A VPC (Virtual Private Cloud) is the network foundation everything else in your AWS account sits on. Get it wrong early, and you end up re-architecting under pressure later. Get it right, and it quietly supports years of growth without a second thought.
Start With Subnet Separation
- Public subnets — for resources that need direct internet access, like load balancers
- Private subnets — for application servers and databases that should never be directly reachable from the internet
- Route traffic from private subnets to the internet through a NAT Gateway, not a direct route
This separation alone prevents an entire category of accidental exposure.
Plan Your IP Ranges Before You Need To
- Choose a CIDR block large enough for future growth — resizing later means recreating the VPC
- Reserve separate ranges for each environment (production, staging, dev) to avoid overlap if you ever need to peer them
- Leave room between subnets for new subnet types you have not built yet
Security Groups and NACLs Serve Different Purposes
- Security Groups — stateful, attached to individual resources, the primary line of defense
- Network ACLs — stateless, applied at the subnet level, useful as a broad secondary control
Most teams over-rely on wide-open security groups. Scope rules to specific ports and specific source security groups rather than open CIDR ranges wherever possible.
Multi-AZ by Default
- Spread subnets across at least two Availability Zones
- Deploy application and database resources redundantly across those zones
- A single-AZ architecture works until that one zone has an issue — then everything goes down at once
Connecting to the Outside World
- Use a NAT Gateway for outbound-only internet access from private subnets
- Use VPC Peering or Transit Gateway to connect multiple VPCs without routing through the public internet
- Use Site-to-Site VPN or Direct Connect for secure connections back to on-premises infrastructure
Things Businesses Get Wrong
- Putting databases in public subnets because it was faster to set up initially
- One giant flat subnet with no separation between application tiers
- No VPC Flow Logs enabled, making it impossible to investigate unusual traffic after the fact
- Security groups with 0.0.0.0/0 access left over from testing and never tightened
A well-designed VPC is not something end users ever notice — which is exactly the point. It should quietly enforce security and support growth without becoming a project of its own six months from now.
