AWS VPC: The Complete Guide to Virtual Private Cloud in 2026

A Virtual Private Cloud (VPC) is a logically isolated network environment inside AWS. Every resource you launch — EC2 instances, RDS databases, Lambda functions, EKS clusters — lives inside a VPC. AWS gives every account a default VPC in each region, but production systems almost always use a custom VPC for full control over IP ranges, subnet layout, routing rules, and security boundaries.

The core building block is a CIDR block. A /16 VPC gives 65,536 IP addresses, while a /24 subnet provides 251 usable IPs (AWS reserves 5 per subnet). The default limit is 5 VPCs per region, but this can be raised via a support request. Once created, a VPC's primary CIDR block cannot be changed — choose carefully upfront.

Four components form the backbone of every VPC architecture. Understanding each one — and the relationship between them — is prerequisite knowledge for any AWS certification or production role.

AWS creates a default VPC in every region with public subnets, an attached IGW, and a permissive security group. This is intentionally convenient for experimentation — everything works without configuration. Production workloads require a custom VPC for security, compliance, and network control.

Proper CIDR planning at the start avoids painful re-architecting later. A standard 3-tier layout uses a /16 VPC subdivided into /24 subnets — one pair per tier (public, app, data) across two or three Availability Zones.

# VPC
VPC CIDR:        10.0.0.0/16     # 65,536 IPs total

# Public subnets (load balancers, NAT GW, bastion)
Public-A:        10.0.1.0/24     # us-east-1a
Public-B:        10.0.2.0/24     # us-east-1b

# Private app subnets (EC2, Lambda, ECS, EKS)
Private-App-A:   10.0.3.0/24     # us-east-1a
Private-App-B:   10.0.4.0/24     # us-east-1b

# Private data subnets (RDS, ElastiCache, OpenSearch)
Private-Data-A:  10.0.5.0/24     # us-east-1a
Private-Data-B:  10.0.6.0/24     # us-east-1b

# Reserve 10.0.10-20.x for future services / peered VPCs

Both security groups and Network Access Control Lists (NACLs) control traffic flow, but they operate at different levels and with different behaviors. Most architectures rely primarily on security groups and use NACLs as a secondary defense layer.

When multiple VPCs need to communicate — across accounts, across regions, or both — the choice between VPC Peering and Transit Gateway depends on the number of VPCs and whether on-premises connectivity is required.

By default, AWS API calls from inside a VPC route over the public internet — even for services in the same region. VPC endpoints keep that traffic on the private AWS backbone, eliminating data transfer charges and improving security posture.

Teams building AI pipelines on AWS frequently underestimate networking costs and compliance requirements. The architecture decisions below apply whether the workload uses Bedrock, SageMaker, or custom model inference.

What is an AWS VPC and why do I need one?

An AWS VPC is a logically isolated section of the AWS cloud where resources launch inside a network you define. Every account gets a default VPC, but production workloads should use a custom VPC to control IP ranges, subnet topology, routing, and security rules. Without explicit VPC design, EC2 instances, RDS databases, and Lambda functions share a flat network with unpredictable exposure.

What is the difference between a security group and a NACL?

Security groups are stateful firewalls attached to individual resources. If inbound traffic is allowed on port 443, return traffic is automatically allowed. NACLs are stateless firewalls attached to subnets — inbound and outbound rules must be configured independently. Security groups are the primary control in most architectures; NACLs provide a second layer, especially for blocking IP ranges at the subnet boundary.

When should I use VPC peering vs Transit Gateway?

VPC peering creates a direct point-to-point connection between two VPCs. It's simple and cost-effective for two or three VPCs. The limitation: peering is non-transitive, so if VPC A peers with B and B peers with C, traffic cannot flow A → C through B. Transit Gateway acts as a central hub routing traffic among many VPCs and on-premises networks. Four or more VPCs, or any hybrid-cloud connectivity, almost always justifies Transit Gateway despite its per-attachment hourly cost.

How do VPC endpoints save money and improve security?

Without endpoints, AWS API calls from inside a VPC route over the public internet — even for services in the same region, incurring data transfer charges. VPC endpoints route traffic through the AWS private backbone instead. S3 and DynamoDB Gateway Endpoints are free. Interface Endpoints for Bedrock, SageMaker, and Secrets Manager cost $0.01/hr per AZ. For AI/ML pipelines moving large datasets through S3, the transfer savings quickly exceed the endpoint cost — and the security benefit (traffic never leaves AWS) is equally important for regulated workloads.