VPC & Subnets
A Virtual Private Cloud is your own isolated network in AWS, divided into public and private subnets.
A VPC (Virtual Private Cloud) is a logically isolated virtual network that you control. You define its IP range and carve it into subnets across Availability Zones.
Core pieces
- CIDR block — the VPC's IP range, e.g.
10.0.0.0/16. - Subnet — a slice of the range that lives in one AZ.
- Public subnet — has a route to an internet gateway, so resources can reach the internet.
- Private subnet — no direct internet route; used for databases and app servers.
Example
# Create a VPC and two subnets
aws ec2 create-vpc --cidr-block 10.0.0.0/16
aws ec2 create-subnet --vpc-id vpc-0a1b2c3d4e5f67890 \
--cidr-block 10.0.1.0/24 --availability-zone us-east-1a
aws ec2 create-subnet --vpc-id vpc-0a1b2c3d4e5f67890 \
--cidr-block 10.0.2.0/24 --availability-zone us-east-1bWhen to use it
- A company creates a VPC with public subnets for load balancers and private subnets for application servers to avoid exposing backend services to the internet.
- A financial firm isolates its trading platform in a dedicated VPC with no internet gateway, connecting it to on-premises systems via Direct Connect.
- A multi-tier web application places its web servers in a public subnet and its RDS database in a private subnet within the same VPC.
More examples
Create a VPC with CIDR Block
Creates a VPC with a /16 CIDR block giving 65,536 private IP addresses, then tags it for identification.
VPC=$(aws ec2 create-vpc \
--cidr-block 10.0.0.0/16 \
--query Vpc.VpcId --output text)
aws ec2 create-tags \
--resources $VPC \
--tags Key=Name,Value=production-vpc
echo "Created VPC: $VPC"Create Public and Private Subnets
Creates one public subnet and one private subnet in the same AZ — a standard VPC pattern for web applications.
# Public subnet (will have route to internet gateway)
aws ec2 create-subnet \
--vpc-id vpc-0abc123 \
--cidr-block 10.0.1.0/24 \
--availability-zone us-east-1a \
--tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=public-1a}]'
# Private subnet
aws ec2 create-subnet \
--vpc-id vpc-0abc123 \
--cidr-block 10.0.10.0/24 \
--availability-zone us-east-1a \
--tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=private-1a}]'List Subnets in a VPC
Lists all subnets in a specific VPC with their CIDR blocks and AZs, giving a clear view of the network layout.
aws ec2 describe-subnets \
--filters Name=vpc-id,Values=vpc-0abc123 \
--query 'Subnets[].{ID:SubnetId,CIDR:CidrBlock,AZ:AvailabilityZone,Name:Tags[?Key==`Name`].Value|[0]}' \
--output table
Discussion