All Services
Networking & CDN
Amazon Virtual Private Cloud
Amazon Virtual Private Cloud provides logically isolated regional networks with IPv4 and IPv6 address space, subnets, route tables, gateways, security groups, network ACLs, endpoints, DNS controls, traffic mirroring, and flow logs.
Explore pricing models, common use cases, infrastructure support, and the AWS services that commonly work with Amazon Virtual Private Cloud.
Amazon Virtual Private Cloud pricing and cost programs
Pricing model: Network resource and processing usage
- On-Demand
- Service-specific
- Reserved Instances or reserved capacity
- Not applicable
- Savings Plans
- Not applicable
- Spot
- Not applicable
Billing dimensions: Public IPv4 addresses · NAT gateways · Traffic mirroring · IPAM and network analysis
Programs and modes: VPC itself has no additional charge · NAT Gateway · IPAM · Reachability Analyzer
Core VPC constructs are generally unmetered, but gateways, addresses, analysis, endpoints, and transfer can incur charges.
Free Tier: Service-specific — verify current offers
Pricing reviewed 2026-07-25. Reviewed against the linked official AWS pricing page. Recheck regional rates and program terms before purchase.
Official AWS pricing
Official AWS sources reviewed 2026-07-21.
Why implement Amazon Virtual Private Cloud?
- Provides software-defined network isolation and routing without physical routers, switches, firewalls, or address-management appliances.
- Supports public, private, isolated, dual-stack, hybrid, shared, and multi-account architectures across Availability Zones.
- Integrates layered controls and telemetry through security groups, network ACLs, endpoints, Network Firewall, DNS, flow logs, Config, and CloudTrail.
How to implement Amazon Virtual Private Cloud
- Plan non-overlapping IPv4 and IPv6 ranges through IPAM, accounts, Regions and Availability Zones; reserve growth space and document trust zones, naming, tagging, routing, DNS, egress, hybrid and shared-service ownership.
- Create subnets and route tables per trust and availability boundary, use stateful security groups as the primary workload control, add NACLs only for deliberate subnet guardrails, and prefer private endpoints for supported dependencies.
- Enable flow logs and configuration monitoring, test ingress, egress, DNS, return paths and failures, scan for broad rules and unused public IPs, and regularly reconcile routes, endpoints, peering, gateways and quotas.
Amazon Virtual Private Cloud best practices
- Design for multiple Availability Zones without assuming a subnet spans zones, avoid overlapping CIDRs, adopt IPv6 deliberately, and use IPAM rather than spreadsheets as environments scale.
- Minimize public IPv4 addresses and direct internet paths, restrict both inbound and outbound traffic, reference security groups where supported, and use centralized inspection only with validated symmetric routing.
- Enable VPC Flow Logs at an appropriate scope, protect log destinations, pair telemetry with Config and GuardDuty, and test connectivity with supported analysis tools before changing production routes.
Amazon Virtual Private Cloud use cases and server impact
- Multi-tier private application networks
- Shared-service and multi-account landing zones
- Hybrid and dual-stack cloud connectivity
Replaces much physical network and virtual-appliance topology, while address planning, segmentation, routing, egress, firewall policy, DNS, hybrid resilience, and traffic analysis remain customer responsibilities.
Official implementation resources
How Amazon Virtual Private Cloud works with other AWS services
Arrows show the documented technical direction. Reciprocal navigation does not imply a reverse technical dependency.
Official AWS sources reviewed 2026-07-25.
Amazon Virtual Private Cloud → Amazon Elastic Container Service
ECS tasks using awsvpc networking receive elastic network interfaces in selected VPC subnets and are controlled by security groups.
- Why teams use it
- Teams can isolate application tiers and use private connectivity while keeping routing policy independent from container scheduling.
- Permissions and networking
- Plan address space and subnet capacity, restrict security-group ingress, and provide NAT or VPC endpoints for required outbound service access.
- Pricing and security caveats
- NAT gateways, public IPv4 addresses, endpoints, and cross-AZ traffic can add cost. A VPC does not automatically make workloads private or secure.
Amazon Virtual Private Cloud → Amazon Elastic Kubernetes Service
EKS cluster and pod networking use VPC subnets, routes, security groups, and elastic network interfaces.
- Why teams use it
- The integration gives Kubernetes workloads native reachability to AWS resources and familiar network controls.
- Permissions and networking
- Size pod address capacity, separate public and private access deliberately, and restrict both cluster endpoint and workload security groups.
- Pricing and security caveats
- Private networking can add NAT or endpoint charges, and Kubernetes network policy is a separate control from VPC security groups.
Amazon Virtual Private Cloud → Amazon Relational Database Service
An RDS DB instance or cluster is placed in a DB subnet group and accepts connections according to VPC routing and security groups.
- Why teams use it
- A private data tier limits database exposure while allowing approved application tiers to connect.
- Permissions and networking
- Use subnets across Availability Zones, allow only the application security group and database port, and keep public accessibility disabled unless required.
- Pricing and security caveats
- Multi-AZ, cross-AZ transfer, NAT, and endpoints have separate cost implications. Network isolation does not replace database authentication or encryption.
Architecture patterns using this service
Planning guides that use Amazon Virtual Private Cloud