardware).

HOW IT WORKS A VPC carves out a portion of the cloud provider's network for your exclusive use. This is achieved by assigning you a private IP address range (a subnet). All resources you launch into this VPC get an IP from that range. Communication between your resources is contained within this virtual network. To connect to the outside world or your corporate office, you use constructs like Internet Gateways or VPN connections, which are secured with authentication and encryption.

WHEN TO USE IT Use a VPC whenever you deploy any application in a public cloud. It's the foundational building block for creating secure and organized cloud infrastructure, separating public-facing web servers from private databases or backend services. It gives you full control over your virtual networking environment.

WHEN NOT TO USE IT You almost always use a VPC in a modern public cloud. The alternative is the older "classic" networking model where resources might get public IPs by default, which is less secure and flexible. For any new project, starting with a VPC is standard practice.

ONE CANONICAL EXAMPLE You create a VPC in AWS with an IP range of 10.0.0.0/16. You then create two subnets: a public one for your web servers (10.0.1.0/24) and a private one for your database (10.0.2.0/24). The web servers can talk to the internet, but the database can only be reached by the web servers, providing a critical layer of security.