Skip to main content
This lesson explains AWS Default VPCs — the ready-made virtual networks AWS creates in each region so you can launch internet-reachable instances quickly. You’ll see the default VPC configuration, how subnets are arranged across Availability Zones, and how an EC2 instance launched into a default subnet receives a public IP and internet access.

​
Open the VPC console

In the AWS Management Console search for “VPC” or open it from the console home. The default VPC is created in every AWS region and uses the same basic configuration (including the same CIDR block). This example uses the N. Virginia (us-east-1) region.
A screenshot of the Amazon Web Services VPC Management Console showing the VPC dashboard with "Create VPC" and "Launch EC2 Instances" buttons. The page lists resource summary tiles (VPCs, subnets, route tables, security groups, NAT gateways, etc.) plus navigation and settings panels.

​
Inspect the default VPC

When your account is new, you should see one VPC marked as the default. Open it and review these key properties:
  • State: available
  • CIDR block: 172.31.0.0/16
  • Default VPC: yes
You can inspect related resources (route tables, network ACLs, security groups), but the essential point is that AWS has created a usable VPC for you and designated it as the default so you can launch instances without pre-provisioning networking. Tip: If you switch regions (for example to Ohio / us-east-2) you’ll find another default VPC with the same CIDR block. AWS creates one default VPC per region.

​
Default VPC components

The default VPC includes a standard set of resources that make launching public instances straightforward: For more details, see the official AWS documentation: Amazon VPC documentation.

​
Examine default subnets

Open the Subnets page and note that AWS creates one subnet per Availability Zone in the region (for us-east-1 that’s typically six subnets: us-east-1a through us-east-1f). Each subnet is associated with the same default VPC.
A screenshot of the AWS VPC management console showing the Subnets page: a list of subnet IDs with their IPv4 CIDR blocks and availability state, plus a details pane displaying properties for the selected subnet.
Important behaviors of default subnets:
  • They are configured with Auto-assign public IPv4 = enabled, so instances launched into them receive a public IPv4 address automatically.
  • They are associated with the default route table, which contains a 0.0.0.0/0 route pointing to the IGW.
  • The IGW attached to the VPC enables both outbound internet access and inbound reachability for instances that have public IPs and permissive security group rules.

​
Launch an EC2 instance in the default VPC

You can demonstrate the default VPC behavior by launching a simple EC2 instance into a default subnet. The steps below accept the standard EC2 defaults (AMI, instance type) to focus on networking behavior. Open the EC2 Launch Instance workflow and accept the defaults for AMI and instance type.
A screenshot of the AWS EC2 "Launch an instance" page showing the Name and tags field and the Application and OS Images (AMI) selection with tiles for Amazon Linux, macOS, Ubuntu, Windows, Red Hat, and SUSE. A right-hand Summary panel lists instance details (AMI, t2.micro instance type, security group, storage) and a "Launch instance" button.
Create or choose a key pair so you can SSH into the instance. In the networking step, select the default VPC (or leave subnet as “No preference” to let AWS pick). Ensure Auto-assign Public IP is set to “Enable” — this is the default for the default subnets.
A screenshot of the AWS EC2 "Launch an instance" console showing Network settings with a VPC selected and a subnet dropdown open. The right-hand Summary panel lists the AMI (Amazon Linux 2023), instance type (t2.micro) and a "Launch instance" button.
After launching, the instance will move to the running state and show both a private IP from 172.31.0.0/16 and a public IPv4 address — confirming it is in the default VPC and received a public IP automatically.
A screenshot of the AWS EC2 Management Console showing a running EC2 instance. The details pane shows the instance ID, instance type (t2.micro), public IPv4 and private IP/DNS and status information.

​
Verify connectivity (SSH and ping)

You can SSH to the instance using the downloaded key pair and verify outbound internet access (for example, by pinging 8.8.8.8). Example SSH session:
This confirms outbound internet connectivity. SSH access from the internet was possible in this example because:
  • The instance received a public IPv4 address, and
  • The instance’s security group was configured with an inbound rule allowing SSH from the relevant source IP.
Default VPC resources are convenient for quick tests but are not hardened for production. The AWS default security group does not, by itself, allow SSH from the public internet — you must explicitly add an inbound rule to permit SSH from your IP range (avoid 0.0.0.0/0 unless strictly necessary). Always follow the principle of least privilege for security group and NACL rules.
Default VPCs let you launch instances and get internet connectivity quickly. For production workloads, design custom VPCs and subnet architectures with appropriate security controls (security groups, NACLs, route tables, NAT gateways) and consider private subnets for backend services.

​
Further reading

Watch Video