Amazon VPC
Amazon Virtual Private Cloud (VPC) is a networking service of Amazon Web Services that lets users create a logically isolated, dedicated virtual network for their resources. It spans multiple Availability Zones within a region, is built from the building blocks described in Amazon VPC Components, and relies on security groups and network ACLs for layered traffic control.
AI Practitioner focus
- Use VPC subnets, routing, security groups, network ACLs, controlled egress, and interface endpoints/AWS PrivateLink to isolate AI data and service access.
- Private networking reduces internet exposure but does not replace IAM, encryption, prompt/tool authorization, data classification, or output validation.
Key points
- Private subnet — a subnet with no internet access.
- Public subnet — a subnet with internet access; carries both a private (internal) IP address and a public IP address, so it is reachable from the internet as well as from within the VPC.
- VPN-only subnet — a subnet with no internet access but with access to the virtual private gateway for a VPN connection.
- Includes many components: Internet gateways, VPN tools, CIDR, Subnets, Route tables, VPC endpoint, NAT instances, Bastion servers, and Peering Connections.
- Spans multiple Availability Zones (AZs) within a region.
- The first four IP addresses and the last one IP address are reserved per subnet (5 reserved addresses total).
- Typical layout: a public subnet for web servers that need internet access, and a private subnet for backend systems such as databases or application servers.
- Can be monitored using Amazon Cloudwatch and Amazon EC2 Auto Scaling groups.
- Every EC2 instance launches within a default VPC that has equal security and control to a normal VPC; the default VPC has no private subnet.
- Uses Security Groups and NACLs (Network Access Control Lists) for multi-layer security.
- Security Groups are stateful and provide instance-level security; NACLs are stateless and provide subnet-level security.
- VPC sharing allows subnets to be shared with other AWS accounts within the same AWS Organizations organization.
Pricing
- Public IPv4 addresses now carry a charge. Since February 1, 2024, AWS charges for every public IPv4 address, whether it is attached to a running resource (an EC2 instance, NAT gateway, internet-facing load balancer, and similar) or sitting idle — $0.005 per address per hour. There is no charge for private IPv4 addresses, private IPv6 addresses, or public IPv4 ranges you bring yourself (BYOIP).