Learn Cloud Computing - Virtual Private Cloud (VPC) & Cloud Networking

#Introduction

In the previous episode, episode 4, you learned about Identity & Access Management — how to grant permissions to users, roles, and applications to access a cloud account. But there's one question that hasn't been answered: permissions to access what? The answer is in this episode: the virtual network where all your cloud resources live.

Episode 5 covers the foundation of cloud networking: the Virtual Private Cloud (VPC). We'll look at network isolation concepts, the global cloud infrastructure map (region, availability zone, edge location), VPC anatomy like subnets, internet gateways, NAT gateways, and route tables, then close with a comparison of how AWS VPC, GCP VPC, and Azure VNet work.

#Why Do You Need Network Isolation?

Imagine a big city where millions of people live on the same land. All cloud customers share the same physical data centers — that's what "multi-tenant" means. If there were no boundaries between residents, one tenant's data and traffic could "bump into" another tenant. A VPC is your house fence in that city: a fully isolated logical network, complete with its own IP addresses, its own access rules, and its own entrance and exit points.

With a VPC, you decide for yourself:

• The private IP address range (CIDR) your resources use.
• How the rooms inside that house are divided (subnets).
• The entrance and exit points to the internet (internet gateway, NAT gateway).
• The traffic signs that direct packet flow (route tables).

#The Cloud Territory Map: Region, Availability Zone, and Edge Location

Before building a network, you must understand the "map" where that network lives. Cloud providers build global infrastructure in three layers:

A Region is the "city" where you place resources. Availability Zones are the different "buildings" in that city — physically close enough for low latency, but separate enough that a power or network failure in one building won't bring down another. This is why placing applications across two or more AZs is the key to high availability, a topic we'll dive into in episode 8.

One thing that often confuses beginners: an edge location is not a place to run virtual machines. An edge only stores cache and DNS answers near users. VMs still must live in a region — the edge has no "rooms" for that.

#VPC Anatomy: Subnets, Route Tables, Internet Gateways, and NAT Gateways

A VPC isn't useful as a single solid block — you have to divide it into parts with different roles.

#Public Subnets vs Private Subnets

A subnet is a division of the IP address space inside a VPC. There are two "types", which are actually determined by their routes, not their labels:

• Public subnet: has a route to the internet through an internet gateway. Used for resources that must be accessible from outside, such as load balancers or web servers.
• Private subnet: has no inbound route from the internet. Used for sensitive resources like databases or application servers — they must not be directly reachable from the outside world.

#Internet Gateway (IGW)

An internet gateway is a two-way door that connects a VPC to the internet. It attaches at the VPC level (not per subnet), and it's always "one per VPC". Without an IGW, a public subnet is just an ordinary subnet connected to nowhere.

#NAT Gateway

A NAT gateway is a one-way outbound door. Imagine a phone that can make outgoing calls but can't receive incoming ones. With a NAT gateway, resources in a private subnet can download packages, run system updates, or call external APIs — without opening themselves to incoming connections from the internet.

#Route Tables

A route table is the network's traffic sign board. Every subnet must be associated with one route table that tells packets where to go. The contents of a route table look roughly like this:

The route 0.0.0.0/0 means "all addresses not more specific than any other route". That's why the local route must always win: inter-subnet traffic will never leak out to the internet.

Internet
   |
[Internet Gateway]
   |
Public Subnet  (route 0.0.0.0/0 -> igw-xxx)
   |
[NAT Gateway]
   |
Private Subnet  (route 0.0.0.0/0 -> nat-xxx)

#CIDR and Subnetting in Practice

CIDR is a shorthand way to write IP address ranges: the /16, /24, or /28 after an IP indicates how many addresses are covered. The smaller the number after the slash, the larger the range.

#Creating a VPC with the AWS CLI

Let's practice it with the AWS CLI. aws ec2 create-vpc creates a VPC with a given CIDR:

aws ec2 create-vpc --cidr-block 10.0.0.0/16

Once the VPC exists, we create subnets inside it, then create and attach an internet gateway. These commands can be chained into a single flow:

VPC_ID=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 --query Vpc.VpcId --output text)
aws ec2 create-subnet --vpc-id "$VPC_ID" --cidr-block 10.0.1.0/24 --availability-zone us-east-1a
IGW_ID=$(aws ec2 create-internet-gateway --query InternetGateway.InternetGatewayId --output text)
aws ec2 attach-internet-gateway --vpc-id "$VPC_ID" --internet-gateway-id "$IGW_ID"

Notice: aws ec2 create-subnet requires --availability-zone — this is why subnets on AWS are tied to one AZ, while the VPC itself spans the entire region.

#Comparing AWS VPC, GCP VPC, and Azure VNet

The concept is the same, but the design details differ. The most fundamental difference is scope: whether a network can span more than one region.

For comparison, here are the network creation commands on the other two providers:

# GCP
gcloud compute networks create production --subnet-mode custom
 
# Azure
az network vnet create --name production-vnet --address-prefix 10.0.0.0/16 --resource-group production-rg

gcloud compute networks create and az network vnet create both build the "house fence" of their respective providers — the difference is only in scope and the options provided.

#Conclusion

In this episode 5, we've built the cloud networking foundation: why a VPC is needed for logical isolation in a multi-tenant environment, the global infrastructure map (region, AZ, edge location), and VPC anatomy with public/private subnets, internet gateways, NAT gateways, and route tables. You also saw how to create a VPC and subnet via the AWS CLI, plus the design differences between AWS, GCP, and Azure.

The keys to take away:

• Region, AZ, and edge location are three cloud geography layers with different roles.
• Public subnets are open to the internet via the IGW; private subnets only go out via a NAT gateway.
• Route tables are the traffic-routing brain: local always wins over internet routes.
• AWS and Azure VPCs are regional, GCP is global — understand the consequences when designing architectures.

Now you have a "house" in the form of a VPC. In the next episode, episode 6, we'll fill it with inhabitants: Cloud Compute Services (Virtual Machines) — how VMs run on top of hypervisors, instance categories that match your workloads, and the on-demand, reserved, and spot purchasing models that can save up to 90 percent of costs.