Home / Knowledge hub / Virtual private cloud
Knowledge hub
Virtual private cloud
A private, isolated network space inside a public cloud account.
What it means
A virtual private cloud, or VPC, is a logically isolated network that you define inside a public cloud account. You choose its address range, split it into subnets, and set routing and access rules for what may enter or leave.
Think of it as your own floor in a shared building. Other customers share the same provider, but their traffic cannot wander onto your floor unless you build a door. Which doors you build, and where they lead, is up to you.
Why it matters
Most cloud breaches begin with something reachable that should not have been. A database in a subnet with a route to the internet is one wrong checkbox away from being found by a scanner. The network layout is your first layer of defence.
It also limits damage. If one server is compromised, tight subnets and rules make lateral movement to the rest of the estate harder. Flat networks where everything talks to everything turn one small mistake into a large incident.
How it shows up
You meet VPCs the moment you create a cloud account. Typical design puts load balancers in public subnets and application servers and databases in private subnets with no direct route from the internet. Outbound access goes through a controlled gateway.
Mistakes repeat. The default network is used for production. Security rules allow all traffic from anywhere for convenience. A database gets a public address during debugging and keeps it. Review route tables and security groups, and test from outside to see what actually answers.
Questions people ask
Virtual private cloud, answered
Is a VPC the same as a firewall?
No. A VPC is the network space. Firewall-style controls such as security groups and network access lists sit inside it and decide which traffic is allowed. You need both the layout and the rules.
Is anything in a VPC automatically private?
No. Resources are private only if their subnet has no route to the internet and no public address. A VPC can be built so that nearly everything is exposed.
Do we need one VPC per environment?
Separating production from test is a sensible default, either with separate VPCs or separate accounts. It stops a mistake in a test environment from touching real data.
How do private servers reach the internet for updates?
Through a managed gateway that allows outbound connections only, or through a proxy you control. Inbound connections from the internet still have no path in.
Does a VPC replace application security?
No. It controls who can reach a service, not what the service does when someone does reach it. Flaws in the app itself remain.
Sources
Where this comes from
Related
Terms that sit next to this one
Security group
Cloud firewall rules that decide which traffic may reach a server.
Public cloud
Computing rented from a provider that shares its hardware across many customers.
Cloud misconfiguration
A cloud setting left unsafe, such as open storage or an overly broad permission.
Egress filtering
Limiting what your servers may connect out to, which blunts data theft.
Bastion host
A single hardened server that is the only way in for administrators.
What can reach your servers?
We check what an outsider can actually reach and what they can do once there, and we report only what we proved. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.