So far every instance went into a network you never saw. From this chapter on, the market gets a network of its own.
A VPC (Virtual Private Cloud) is a private network inside one region. Nothing reaches into it, and nothing in it reaches out, unless you build the path. It has a block of addresses and four kinds of parts:
| Part | Its job | Lesson |
|---|---|---|
| subnet | a slice of the VPC's addresses in one zone; instances live in subnets | 4 |
| route table | where traffic leaving a subnet goes | 5 |
| internet gateway | the door between the VPC and the internet | 6 |
| NAT gateway | a way out for subnets that must not be reachable | 8 |
Instances and security groups belong to a VPC. A database goes in a private subnet, where only the market's own servers can reach it; a web server goes in a public one.
The default VPC
Every region comes with a default VPC, 172.31.0.0/16, with one public subnet in each zone. That is where the instances of Chapter 3 went: a launch that names no subnet lands there.
aws ec2 describe-vpcs --query "Vpcs[].[VpcId,CidrBlock,IsDefault]" --output table| vpc-0021f4d143d89e84c | 172.31.0.0/16 | True |It is fine for experiments and wrong for a real application, because everything in it is public. The next lessons build the market a proper one.