Amazon Virtual Private Cloud (Amazon VPC)
Logically isolated virtual network with fine-grained subnet isolation, multi-AZ NAT Gateways, and PrivateLink connectivity.
Logically isolated virtual network with fine-grained subnet isolation, multi-AZ NAT Gateways, and PrivateLink connectivity.
Coming from Google Cloud?
Both provide isolated private cloud networking, but Google Cloud VPC is global across all regions by default with regional subnets, whereas Amazon VPC is regional with Availability Zone-scoped subnets.
- Private RFC 1918 CIDR IP space allocation and route table management.
- Stateful virtual firewall rules protecting compute instances (AWS Security Groups vs GCP Firewall Rules).
- Private managed NAT gateways providing outbound internet access for private workloads (AWS NAT Gateway vs GCP Cloud NAT).
- Private API connectivity without public internet traversal (AWS PrivateLink vs GCP Private Service Connect).
- Scope: GCP VPC is Global (one VPC spans all global regions with regional subnets); AWS VPC is Regional (must peer or connect via Transit Gateway across regions).
- Subnet Scope: GCP subnets are Regional (spanning all zones in a region); AWS subnets are Availability Zone-scoped.
- Firewalls: GCP uses global distributed stateful Firewall Rules with Service Account / network tags; AWS uses per-ENI Security Groups and per-subnet stateless NACLs.
- NAT Scaling: GCP Cloud NAT is serverless and software-defined (no IP gateways to provision); AWS requires deploying 1 managed NAT Gateway per AZ with an Elastic IP.
What is Amazon Virtual Private Cloud (Amazon VPC)?
Amazon Virtual Private Cloud (Amazon VPC) enables you to launch AWS resources into a virtual network that you've defined. It provides complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, configuration of route tables, and network gateways. It supports IPv4 and IPv6, stateful Security Groups at the instance ENI layer, and stateless Network ACLs at the subnet boundary.
Decision Guide: When to Choose This Service
Use Amazon VPC when you deploy any production infrastructure in AWS (EC2, RDS, EKS, Lambda, ElastiCache) requiring private network boundaries, public/private subnet tiering, controlled egress via NAT Gateways, or hybrid on-premises connectivity via Direct Connect and AWS Transit Gateway.
Do NOT create multiple fragmented VPCs for simple environments that can be securely isolated using private subnets and Security Groups within a single multi-AZ VPC.
Core Architectural Pillars
Subnets reside strictly within a single Availability Zone with 5 reserved IPs per subnet (.0, .1, .2, .3, .255).
Security Groups operate at the ENI level (allow-only, stateful); NACLs operate at the subnet boundary (allow/deny, stateless with ephemeral return ports).
Deployed in public subnets with an Elastic IP to provide outbound internet connectivity for private instances without inbound exposure.
Free Gateway Endpoints for S3 & DynamoDB; Interface Endpoints (PrivateLink ENIs) for 150+ AWS services.
Centralized hub-and-spoke router connecting thousands of VPCs, VPNs, and Direct Connect circuits.
Captures IP traffic metadata (ACCEPT/REJECT) with zero performance impact for security threat monitoring.