# What a VPC Is — Cloud Networking: VPCs, Subnets & Peering

Source: https://www.skillbyai.com/en/cloud-networking/cn-vpc-basics

> Explain a Virtual Private Cloud, its address range and its default isolation, and compare it across AWS, Google Cloud and Azure.

## A private, isolated network you define

A **Virtual Private Cloud (VPC)** is a logically isolated network inside a cloud provider. When you create one you give it an IPv4 CIDR block, for example `10.0.0.0/16`, and every resource you launch inside it gets a private address from that range. By default, nothing outside the VPC can reach anything inside it, and resources in two different VPCs cannot talk to each other even if they belong to the same account. Connectivity has to be added on purpose: an internet gateway for the public internet, peering or a transit hub for other VPCs, a VPN for your office. In AWS a VPC lives in one **region** and you can attach additional CIDR blocks later if you run out. In Google Cloud a VPC network is **global** and its subnets are regional. An Azure **VNet** is regional, like AWS. Thinking of the VPC as a closed building with no doors yet is the right starting mental model.

## Creating a VPC with the AWS CLI

The `--query` and `--output text` options make the call print only the new `VpcId`, which is what you pass to every later command. Region and IDs will differ in your account.

```bash
aws ec2 create-vpc \
  --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=demo-vpc}]' \
  --query 'Vpc.VpcId' --output text

# Turn on DNS hostnames so instances get resolvable names
aws ec2 modify-vpc-attribute --vpc-id vpc-0123456789abcdef0 --enable-dns-hostnames '{"Value":true}'
```

## The default VPC is a convenience, not a design

AWS creates a default VPC in each region with public subnets in every Availability Zone, so instances get public IPs automatically. That is great for a first experiment and risky for production. Build your own VPC with deliberate public and private tiers.

**Quiz:** Two VPCs in the same AWS account and region are created with no extra configuration. Can an instance in one reach an instance in the other by private IP?

- [ ] Yes, because they share an account
- [x] No, VPCs are isolated until you connect them
- [ ] Only over IPv6
- [ ] Yes, if both use 10.x ranges

*Answer:* No, VPCs are isolated until you connect them. VPC isolation is the default. You must add peering, a transit gateway or another connection, plus routes and firewall rules.