VPC in plain English

1. The big picture

Everything you launch in AWS (a server, a database) has to live somewhere. A VPC is that somewhere. It is private by default. Nobody from outside can walk in until you build a gate and open it.

2. AWS words, real-life words

Learn these nine words and the rest of this course is easy. This chapter builds the first five. The rest get a short preview, and endpoints and security groups each get a chapter of their own.

3. What we built together

One VPC, two streets, one gate. The left street has a road to the gate. The right street does not.

4. What makes a street "public"?

There is no "public" switch. A street is public only when its route table has a road to the gate. That road is the line 0.0.0.0/0, which means "everywhere else".

Reading 0.0.0.0/0

Every destination in a route table is a CIDR block: a starting address, a slash, and a number. The number says how many bits at the front of an address must match.

So a house on Street B matches two lines in the public table: 10.0.0.0/16 and 0.0.0.0/0. AWS settles this with one rule: the most specific match wins. The line with the bigger number after the slash is the one used.

That is why 0.0.0.0/0 reads as "everywhere else". It never takes traffic away from the VPC, because the local line is always more specific. It only catches what no other line claims.

The gate on its own opens nothing. A VPC can have an Internet Gateway attached and a server with a public IP, and that server still cannot reach the internet until its street's route table sends traffic to the gate. The route is what makes a street public.

5. Follow one request

A server asks for google.com, which lives at a public address such as 142.250.74.46. That address is not inside 10.0.0.0/16, so only a 0.0.0.0/0 line can carry it. Here is what happens on each street.

A private server can still reach the internet later by using a NAT Gateway. It is the courier from the word table, and it costs about 4 cents an hour, so we skip it for now.

6. Two locks (a preview)

Roads decide where traffic can go. Locks decide who is allowed to enter. A VPC has two kinds. This chapter only names them. Chapter 3 sets up a real security group and shows it at work.

7. Every step we did, in order

This is the full lab, exactly as we ran it in the AWS console (region eu-north-1, Stockholm). On the left are the clicks. On the right is the same thing in the CLI. Everything here is free.

1. Look at the default VPC first

   Before building, we looked at what AWS already gave you. It is read-only, so nothing changes.

   Console clicks

   1. Search VPC and open it. Make sure the region says Europe (Stockholm).
   2. Open Your VPCs, then Subnets, then Route tables in the left menu.

   CLI

   aws ec2 describe-vpcs
   aws ec2 describe-subnets \
     --filters Name=vpc-id,Values=vpc-0431ca2213ee35034
   aws ec2 describe-route-tables \
     --filters Name=vpc-id,Values=vpc-0431ca2213ee35034
   aws ec2 describe-internet-gateways

   What we found: default VPC 172.31.0.0/16 with 3 public subnets (one per Availability Zone). Its route table already has 0.0.0.0/0 → igw-0edcece1d6bff5af1, which is why those subnets are public.

2. Create the VPC

   This is the society itself. We picked the 10.0.0.0/16 range so it never clashes with the default 172.31.x.x.

   Console clicks

   1. VPC console › Your VPCs › Create VPC.
   2. Resources to create: VPC only.
   3. Name tag: learn-vpc. IPv4 CIDR: manual input, 10.0.0.0/16.
   4. IPv6: none. Tenancy: Default. Encryption control: none.
   5. Tags: Project=aws-learning, Env=dev.
   6. Click Create VPC.

   CLI

   aws ec2 create-vpc --cidr-block 10.0.0.0/16 \
     --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=learn-vpc},{Key=Project,Value=aws-learning},{Key=Env,Value=dev}]'

   Result: vpc-01f172031e4a6b6e6. AWS also made a main route table, a main network ACL and a default security group for it. There is no gate yet, so the VPC is completely sealed.

3. Create two subnets (two streets)

   We cut the VPC into two /24 slices, both in Availability Zone eu-north-1a. A /24 has 251 usable addresses, because AWS keeps 5 for itself. Right now they are identical.

   Console clicks

   1. Left menu › Subnets › Create subnet.
   2. VPC ID: learn-vpc.
   3. Subnet 1: name learn-public-a, AZ eu-north-1a, CIDR 10.0.1.0/24.
   4. Click Add new subnet. Subnet 2: name learn-private-a, AZ eu-north-1a, CIDR 10.0.2.0/24.
   5. Add the two tags to each, then Create subnet.

   CLI

   aws ec2 create-subnet \
     --vpc-id vpc-01f172031e4a6b6e6 \
     --cidr-block 10.0.1.0/24 \
     --availability-zone eu-north-1a \
     --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=learn-public-a}]'
   
   aws ec2 create-subnet \
     --vpc-id vpc-01f172031e4a6b6e6 \
     --cidr-block 10.0.2.0/24 \
     --availability-zone eu-north-1a \
     --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=learn-private-a}]'

   Result: subnet-0b72f2ddf7ea69acc (public-a) and subnet-069c9567082c66e19 (private-a). Both still use the main route table, so neither can reach the internet.

4. Create the Internet Gateway and attach it

   This is the main gate. Creating it is not enough. A gate that is not attached to the VPC does nothing, so it first shows the state Detached.

   Console clicks

   1. Left menu › Internet gateways › Create internet gateway.
   2. Name tag learn-igw, plus the two tags › Create internet gateway.
   3. On the next screen click Attach to a VPC.
   4. Choose learn-vpc › Attach internet gateway.

   CLI

   aws ec2 create-internet-gateway \
     --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=learn-igw}]'
   
   aws ec2 attach-internet-gateway \
     --internet-gateway-id igw-03d8b88d0eca47fcd \
     --vpc-id vpc-01f172031e4a6b6e6

   Result: igw-03d8b88d0eca47fcd, state Attached to learn-vpc. Still nothing is public, because no street has a road to it yet.

5. Create a route table with a road to the gate

   The route table is the signboard. We made a new one and added one line: everything that is not inside the VPC goes to the gate.

   Console clicks

   1. Left menu › Route tables › Create route table.
   2. Name learn-public-rt, VPC learn-vpc, add tags › Create route table.
   3. Open its Routes tab › Edit routes › Add route.
   4. Destination 0.0.0.0/0. Target: Internet Gateway › learn-igw.
   5. Click Save changes.

   CLI

   aws ec2 create-route-table \
     --vpc-id vpc-01f172031e4a6b6e6 \
     --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=learn-public-rt}]'
   
   aws ec2 create-route \
     --route-table-id rtb-0dd7e045b91605be4 \
     --destination-cidr-block 0.0.0.0/0 \
     --gateway-id igw-03d8b88d0eca47fcd

   Result: rtb-0dd7e045b91605be4 with two routes: 10.0.0.0/16 → local and 0.0.0.0/0 → igw-03d8…. No street uses it yet.

   The destination does not have to be 0.0.0.0/0. It can be any range. Chapter 2 asks what happens if you name only S3's addresses here.

6. Give that route table to the public street only

   This is the step that makes a street public. We ticked only learn-public-a. The private street keeps the main route table, so it stays private.

   Console clicks

   1. Open learn-public-rt › tab Subnet associations › Edit subnet associations.
   2. Tick only learn-public-a. The counter should say 1 subnet selected.
   3. Click Save associations.

   CLI

   aws ec2 associate-route-table \
     --route-table-id rtb-0dd7e045b91605be4 \
     --subnet-id subnet-0b72f2ddf7ea69acc

   Result: the route table now lists learn-public-a under Explicit subnet associations.

7. Check that it worked

   The console tells you directly. The Subnets list has an Internet access column.

   Console clicks

   1. Left menu › Subnets. Filter by name learn-.
   2. Scroll right to Route table and Internet access.

   CLI

   aws ec2 describe-route-tables \
     --filters Name=association.subnet-id,Values=subnet-0b72f2ddf7ea69acc
   
   aws ec2 describe-subnets \
     --subnet-ids subnet-0b72f2ddf7ea69acc subnet-069c9567082c66e19

   What we saw: learn-public-a says Yes (public) and uses learn-public-rt. learn-private-a says No (private) and uses the main route table.

Cost check: VPCs, subnets, route tables and Internet Gateways are free. Charges only start when you add things like a NAT Gateway, an Elastic IP that is not in use, or servers. We added none of those.

# 1. remove the route table link, then the table
aws ec2 disassociate-route-table --association-id <rtbassoc-id>
aws ec2 delete-route-table --route-table-id rtb-0dd7e045b91605be4
# 2. detach, then delete the gate
aws ec2 detach-internet-gateway --internet-gateway-id igw-03d8b88d0eca47fcd --vpc-id vpc-01f172031e4a6b6e6
aws ec2 delete-internet-gateway --internet-gateway-id igw-03d8b88d0eca47fcd
# 3. delete the subnets
aws ec2 delete-subnet --subnet-id subnet-0b72f2ddf7ea69acc
aws ec2 delete-subnet --subnet-id subnet-069c9567082c66e19
# 4. finally the VPC
aws ec2 delete-vpc --vpc-id vpc-01f172031e4a6b6e6

Remember only this

1. VPC = your private network. Nothing gets in or out until you build a gate.
2. Subnet = one street inside it. Each street lives in one Availability Zone.
3. Public street = its route table has 0.0.0.0/0 → Internet Gateway. No road, no public.
4. Most specific route wins. local keeps VPC traffic inside. 0.0.0.0/0 catches everything else.

Next: the main gate is not the only way out. Chapter 2 compares it with a VPC endpoint, a private passage that leads to one AWS service.