Amazon Virtual Private Cloud (VPC) lets you launch AWS resources in a private, isolated cloud.

Asecurity groupacts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups.

Security groups

Anetwork access control list (ACL)is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC.

Network ACLs

A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them privately. Instances in either VPC can communicate with each other as if they are within the same network. You can create a VPC peering connection between your own VPCs, with a VPC in another AWS account, or with a VPC in a different AWS Region.

Peering connections

You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the internet or other AWS services, but prevent the internet from initiating a connection with those instances.

NAT gateways

AWS Client VPN is a managed client-based VPN service that enables you to securely access your AWS resources or your on-premises network. With AWS Client VPN, you configure an endpoint to which your users can connect to establish a secure TLS VPN session. This enables clients to access resources in AWS or an on-premises from any location using an OpenVPN-based VPN client.

Client VPN endpoints

You can create an IPsec VPN connection between your VPC and your remote network. On the AWS side of the Site-to-Site VPN connection, a virtual private gateway or transit gateway provides two VPN endpoints (tunnels) for automatic failover.

Site-to-Site VPN connections

A virtual private gateway is the router on the Amazon side of the VPN tunnel.

Virtual private gateways

Acustomer gateway deviceis a physical or software appliance that you own or manage in your on-premises network (on your side of a Site-to-Site VPN connection).

Customer gateways

A transit gateway has a default route table and can optionally have additional route tables. A route table includes dynamic and static routes that decide the next hop based on the destination IP address of the packet.

Transit Gateway route tables

You can attach a VPC, an AWS Direct Connect gateway, a peering connection with another transit gateway, or a VPN connection to a transit gateway.

Transit Gateway attachments

Atransit gatewayis a network transit hub that you can use to interconnect your virtual private clouds (VPC) and on-premises networks.

Transit gateways

Use a traffic mirror filter and its rules to define the traffic that is mirrored. A traffic mirror filter contains one or more traffic mirror rules, and a set of network services.

Traffic Mirror filters

A target is the destination for a traffic mirror session.

Traffic Mirror targets

A traffic mirror session establishes a relationship between a traffic mirror source and a traffic mirror target.

Traffic Mirror sessions

Transit Gateway supports routing multicast traffic between subnets of attached VPCs and serves as a multicast router for instances sending traffic destined for multiple receiving instances.

Transit Gateway multicast

A prefix list is a set of one or more CIDR blocks. There are two types of prefix lists: AWS-managed prefix list and Customer-managed prefix list.

Managed prefix lists

A global network is a container for your network objects, where you can register Transit Gateways and create Core Networks. You can also define your on-premise network and view all networks in one dashboard.

Global Network

An Elastic IP address is a static, public IPv4 address designed for dynamic cloud computing. You can associate an Elastic IP address with any instance or network interface in any VPC in your account. With an Elastic IP address, you can mask the failure of an instance by rapidly remapping the address to another instance in your VPC.

Elastic IP addresses

Cloud WAN makes it easy for enterprises to build, manage, and monitor their global networks across their cloud and on-premises environments. Cloud WAN provides a central dashboard that enterprises can use to connect their on-premises branch offices, data centers, and VPCs across the AWS global network.

Core Network

The Dynamic Host Configuration Protocol (DHCP) provides a standard for passing configuration information to hosts on a TCP/IP network. The options field of a DHCP message contains configuration parameters, including the domain name, domain name server, and the netbios-node-type.

DHCP options sets

Cloud WAN

A carrier gateway provides connectivity to the carrier network for resources in a Wavelength VPC.

Carrier gateways

An egress-only internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows outbound communication over IPv6 from instances in your VPC to the internet, and prevents the internet from initiating an IPv6 connection with your instances.

Egress-only internet gateways

An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet.

Internet gateway

A route table contains a set of rules, called routes, that are used to determine where network traffic from your subnet or gateway is directed.

Route table

To add a new subnet to your VPC, you must specify an IPv4 CIDR block for the subnet from the range of your VPC. You can specify the Availability Zone in which you want the subnet to reside. You can have multiple subnets in the same Availability Zone.

Subnet

A virtual private cloud (VPC) is a virtual network dedicated to your AWS account. It is logically isolated from other virtual networks in the AWS Cloud. You can launch your AWS resources, such as Amazon EC2 instances, into your VPC.

Your VPCs

You can create your own application in your VPC and configure it as an AWS PrivateLink-powered service (referred to as an endpoint service). Other AWS principals can create a connection from their VPC to your endpoint service using an interface VPC endpoint. You are the service provider, and the AWS principals that create connections to your service are service consumers.

Endpoint services

VPC endpoints enable you to privately access AWS services, VPC endpoint services, VPC Resources such as databases and clusters, Lattice services and service-networks across VPCs and from on-premises.

Endpoints

VPC Reachability Analyzer is a configuration analysis tool that enables you to perform connectivity testing between a source resource and a destination resource in your virtual private clouds (VPCs).

VPC Reachability Analyzer

AWS Network Manager provides tools and features to help you manage and monitor your network on AWS.

Network Manager

You can attach your VPCs and other networks to a Core Network for global connectivity.

Core Network Attachments

Network Access Analyzer is a feature that identifies unintended network access to your resources on AWS. You can use Network Access Analyzer to specify your network access requirements and to identify potential network paths that do not meet your specified requirements.

Network Access Analyzer

Amazon VPC IP Address Manager (IPAM) makes it easier to manage and monitor IP addresses at scale across AWS resources

Amazon VPC IP Address Manager

AWS Verified Access makes it easier to enable secure access for corporate applications without requiring a VPN. Built on AWS Zero Trust principles, AWS Verified Access continuously validates each and every application request in real-time before granting access.

AWS Verified Access

AWS Network Firewall is a stateful, managed network firewall and intrusion detection and prevention service that lets you filter traffic at the perimeter of your VPCs.

AWS Network Firewall

Simplify networking for service-to-service communication

Amazon VPC Lattice

View an overview of your VPC resources in the region; quickly find a resource by its resource ID; opt-in to VPC experimental features and discover new VPC capabilities.

Dashboard

DNS Firewall filters and regulates outbound DNS traffic for your VPCs. You create reusable collections of filtering rules in DNS Firewall rule groups, associate the rule groups to your VPC, and then monitor activity in DNS Firewall logs and metrics.

DNS Firewall

Rule groups are a named, reusable collection of DNS Firewall rules for filtering DNS queries. You populate the rule group with the filtering rules, then associate the rule group with one or more VPCs. If you associate multiple rule groups with a single VPC, you indicate their processing order through the priority setting in each association. DNS Firewall processes rule groups for a VPC from the lowest numeric priority setting on up.

Rule groups

Domains lists are a named, reusable collection of domain specifications for use in DNS filtering. Each rule in a rule group requires a single domain list. You can choose to specify the domains that you want to allow or block access to. You can create your own domain lists or use domain lists that AWS manages for you.

Domains lists

Service networks enable you to centrally organise VPC resources and services, and access them from your VPCs directly or using a VPC endpoint

Service Network

Resource configurations let you share VPC Resoures across accounts. VPC Resources are resources such as databases and clusters that are in your VPC or in an environment connected to your VPC.

Resource Configurations

Resource gateways let you share resources from your VPC with other accounts/VPCs.

Resource Gateways

A Lattice target group is a collection of targets, or compute resources, that run your application or service. Targets can be EC2 instances, IP addresses, Lambda functions, Application Load Balancers or Kubernetes Pods.

Target groups

A Lattice service is an independently deployable unit of software that delivers a specific task or function. It can run on instances, containers or as serverless functions.

VPC
Networking & Content Delivery

Overview

Key Features

Links

Related Services

Amazon VPC

Elastic Load Balancing

Amazon EBS

Modern BDD Test Automation with Playwright, Typescript

AWS Cloud Mastery

VPCNetworking & Content Delivery