Written by Hyojung Yoon
Hello! Today, we're going to learn about fundamental building blocks of AWS and other cloud platforms: the VPC.
In this guide, you'll learn what a private cloud is, how it works, and why it's such an important part of your cloud environment. So let's get started with our comprehensive guide to VPCs!
What is a VPC?
What is a Private Cloud?
A private cloud is a cloud computing environment dedicated to a single organization. Any cloud infrastructure has underlying compute resources like CPU and storage that you provision on demand through a self-service portal. In a private cloud, all resources are isolated and in the control of one organization. So, the private cloud is also called the internal or corporate cloud.
What is Amazon VPC?
A Virtual Private Cloud (VPC) is a private network space dedicated to a customer that is logically independent.
If that sounds too difficult, let's imagine a large apartment complex as an AWS cloud environment.
The apartment complex has a huge amount of land and in addition to apartments, it has tons of facilities such as common areas, gyms, and swimming pools. Now imagine that within this large complex, you have a penthouse for yourself. The penthouse has everything you need - a living room, bedroom, kitchen, and even a private terrace - and no one else can enter or use it without your permission.
This penthouse in an apartment complex is a good representation of a VPC in the AWS cloud. A VPC is a secure, dedicated space where you can work digitally out of reach of others. A penthouse (VPC) in an apartment complex (AWS cloud) has its own unique characteristics. It's separate from the rest of the apartments, and it offers a high level of security and control, allowing you to control who is in and out of your home and when.
When you live in an apartment, there are basic rules to follow, and residents are free to act within those rules. You can add and rearrange furniture in your own home as needed, but you can't bring exercise equipment from the gym, which is a common area within the apartment complex, into your own home. This is similar to how a VPC works. AWS gives you a designated space in the cloud, and you can configure it however you want within set rules.
The difference is that with a VPC, you can request more resources as you need them, and if approved, they become part of your VPC.
Components of a VPCs
1. Subnet
A subnet is a small network that one network is divided into. Each subnet is assigned a range of IP addresses and can have its own policies for controlling network traffic. This allows you to divide your VPC into separate sections with specific purposes, such as hosting web servers or database servers.
Within a VPC, you can create multiple subnets, each of which must exist within one Available Zone (AZ) and cannot extend across multiple zones. Launching AWS resources in separate Availability Zones protects your applications from failures in a single Availability Zone.
A public subnet is a public network that is open to the outside world and can communicate directly with the rest of the Internet. A private subnet is not directly accessible from the outside and only allow one-way communication from inside to outside using a NAT gateway.
2. Routing tables and routers
A routing table contains a set of rules called routes that determine where network traffic on a subnet or gateway is sent. Each subnet in a VPC must be associated with a routing table. Unless you set it up otherwise, it is associated with the VPC's default routing table. You can modify the routing table, create custom routing tables, and associate them with subnets to more precisely control traffic flow.
3. Internet gateways and NAT gateways
An Internet gateway can be thought of as a gateway that allows communication between your VPC and the Internet. A Network Address Translation (NAT) gateway, on the other hand, is a NAT service that allows instances in your private subnet to access the Internet or other AWS services, while preventing the Internet from initiating a connection with those instances.
This enables secure outbound connections to instances in your VPC's private subnet.
4. Network Access Control Lists and Security Groups
Network Access Control Lists (ACLs) and security groups are the backbone of network security within a VPC.
Network ACLs allow or deny specific inbound or outbound traffic at the subnet level. Network ACL rules are evaluated as traffic enters and leaves the subnet, not as it is routed within the subnet, meaning that the response to permitted inbound traffic follows the rules for outbound traffic and vice versa.
In contrast, security groups operate at the individual resource level. They control inbound and outbound traffic to an instance and can specify allowable traffic based on ports and protocols. Each security group adds a separate set of rules for inbound and outbound traffic.
Benefits of using VPC
1. Privacy and security
By isolating your network infrastructure, a VPC ensures that your data is separate from other data in the public cloud. Features like security groups and network access control lists allow you to control inbound and outbound traffic, further securing your applications.
2. Customizable network configuration
With a VPC, you have the freedom to customize your network configuration to meet your business needs. You can select IP address ranges, create subnets, configure route tables and network gateways.
3. Controlled traffic flow
VPCs allow controlled access to resources. You can use routing tables, Internet gateways, and virtual private network (VPN) connections to direct and manage the flow of data within your network.
4. Extended IT infrastructure
With a secure VPN connection, you can connect your on-premises resources to your cloud infrastructure, making it an extension of your own data center. This makes data transfer smoother and allows you to leverage the benefits of both environments.
5. Multiple connectivity options
VPCs offer multiple connectivity options, including a private connection to your on-premises, a direct connection option to your office or local network, and a VPN connection over the internet.
VPCs and other cloud models
As you learn about cloud computing, it's a good idea to understand the differences between different models such as VPC, public cloud, hybrid cloud, and on-premises environments. Each model offers unique features to meet different needs.
Public Clouds
A public cloud can be described as a shared space that is open to the general public, like a plaza or park. Everyone can use the park's resources, such as benches and playgrounds, and it can accommodate many people at once.
Public clouds have the advantage of being cost-effective because they are managed and operated by a cloud service provider, so you don't have to buy physical servers, and you don't have to worry about operating and maintaining them. This makes them ideal for businesses with fluctuating demand or public applications with many users.
Private Clouds
A private cloud is a building that is used exclusively by one family, like a single-family home. From the interior of the house to the yard, the family can decorate and manage it as they wish. However, this requires higher maintenance costs and management compared to an apartment complex.
A private cloud is a cloud that can be used exclusively by a single customer with independent access. It's used where data needs to be protected, such as an organization's intranet or data center. The advantage of a private cloud is that it can be operated internally, allowing you to manage your data and resources efficiently.
Hybrid Clouds
A hybrid cloud is a combination of a public cloud and a private cloud, connected through technology that allows data and applications to be exchanged between the two. Think of it as a bridge between an island (private cloud) and a mainland (public cloud).
Hybrid clouds combine the best of both cloud computing models, allowing sensitive data and applications that require security to operate in a private cloud, while relatively lightly loaded applications, etc. can operate in a public cloud. This allows organizations to reduce costs and maintain security and control to meet the needs of their business.
| VPC | Public Cloud | Private Cloud | Hybrid Cloud |
Privacy | Private space within the public cloud | Moderate | Fully Controlled | High |
Cost | Depends on usage, cheaper than private clouds | Inexpensive due to pay-as-you-go model | Expensive due to the use of dedicated infrastructure | Varies as a combination of public and private clouds |
Scalability | High | High | Low ~ moderate | High |
Control | High | Low ~ moderate | High | High |
Complexity | Moderate | Low | High | High |
Applications | Web, Email, CRM, Collaboration, HR | ERP, R&D, SCM, Analytics | Call centers, Remote sites, Banking |
Conclusion
We've covered a lot of ground, from VPC architectural frameworks to detailed comparisons with public, private, and hybrid clouds. To get the most out of VPC, you need to have a general understanding of the network, not just a grasp of VPC fundamentals. We hope this VPC guide has helped you get started.