# VPC - Manage Private Network on AWS

VPC is our own isolated network in the cloud.

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2Fjk5WE2haeRwQHUNVf8Mi%2Fimage.png?alt=media\&token=be9e13f9-80ef-4800-8e2d-ef6b102127df)

{% hint style="success" %}
Your resources always have to run in a VPC!
{% endhint %}

▪ We have a VPC for each Region&#x20;

&#x20;  ▪ VPC spans all the AZ (Subnet) in that Region&#x20;

&#x20;  ▪ Multiple VPCs in different Regions

&#x20;  ▪ VPC is like a virtual representation of network infrastructure: Server setup, network configuration (router, firewall, DHCP etc.) moved to cloud

### SUBNET

Subnet is a range of IP addresses in your VPC&#x20;

It's like a private network inside a network:

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FEl6Eo3YFBBpTqP8XGyEi%2Fimage.png?alt=media\&token=6dc4607b-61ba-4643-b700-59dff9669006)

We have a subnet for each Availability Zone:

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FLp87rfFINAer5P4zEI8q%2Fimage.png?alt=media\&token=6e7fe300-3126-4c9a-ae87-306216984ac4)

#### Private and Public Subnets

&#x20;  ▪ Based on firewall configuration we can have a private and/or public subnet:

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FWBwaDW5hjJbiu6MTkBy9%2Fimage.png?alt=media\&token=7a7664b7-3560-4fba-b9c5-e2e50b66eadc)

&#x20;▪ A subnet has a default range of internal(private) IP addresses&#x20;

BUt : other services inside the vpc still have access

&#x20;  ▪ When you create a new resource like EC2 instance then an IP address is assigned within this subnet's IP range&#x20;

&#x20;  ▪ For communication inside the VPC

* not for outside web traffic
* internal IP range on VPC  level

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2FDjrujY6DGXisuRd8w6va%2Fimage.png?alt=media\&token=177a563c-8c8a-44d4-b655-46c9dcecb1a3)

### Internet Gateway

&#x20;  ▪ Using an internet gateway you can connect the VPC or its subnets to the outside internet

### Security - Controlling Access

Of course, we need to **secure our resources:**&#x20;

&#x20;  ▪ Control access to your VPC&#x20;

&#x20;  ▪ Control access to your individual server instances

* secure your components

### NETWORK ACCESS CONTROL LIST (NACL)

![](https://604868167-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQ9IWUW0VjkKLJPOeTIP3%2Fuploads%2Ff6H98sWArtCdi1GvQc2T%2Fimage.png?alt=media\&token=ebfe4a73-65e9-46b5-b381-3444442d4e20)

* Configure access on instance level = Security group
* Configure access on subnet  level = NACL
