What Is AWS VPC?

Key Takeaways

Now, inside a region, we create something called a VPC, virtual private cloud. This is basically your own private network inside AWS. Nobody else can enter it unless you explicitly allow it. If a region is a city, your VPC is your own fenced neighborhood inside that city. You choose the IP range, you control who can enter, and you decide how the network is laid out. Every EC2 instance, every database, every load balancer in our app will sit inside this VPC. VPC always lives inside one region, but it can span multiple availability zones within that region. Think of it like this. Region is a city, AZs are separate buildings in that city, and VPC is your private neighborhood inside that city. Your neighborhood can cover multiple buildings, multiple AZs, but it cannot stretch into another city. Inside a VPC, you divide the network into smaller sections called subnets. Subnets are simply slices of your VPC's IP address space. And here's the key idea. Public subnets are reachable from the internet. Private subnets are not reachable directly from the internet. So, why do we split them? Because not every part of your app should be exposed. For example, load balancers go in the public subnet. EC2 servers and databases sit in the private subnet. This gives you a secure and organized layout instead of throwing everything into one giant network. Now, let's tie it back to our photo sharing app. Our application load balancer sits in the public subnet so users can reach it. Typically, EC2 instances are deployed in private subnets. However, due to limitations in the free version of the lab environment, we have placed the EC2 instance in a public subnet for this setup. Our RDS database resides in the private subnet since it shouldn't be exposed publicly. The Lambda function is intentionally kept outside the VPC since it only interacts with AWS managed services like S3 and does not require access to private VPC resources. And everything sits inside two different AZs for high availability. Once this network foundation is in place, everything else in the architecture becomes a lot easier to understand.