AWS for DevOps — VPC Basics

4.1 — VPC Basics

A VPC is a logically isolated virtual network that you define. You control the IP address range, create subnets, configure route tables, and set up gateways.

What Is CIDR?

CIDR (Classless Inter-Domain Routing) defines the size of your network:

CIDR	Total IPs	Usable IPs	Use Case
/16	65,536	65,531	Large VPC (AWS max for VPC)
/20	4,096	4,091	Medium subnet
/24	256	251	Standard subnet
/28	16	11	Tiny subnet (minimum for AWS)

AWS reserves 5 IPs per subnet: network address, VPC router, DNS, reserved, broadcast.

Private IP Ranges (RFC 1918)

Always use these ranges for VPCs:

Range	CIDR	Total IPs
10.0.0.0 – 10.255.255.255	10.0.0.0/8	16.7 million
172.16.0.0 – 172.31.255.255	172.16.0.0/12	1 million
192.168.0.0 – 192.168.255.255	192.168.0.0/16	65,536

Tip: Use 10.0.0.0/16 for production VPCs. Avoid 172.31.0.0/16 — that’s the default VPC range. If you plan to peer VPCs, make sure CIDRs don’t overlap.

Creating a VPC

$ aws ec2 create-vpc \
    --cidr-block 10.0.0.0/16 \
    --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=production-vpc}]'
{
    "Vpc": {
        "VpcId": "vpc-0abc123",
        "CidrBlock": "10.0.0.0/16",
        "State": "available"
    }
}

# Enable DNS hostnames (needed for public DNS names)
$ aws ec2 modify-vpc-attribute \
    --vpc-id vpc-0abc123 \
    --enable-dns-hostnames '{"Value": true}'

# Enable DNS resolution
$ aws ec2 modify-vpc-attribute \
    --vpc-id vpc-0abc123 \
    --enable-dns-support '{"Value": true}'

Default VPC vs Custom VPC

Aspect	Default VPC	Custom VPC
Created by	AWS (one per region)	You
CIDR	172.31.0.0/16	You choose
Subnets	One per AZ (public)	You create
Internet Gateway	Pre-attached	You create
Use case	Quick tests, learning	Production

Never use the default VPC for production. It has wide-open security groups and all subnets are public.

VPC Components Overview

  VPC (10.0.0.0/16)
  │
  ├── Subnets (divide the VPC into segments)
  │   ├── Public Subnet  (10.0.1.0/24)  → has route to IGW
  │   └── Private Subnet (10.0.10.0/24) → no route to IGW
  │
  ├── Route Tables (control where traffic goes)
  │   ├── Public RT  → 0.0.0.0/0 → IGW
  │   └── Private RT → 0.0.0.0/0 → NAT Gateway
  │
  ├── Internet Gateway (connects VPC to internet)
  │
  ├── NAT Gateway (lets private subnets reach internet)
  │
  ├── Security Groups (instance-level firewall)
  │
  └── NACLs (subnet-level firewall)

Real-World Analogy

Think of a VPC as a gated office campus:

• The VPC is the campus boundary with a fence (CIDR range)
• Subnets are individual buildings
• Public subnets have a visitor entrance (Internet Gateway)
• Private subnets are internal buildings (no direct visitor access)
• NAT Gateway is a mail room — internal staff can send mail out, but outsiders can’t walk in
• Security groups are the badge readers on each door
• NACLs are the security checkpoints at each building entrance

Listing VPCs

$ aws ec2 describe-vpcs \
    --query 'Vpcs[*].[VpcId,CidrBlock,Tags[?Key==`Name`].Value|[0],IsDefault]' \
    --output table
--------------------------------------------------
|  vpc-default123  | 172.31.0.0/16 | default     | true  |
|  vpc-0abc123     | 10.0.0.0/16   | production  | false |
--------------------------------------------------

Quick Reference

Task	Command
Create VPC	aws ec2 create-vpc --cidr-block 10.0.0.0/16
Enable DNS hostnames	aws ec2 modify-vpc-attribute --vpc-id VPC --enable-dns-hostnames '{"Value":true}'
List VPCs	aws ec2 describe-vpcs
Delete VPC	aws ec2 delete-vpc --vpc-id VPC (must remove all resources first)

---

Next → Subnets & Route Tables