What is Virtual Private Cloud in AWS ??

VPC is one of the services provided by AWS to isolate your resources from others by launching resources in a separate network. You may have noticed when you have launched an instance, by default AWS attaches a VPC to that instance. By doing so, it is configuring your instance to internet connectivity. Basically, when instances are attached to default VPC in AWS, it is exposed to the public world, but what if you want some instances should be privately available and only a few to be publicly accessible. In such default, VPC will not help you, therefore to accomplish your need, you need to create your own VPC. So, to create your own VPC or private network you need to have an understanding of terminologies related to VPC such as Internet Gateway, Routing Table, Sub-Network, NAT gateway, VPC peering, Security Groups, NACLs, CIDR, etc. So, the requirement of own VPC depends on use cases to use cases. Secondly, understanding the concepts of Networking practically, is one of the best ways, because here you will create your own Network, so you will learn how things work and are implemented. That's a basic intro on VPC before proceeding further with detail of it. Hello Everyone, this blog is a part of the AWS series part 3. Refer here to learn about part 1 and part 2.

Things you will learn at the end of this blog:

• What is VPC with an Example?
• How to create your VPC?
• What is Subnet ??
• How to Create a Subnet ??
• What is Internet Gateway?
• Why do we need it and how do we create it?
• What is Route Table ??
• Why do we need a Route Table and how do we create it?
• What is a NAT gateway?
• Why do we need it and how do we create it?

So, let's start with VPC and understand it with the help of an example.

Inside a big hotel, there are various rooms that are available for rent and those are known as public rooms. These types of rooms are: single rooms, double rooms, triple rooms, duplex rooms, etc. And there are few rooms which are not for rent such as kitchen, laundry, store room, etc and these rooms are known as private rooms.

Similarly, VPC is like a big hotel or big network, under which many rooms or sub-networks are available. Some rooms or sub-networks need to be publicly available and some sub-networks need to be privately available.

Back to the example. Although, all rooms inside the hotel are isolated from each other. But What if someone from room no. 101 wants to have a communication with room no 205?

Yeah, he can do it but for that, he has to knock on his door to get him out of the room and start communication until and unless that guy in room no 205 has any problem with him. So, we can say by default internal communication within the hotel rooms is possible.

Similarly in VPC, by default, communication within sub-networks is allowed, until and unless sub-networks don't want to communicate with other sub-networks. If some sub-networks don't want to communicate with other sub-networks they can add a firewall i.e. NACLs.

NOTE: So, internal communication b/w sub-networks is possible until and unless any firewall is added.

Back to the hotel example. But what if people outside the hotel i.e. guests want to communicate with room 301, then they need permission from the hotel entrypoint i.e. hotel reception, and on the basis of the rules and regulations of the hotel, they will be allowed or denied.

Similarly, if someone from outside the VPC network wants to communicate with a sub-network, then as per the rules and regulations of the VPC entrypoint i.e. Internet gateway request will be allowed or denied.

See the below diagram to get an idea of what we have discussed till now.

So, the guest will show their identity at the reception and will tell about room no. to which the guest has to go.  The receptionist will show the path to him, from where, and how to reach that room number.

Similarly, in the VPC case, since Internet Gateway is also known as the Entrypoint. And this entrypoint i.e. Internet Gateway is nothing but  Router of VPC.  The router has routing tables that contain a set of rules in it. The rule guides the request on reaching its destination.  After the request reaches to sub-network.  Each sub-network has one router like VPC.  This router acts as an Entrypoint for sub-network.  These routers too contain rules to guide the request where to go and how to go. So, now, the router of the sub-network will check that request against its list of rules, whether that request is allowed or not. The request is identified via its source IP address. If it is allowed, then a request will communicate with that instance. After successful communication now response will be sent back to the sub-network. And sub-network will send the response to the Internet Gateway.