Amazon Virtual Private Cloud

Amazon Virtual Private Cloud
Name	Amazon Virtual Private Cloud
Developer	Amazon Web Services
Released	2009
Operating system	Cross-platform
Genre	Virtual private cloud, Networking
License	Proprietary
Website	https://aws.amazon.com/vpc/

Amazon Virtual Private Cloud. It is a foundational service within the Amazon Web Services cloud computing platform that enables users to provision a logically isolated section of the Amazon Web Services cloud. Within this virtual network, users can launch Amazon Elastic Compute Cloud instances, Amazon Relational Database Service databases, and other Amazon Web Services resources in a user-defined virtual topology. This service provides granular control over the network environment, including selection of IP address ranges, creation of subnets, and configuration of route tables and network gateways.

Overview

Launched in 2009, the service was a pivotal development for Amazon Web Services, addressing enterprise demands for greater network isolation and control within the public cloud. It functions as a virtual data center in the cloud, allowing organizations to extend their existing on-premises computing infrastructure into Amazon Web Services using industry-standard encryption protocols. The architecture is regionally scoped but can be connected globally, forming a backbone for complex, distributed applications. Its design principles align with core cloud computing tenets of elasticity and scalability, while providing the familiar constructs of traditional information technology networking.

Core Concepts

The fundamental building block is the Virtual Private Cloud, which is logically isolated from other virtual networks in Amazon Web Services. Each VPC is created within a specific Amazon Web Services Region and consists of one or more subnets, which are segments of the VPC's IP address range placed in a specific Availability Zone. Connectivity is managed through Internet Gateways for public access and Virtual Private Gateways for establishing IPsec VPN connections to on-premises networks via Amazon Web Services Direct Connect. Traffic flow between subnets and to external networks is controlled by route tables and security groups, which act as stateful firewalls.

Key Features

Primary features include the ability to define custom IP address ranges using Classless Inter-Domain Routing notation and to create public and private subnets. Network access control is enforced through security groups and network access control lists. The service supports Elastic IP addresses for dynamic cloud computing and offers VPC peering to route traffic between VPCs using private IP addresses. Advanced networking capabilities include Amazon VPC Flow Logs for monitoring, AWS PrivateLink for private service access, and Transit Gateway for simplifying network architecture across multiple VPCs and on-premises data centers.

Use Cases

Common applications include hosting multi-tier web applications, where Amazon Elastic Compute Cloud instances in public subnets serve web traffic while Amazon Relational Database Service databases reside in private subnets. It is essential for creating hybrid cloud architectures, connecting to corporate data centers via VPN or Amazon Web Services Direct Connect. The isolation is critical for regulated industries, enabling secure environments for workloads subject to Health Insurance Portability and Accountability Act or Payment Card Industry Data Security Standard. Developers also use it to create isolated sandbox environments for testing and staging.

Security and Compliance

Security is a shared responsibility model between Amazon Web Services and the customer. The service provides multiple layers, including security groups at the instance level and network access control lists at the subnet level. Data in transit can be secured using IPsec VPN tunnels or Amazon Web Services Direct Connect. It supports integration with AWS Identity and Access Management for fine-grained access control and is a foundational component for achieving compliance with standards like ISO/IEC 27001, System and Organization Controls, and the Federal Risk and Authorization Management Program. Amazon GuardDuty can monitor VPC flow logs for threat detection.

Integration with AWS Services

The service is deeply integrated with the broader Amazon Web Services ecosystem. Most Amazon Web Services services, such as Amazon Simple Storage Service, Amazon DynamoDB, and Amazon Elastic Kubernetes Service, are designed to be deployed within a VPC or interface with it via VPC endpoints. Amazon CloudFront can originate from VPC resources, and AWS Lambda functions can be deployed inside a VPC to access internal resources. Monitoring and management are facilitated through Amazon CloudWatch and AWS CloudTrail.

Pricing and Billing

There is no additional charge for creating and using a VPC itself. Costs are incurred for the resources provisioned within the VPC, such as Amazon Elastic Compute Cloud instances, and for specific VPC capabilities like NAT Gateways, VPN Gateways, VPC peering (for cross-region peering), and data processing charges for Amazon VPC Flow Logs stored in Amazon Simple Storage Service or Amazon CloudWatch Logs. Data transfer charges apply for communication across Availability Zones, Amazon Web Services Regions, or to the public internet via an Internet Gateway.

Category:Amazon Web Services Category:Cloud computing providers Category:Virtual private networks