Plenty of engineers deploy to AWS for years while quietly not understanding the VPC. Then something can't reach the internet, or a database is unreachable, and there is nowhere to hide. Here is the model that makes it click.
The VPC Is Your Private Network
A VPC (Virtual Private Cloud) is an isolated network inside AWS that you own. You give it a private IP range with a CIDR block:
VPC CIDR: 10.0.0.0/16 → ~65,000 private addresses to carve up
Nothing inside a VPC is reachable from the internet unless you deliberately open a path. That default isolation is the whole point.
Subnets Slice the VPC
A subnet is a slice of the VPC's IP range, and it lives in one availability zone. The crucial distinction is public vs private:
Public subnet: 10.0.1.0/24 → has a route to an Internet Gateway
Private subnet: 10.0.2.0/24 → no direct route to the internet
What makes a subnet "public" is not a checkbox — it is whether its route table sends traffic to an Internet Gateway.
Route Tables Decide Where Traffic Goes
Every subnet has a route table. It maps destinations to targets:
Destination Target
10.0.0.0/16 local (traffic within the VPC)
0.0.0.0/0 igw-xxxx (everything else → Internet Gateway = public)
Swap the internet gateway for a NAT gateway and the subnet becomes private-with-outbound: resources can reach out, but nothing can reach in.
The Standard Layout
The common, safe pattern: put load balancers in public subnets, and put application servers and databases in private subnets. Private resources reach the internet for updates through a NAT gateway in the public subnet, while staying unreachable from outside.
Internet → IGW → public subnet (load balancer) → private subnet (app) → private subnet (DB)
Summary
A VPC is your isolated private network; subnets carve it into zones; route tables decide what is reachable. Public means "routes to an Internet Gateway," private means it does not. Keep your databases and app servers private, expose only load balancers publicly, and use a NAT gateway for outbound. Once you see networking as route tables rather than magic, the whole thing stops being scary.