Amazon VPC Essential2009年〜
Build a logically isolated virtual network on AWS
What It Does
Amazon VPC (Virtual Private Cloud) lets you build a logically isolated virtual network within the AWS cloud. You can freely configure IP address ranges, subnets, route tables, and network gateways, with the same level of control as an on-premises network. Many AWS services including EC2, RDS, and Lambda run inside a VPC.
Use Cases
Web application network architecture (web servers in public subnets, databases in private subnets), VPN connections to on-premises, network isolation between microservices, and network controls for compliance requirements.
Everyday Analogy
Think of designing floors in an office building. Within the building (VPC), you partition floors (subnets), set up a reception desk (internet gateway), and control access to each floor with security gates (security groups).
What Is VPC?
Amazon VPC lets you build your own dedicated virtual network on AWS. When you create an AWS account, a default VPC is automatically created in each region, but for production environments, designing a custom VPC tailored to your requirements is standard practice. Your VPC is completely isolated from other accounts' VPCs.
Subnets and Routing
Within a VPC, you create public and private subnets. Public subnets have a route to the internet gateway and are accessible from the outside. Private subnets have no direct internet access and are where you place databases and internal services. To access the internet from private subnets, use a NAT Gateway.
Security
VPC security is controlled in two layers: security groups and network ACLs. Security groups are instance-level stateful firewalls that define allow rules only. Network ACLs are subnet-level stateless firewalls that can define both allow and deny rules. VPC Flow Logs record network traffic for auditing and troubleshooting. For practical security knowledge, technical books on Amazon are helpful.
Getting Started
In the VPC console, select "Create VPC" and specify a CIDR block (e.g., 10.0.0.0/16). Choosing "VPC and more" creates subnets, route tables, internet gateway, and NAT Gateway all at once. Best practice is to place subnets in 2+ Availability Zones for a Multi-AZ configuration.
Things to Watch Out For
- VPC CIDR blocks can be expanded after creation but not shrunk. Allocate a generous range with future growth in mind
- NAT Gateway incurs hourly and data processing charges. Consider NAT instances or VPC endpoints to reduce costs
- Default VPCs are convenient but use custom VPCs for production environments for better security and network design
