What is a Virtual Private Cloud (VPC)

Whenever I describe AWS services to organizations just starting on their AWS journey, I like to take an approach I use when learning new things myself: relate new concepts to material of which I’m already intimately knowledgeable.

One of the core components almost every AWS service relies on is the Virtual Private Cloud (VPC). I like to visualize a VPC as a network switch inside a large office building; every piece of your network infrastructure must connect to the switch to communicate with one another. The same theory applies to your AWS environment; all resources must be in the same VPC to easily communicate with each other. Although you do have the ability to peer separate VPC’s together to allow communication between them - we’ll come back to this.

VPC: Regional AWS Service

Each VPC created in your AWS account is associated to a single AWS region; think geographic locations: Canada, Eastern & Western USA, and Europe to name just a few - currently there are [eighteen regions with another four coming soon] (https://aws.amazon.com/about-aws/global-infrastructure/). Within each VPC you can create the following resources:

• subnets
• route tables
• network access control lists (NACLs)
• security groups
• Internet gateway
• NAT gateways
• VPN connections

VPC Security

When it comes to securing your VPC, you’re responsible for the creation and maintenance of Security Groups and optional Network Access Control Lists (NACLs).

• Security Groups are stateless fireless and by default block all traffic.
• NACLs, on the other hand, are stateless firewalls and by default allow all traffic.

If you’re just getting started, I’d highly recommend familiarizing yourself with the [AWS Shared Responsibility Model.] (https://aws.amazon.com/compliance/shared-responsibility-model/)

VPC Peering

VPC peering is best described if we go back to the office building network; if one branch in Toronto wanted to connect to another location in Vancouver securely, they’d set up a VPN connection between offices. VPC peering is the same concept, except arguably better since it’s a Managed Service and therefore has no single point of failure, requires little user configuration, and requires no resource management. VPC peering also enhances security because all data passed between peered VPC’s is not exposed to the public Internet.

VPC Endpoints

Some AWS services - like the Simple Storage Service (S3) - are not deployed within a VPC. This means if you have resources in a VPC which need to communicate with S3, by default, that communication is done over the public Internet. If transferring data over the Internet is not possible, you can use [VPC Endpoints] (https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-endpoints.html). A VPC Endpoint allows you to create a private connection between your VPC and another AWS service. Unlike a traditional VPN connection, and much like VPC peering, the VPC Endpoint is a fully managed service from Amazon that scales horizontally, is highly available and redundant.

Virtual Private Gateway

For accessing your AWS environment from an on-premises site, you can set up a VPN or Direct Connect (DX) connection between your VPC and on-site network. In this article, we’re only going to talk about the VPN connection, because it’s the most common method new organizations use to get started. When it comes to creating a VPN connection, there are two primary methods of setting up the link to your VPC: AWS managed VPN or third-party software VPN. We won’t cover the third party option since the options vary widely and the management of the VPN relies solely on you, which is not something we would recommend. When setting up an AWS managed VPN, there are two components that you must set up within your AWS account: a Virtual Private Gateway and a Customer Gateway. The Virtual Private Gateway is the VPN concentrator on the Amazon side of the VPN connection. The Customer Gateway is where you provide all the details of your on-premises appliance that will connect to the VPC.

Wrapping up

In conclusion, a VPC is the foundation of any AWS environment much like any corporate network. As always, be sure to follow best practices for access control and implement the method of granting access on a least-privilege basis when allowing data to flow both in and out of your VPC.