- Logical isolation: VPCs provide a secure “bubble” for your cloud resources, separated from other customers’ networks.
- Network control: Define IP ranges, subnets, routing tables, and security (firewall) rules.
- Flexible connectivity: Connect VPCs to each other or on-premises networks using peering, VPNs, or dedicated interconnects.
- Compliance and segmentation: Use subnets and firewall rules to isolate environments (production, staging, dev).
- The cloud provider is the building owner/manager: they run the physical datacenter, network backbone, and managed platform services.
- Your VPC is your apartment: you design the layout, pick which rooms (subnets) you use, and control who can enter (firewall rules).
- Tenants are separate customers: activities inside one tenant’s apartment don’t affect other tenants unless explicitly connected.
| Concept | Cloud equivalent | What you control |
|---|---|---|
| Building / Owner | Cloud provider infrastructure (data center, physical networking) | Nothing — provider-managed (physical security, power, backbone) |
| Apartment / Tenant space | VPC (virtual network) | IP addressing, subnets, routing, firewall/security rules |
| Rooms | Subnets | IP range allocation, resource placement (zones/regions) |
| Doors & locks | Firewall rules / Security groups | Allow/block traffic to/from resources |
| Hallways & elevators | Routing, load balancers, gateways | How traffic flows between subnets, VPCs, and the internet |
| Inter-apt connections | VPC peering, VPN, Interconnect | Explicitly configured cross-VPC or on-prem connectivity |
- Shared responsibility: The provider secures and operates the physical layer; you are responsible for network design, segmentation, and access controls inside your VPC.
- Isolation: VPCs are isolated at the network level. No cross-VPC access occurs unless you configure VPC peering, a VPN, or a dedicated interconnect.
- Segmentation: Use subnets and IP ranges to separate environments and control communication with routing and firewall rules.
- Naming and IP planning: Plan CIDR ranges and subnet sizes early to avoid overlapping address spaces when you later peer VPCs or connect to on-prem networks.
VPCs give you network-level isolation and control. The provider secures and operates the physical infrastructure, while you design IP addressing, subnets, firewall policies, and routing for your workloads.
- VPC Peering — Private, non-transitive connection between two VPCs for low-latency internal traffic.
- VPN — Encrypted tunnel for secure connectivity between a VPC and on-premises networks or other clouds.
- Interconnect / Direct Connect — Dedicated, high-throughput private link between your network and the cloud provider.
- Shared VPC / Transit Gateway / Hub-and-spoke — Centralized models for managing many VPCs at scale.