VPC explained: the ten minutes that make AWS click

A VPC is a private network you own inside AWS. That is the whole idea. Everything else is plumbing.

Start with one question

Does this thing need to be reachable from the internet?

If yes, it goes in a public subnet. If no, it goes in a private subnet. Most VPC confusion disappears once you answer that question per resource instead of per subnet name.

The pieces

CIDR block. The address range, for example 10.0.0.0/16. Write it down before you build anything; changing it later means rebuilding.

Subnets. Slices of that range, each tied to one Availability Zone. A subnet cannot span AZs — this is why "highly available" always means two subnets in two AZs.

Route table. A list of "traffic to this destination goes that way". A public subnet's table sends 0.0.0.0/0 to an internet gateway. A private subnet's table sends it to a NAT gateway instead.

Internet gateway. The door to the internet. Attaching it to the VPC does nothing on its own; the route table is what opens the door for a subnet.

NAT gateway. Lets private resources make outbound requests without accepting inbound ones. It lives in a public subnet and costs money per hour and per gigabyte.

Security groups. Stateful, allow-only firewalls attached to resources. Network ACLs are stateless and attached to subnets. If you only remember one, remember that security groups are stateful.

Build it once

Create a VPC, two public subnets in two AZs, two private subnets, an internet gateway, a NAT gateway in one public subnet, and route tables that send public traffic to the gateway and private traffic to the NAT.

Then put an EC2 instance in each private subnet with no public IP, and check that it can reach the internet but the internet cannot reach it. That single test teaches more than any diagram.

The exam angle

SAA questions about networking are almost always testing one of three things: which subnet a resource must live in, whether traffic is allowed by a security group, or whether the traffic is even routed. Answer those in order and the option usually eliminates itself.

Our live SAA batch builds this exact lab in week three, then breaks it on purpose.