VPC: your own private network
Build a real VPC with public and private subnets in two AZs, read its route tables, and see how internet gateways, NAT, security groups, network ACLs and endpoints fit together.
By the end of this lesson you'll be able to
0 of 6 completeWhy a network of your own
In lesson 3 the server landed in the default VPC, which AWS creates in every Region with only public subnets: fine for a test, wrong for a database. A VPC (Virtual Private Cloud) is your own private network in a Region. You choose its address range, cut it into subnets in different Availability Zones, and decide which ones the internet can reach.
The target for this lesson, built in a real account and deleted afterwards:
| Subnet | AZ | Range | Can the internet reach it? |
|---|---|---|---|
| public 1 | ap-south-1a | 10.0.0.0/20 | yes, through the internet gateway |
| public 2 | ap-south-1b | 10.0.16.0/20 | yes |
| private 1 | ap-south-1a | 10.0.128.0/20 | no |
| private 2 | ap-south-1b | 10.0.144.0/20 | no |
Load balancers go in the public subnets; app servers and databases in the private ones (lesson 5 uses this).
Plan the addresses
A CIDR block is an address range written as a start address and a prefix length. The prefix says how many bits are fixed; the rest are yours:
| CIDR | Addresses | Typical use |
|---|---|---|
10.0.0.0/16 | 65,536 | a whole VPC (the largest AWS allows) |
10.0.0.0/20 | 4,096 | one subnet |
10.0.0.0/24 | 256 | a small subnet |
AWS reserves 5 addresses in every subnet (the first four and the last), so a /24 gives 251 usable. Use the
private ranges 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16, and give every VPC a range that doesn't
overlap the others or your office network, or you can never connect them later.
Subnets in two AZs
VPC → Your VPCs → Create VPC → VPC and more builds the whole network in one go, and draws it as you type:
The VPC's Resource map tab shows how the pieces connect:
What makes a subnet public
Nothing about the subnet itself: only its route table. Every packet leaving a subnet looks up its destination there:
| Route | Means |
|---|---|
10.0.0.0/16 → local | in every route table: any subnet can reach any other inside the VPC |
0.0.0.0/0 → igw-… | the internet gateway: makes the subnet public, both directions |
pl-… → vpce-… | S3 through the gateway endpoint, without the internet |
An instance in a public subnet also needs a public IP to be reachable; one in a private subnet has only a private address, and nothing outside the VPC can start a connection to it.
NAT: the way out for private subnets
Private servers still need to download packages and call APIs. A NAT gateway sits in a public subnet and
lets private subnets go out (private route table: 0.0.0.0/0 → nat-…) while nothing comes in. The wizard
offers three choices: None, Regional (one NAT for all AZs, new) and Zonal (one per AZ).
Two firewalls
| Security group | Network ACL | |
|---|---|---|
| Attached to | an instance (its network interface) | a subnet |
| State | stateful: a reply to allowed traffic is allowed | stateless: rules needed in both directions |
| Rules | allow only | allow and deny, evaluated in number order |
| Default | nothing in, everything out | the default ACL allows everything |
Most teams leave network ACLs at their defaults and filter with security groups, because a security group can name another security group as the source ("only from the load balancer"), which lesson 5 uses.
Endpoints, peering and flow logs
- Gateway endpoints (S3 and DynamoDB only) add a route, cost nothing, and keep that traffic off the NAT
gateway. The wizard created one:
academy-vpce-s3. - Interface endpoints (PrivateLink) put a private IP for an AWS service (ECR, Secrets Manager, SSM) inside your subnet. They cost per hour, and they let private subnets work with no internet access at all.
- VPC peering connects two VPCs one-to-one; ranges must not overlap. Transit Gateway is a hub for many VPCs and VPN connections, when peering every pair gets out of hand.
- VPC Flow Logs record accepted and rejected connections per interface, to CloudWatch Logs or S3: the first thing to turn on when "the network is blocking it" (lesson 13).
Clean up
Delete the VPC from Your VPCs → Actions → Delete VPC; the console deletes its subnets, route tables, internet gateway and endpoint with it. From the CLI you delete them yourself, in order:
$ aws ec2 delete-vpc-endpoints --vpc-endpoint-ids vpce-… $ aws ec2 detach-internet-gateway --internet-gateway-id igw-… --vpc-id vpc-… $ aws ec2 delete-internet-gateway --internet-gateway-id igw-… $ aws ec2 delete-subnet --subnet-id subnet-… # each of the four $ aws ec2 delete-route-table --route-table-id rtb-… # each non-main table $ aws ec2 delete-vpc --vpc-id vpc-…
aws ec2 delete-vpc-endpoints --vpc-endpoint-ids vpce-…awsthe AWS command line
Build and read a two-tier network
Create a VPC with 2 AZs, 2 public and 2 private subnets, no NAT gateway and an S3 gateway endpoint. Prove from the route tables which subnets are public, then delete the whole VPC and confirm it's gone.
Route tables showing 0.0.0.0/0 to an internet gateway only for the public subnets, then no academy-vpc leftReveal one safe solution
$ # 1. Console: VPC → Create VPC → VPC and more, name academy, 10.0.0.0/16, 2 AZs, 2 public, 2 private, $ # NAT None, S3 Gateway → Create VPC $ V=$(aws ec2 describe-vpcs --filters Name=tag:Name,Values=academy-vpc --query 'Vpcs[0].VpcId' --output text) $ aws ec2 describe-route-tables --filters Name=vpc-id,Values=$V \ --query 'RouteTables[].[Tags[?Key==`Name`]|[0].Value, Routes[?DestinationCidrBlock==`0.0.0.0/0`]|[0].GatewayId]' --output text $ # 2. Console: Your VPCs → select academy-vpc → Actions → Delete VPC → type delete $ aws ec2 describe-vpcs --filters Name=tag:Name,Values=academy-vpc --query 'length(Vpcs)' # 0 when it's gone
aws ec2 describe-route-tables --filters Name=vpc-id,Values=$V \awsthe AWS command line
aws ec2 describe-vpcs --filters Name=tag:Name,Values=academy-vpc --query 'length(Vpcs)'--querypick fields from the JSON response
Expect one line per route table: only academy-rtb-public shows an igw-… ID; the private tables and the
main table show None, because they have no route to the internet. Without a
NAT gateway this network costs nothing, so you can rebuild it whenever you like.
Try it yourself
0 of 6 steps doneRun each task in your own account or terminal, then tick it off.
Quick check
What makes a subnet public?
Official reading for this lesson
Or get every quiz answer right and it completes itself.