VPC

Master this essential documentation concept

Quick Definition

Virtual Private Cloud - a dedicated, isolated section of a cloud provider's infrastructure where an organization can run resources with enhanced privacy and security controls.

How VPC Works

Understanding VPC

Virtual Private Cloud - a dedicated, isolated section of a cloud provider's infrastructure where an organization can run resources with enhanced privacy and security controls.

Key Features

  • Centralized information management
  • Improved documentation workflows
  • Better team collaboration
  • Enhanced user experience

Benefits for Documentation Teams

  • Reduces repetitive documentation tasks
  • Improves content consistency
  • Enables better content reuse
  • Streamlines review processes

Documenting Your VPC Architecture: From Recorded Walkthroughs to Searchable Reference

When engineers set up or modify a VPC, the knowledge transfer often happens in recorded architecture reviews, onboarding walkthroughs, or screen-share sessions where someone narrates subnet configurations, security group rules, and peering connections in real time. These recordings capture valuable context that written tickets rarely include.

The problem is that VPC configurations change frequently — new subnets get added, routing tables get updated, and access controls evolve as your infrastructure grows. When that institutional knowledge lives only in a 45-minute recording, the next engineer troubleshooting a connectivity issue has no practical way to search for "why was this CIDR block reserved" or "which security group controls inbound traffic to the private subnet." They either watch the whole video or ask someone who was in the room.

Converting those recorded sessions into structured documentation gives your team a living reference for your VPC setup — one where specific decisions, configurations, and rationale are actually findable. A new team member can search for "VPC peering" and land directly on the relevant section rather than scrubbing through recordings hoping to find the right moment.

If your team regularly records infrastructure reviews, onboarding sessions, or architecture discussions involving your VPC and related networking decisions, turning those recordings into searchable documentation is worth exploring.

Real-World Documentation Use Cases

Isolating a HIPAA-Compliant Healthcare Application from Shared Cloud Tenants

Problem

Healthcare SaaS teams deploying on shared cloud infrastructure risk exposing patient data (PHI) to neighboring tenants through misconfigured security groups or flat network architectures, failing HIPAA audit requirements.

Solution

A dedicated VPC with private subnets, strict NACLs, and VPC Flow Logs ensures PHI never traverses public network paths, and all traffic is auditable for compliance reporting.

Implementation

['Create a VPC with CIDR 10.0.0.0/16 and disable the default VPC in the AWS account to prevent accidental resource deployment outside the controlled environment.', 'Place all application servers and RDS instances in private subnets (10.0.2.0/24) with no direct internet gateway attachment, routing outbound traffic through a NAT Gateway in the public subnet.', 'Apply Network ACLs to deny all inbound traffic except port 443 from the ALB security group, and enable VPC Flow Logs to an S3 bucket with server-side encryption for audit trails.', 'Configure AWS PrivateLink endpoints for S3 and DynamoDB so PHI data never leaves the VPC boundary when accessing AWS managed services.']

Expected Outcome

The architecture passes HIPAA Technical Safeguard audits with zero findings related to network exposure, and Flow Log analysis confirms no unauthorized lateral movement between subnets over a 90-day review period.

Connecting an On-Premises Data Center to AWS Workloads Without Exposing Services to the Public Internet

Problem

Enterprise teams running hybrid workloads need their on-premises ERP systems to query cloud-hosted microservices, but routing through the public internet introduces latency, data exfiltration risk, and fails internal security policy requiring private connectivity.

Solution

A VPC with an AWS Site-to-Site VPN or AWS Direct Connect attachment extends the corporate network into the cloud privately, allowing on-premises hosts to reach private subnet resources using RFC1918 addresses.

Implementation

["Create a Virtual Private Gateway and attach it to the VPC, then configure a Customer Gateway object in AWS representing the on-premises firewall's public IP.", 'Establish a Site-to-Site VPN tunnel with BGP routing so on-premises routes (192.168.0.0/16) are propagated into the VPC route table and VPC CIDR routes are advertised back to the corporate router.', 'Update private subnet route tables to direct on-premises-bound traffic (192.168.0.0/16) to the Virtual Private Gateway instead of the NAT Gateway.', 'Validate connectivity by running a traceroute from an on-premises host to a private EC2 instance IP, confirming all hops remain within private address space.']

Expected Outcome

End-to-end latency between on-premises ERP and cloud microservices drops from 85ms (public internet path) to 12ms (VPN tunnel), and the security team confirms zero public IP exposure for any backend service.

Segmenting Multi-Tier E-Commerce Infrastructure to Contain a Potential Security Breach

Problem

A flat cloud network where web servers, application servers, and databases share the same subnet means a compromised web server can directly query the payments database, dramatically expanding blast radius during a breach.

Solution

VPC subnet segmentation with security groups enforcing least-privilege traffic rules ensures that even a fully compromised web tier cannot initiate connections to the database tier without explicit rule allowance.

Implementation

['Design three subnets within the VPC: public (10.0.1.0/24) for the ALB, private-app (10.0.2.0/24) for Node.js servers, and private-data (10.0.3.0/24) for RDS and ElastiCache.', "Create security group 'sg-web' allowing inbound 443 from 0.0.0.0/0, security group 'sg-app' allowing inbound 8080 only from 'sg-web', and security group 'sg-db' allowing inbound 5432 only from 'sg-app'.", 'Apply Network ACLs as a secondary defense layer to block all traffic between private-app and private-data subnets except port 5432 TCP, making lateral movement require bypassing two independent control mechanisms.', 'Run AWS Inspector network reachability assessments weekly to detect any new paths from the public subnet to the data subnet that bypass the security group chain.']

Expected Outcome

Penetration testing confirms that a simulated RCE on the web tier cannot reach the RDS instance, reducing PCI DSS scope and earning a passing Report on Compliance with no network segmentation findings.

Enabling Secure Multi-Account SaaS Architecture with VPC Peering Across Development, Staging, and Production

Problem

SaaS product teams using a single AWS account for all environments risk a developer accidentally terminating production RDS instances, and shared security groups create overly permissive rules that satisfy both dev and prod requirements poorly.

Solution

Separate VPCs per environment (dev, staging, prod) across dedicated AWS accounts, connected via VPC Peering or AWS Transit Gateway, enforce environment isolation while still allowing controlled cross-environment traffic like shared logging or artifact promotion.

Implementation

['Create three AWS accounts (dev, staging, prod) under AWS Organizations, each with its own VPC using non-overlapping CIDRs: 10.1.0.0/16 (dev), 10.2.0.0/16 (staging), 10.3.0.0/16 (prod).', 'Establish VPC Peering connections between dev-to-staging and staging-to-prod only (never dev-to-prod), and update route tables in each VPC to direct inter-environment traffic through the peering connection.', "Configure security groups in staging and prod VPCs to accept inbound traffic from the CI/CD pipeline runner's specific IP range only for deployment ports, blocking all developer workstation IPs.", 'Use AWS RAM (Resource Access Manager) to share a central Transit Gateway, enabling future environment additions without reconfiguring existing peering mesh connections.']

Expected Outcome

Developer incidents affecting production drop to zero after separation, deployment pipeline success rate increases to 99.2% due to staging accurately mirroring prod network topology, and IAM blast radius is contained per account.

Best Practices

Design Your VPC CIDR Block for Future Growth Before Deploying Any Resources

Once a VPC CIDR block is assigned and resources are deployed, resizing requires complex migrations. Choosing a CIDR that is too small (e.g., /24) will force painful re-architecting as the organization scales. Plan for at least 3x your current expected host count across all subnets and availability zones.

✓ Do: Allocate a /16 CIDR (e.g., 10.0.0.0/16) for production VPCs to provide 65,536 addresses, and divide into /24 subnets per availability zone per tier, leaving unallocated ranges for future services.
✗ Don't: Do not use the default VPC (172.31.0.0/16) for production workloads or assign a /24 VPC CIDR that leaves no room for subnet expansion, forcing a VPC replacement when you add a new microservice tier.

Always Deploy Resources Across Multiple Availability Zones Within the VPC

A VPC spans all Availability Zones in a region, but subnets are AZ-specific. Deploying all instances in a single AZ subnet creates a single point of failure that a VPC alone cannot protect against. Multi-AZ subnet design is the foundation of high availability within the VPC construct.

✓ Do: Create paired public and private subnets in at least two AZs (e.g., us-east-1a and us-east-1b), deploy Auto Scaling Groups with AZ balancing enabled, and place RDS in Multi-AZ mode with the standby in the second AZ subnet.
✗ Don't: Do not create a single private subnet in one AZ and route all application traffic through it, even if it seems simpler initially—an AZ outage will take down your entire application despite running in a VPC.

Use Security Groups as Stateful Micro-Firewalls and Network ACLs as Stateless Subnet Boundaries Together

Security groups and Network ACLs serve complementary roles in VPC security. Security groups are stateful and operate at the instance level, while NACLs are stateless and operate at the subnet boundary. Using only security groups leaves subnet-level controls absent; using only NACLs requires managing both inbound and outbound rules for every ephemeral port range.

✓ Do: Define security groups with source references to other security group IDs (not CIDR blocks) for inter-tier traffic, and layer NACLs to explicitly deny known-bad IP ranges and restrict subnet-to-subnet traffic to required ports only.
✗ Don't: Do not create a single security group with 0.0.0.0/0 inbound rules 'for testing' and leave it attached to production instances, and never rely solely on NACLs without security groups as NACLs cannot reference security group membership.

Enable VPC Flow Logs to S3 or CloudWatch Logs for All Production VPCs Immediately at Creation

VPC Flow Logs capture metadata about accepted and rejected traffic flowing through your VPC network interfaces, providing the audit trail required for security incident investigation and compliance frameworks like SOC 2, PCI DSS, and HIPAA. Retroactively enabling Flow Logs after a security incident means you have no historical data for forensic analysis.

✓ Do: Enable Flow Logs at the VPC level (not just ENI level) with a 14-day retention in CloudWatch Logs for operational queries and archive to S3 with Glacier transition after 90 days for long-term compliance retention.
✗ Don't: Do not skip Flow Logs to save on CloudWatch ingestion costs—use S3 delivery with Athena for cost-effective querying instead of disabling logging entirely, as the absence of logs during a breach investigation is far more costly.

Use AWS PrivateLink and VPC Endpoints Instead of NAT Gateways for AWS Service Access

Routing traffic from private subnets to AWS services like S3, DynamoDB, or Secrets Manager through a NAT Gateway sends that traffic over the public internet, incurring data transfer costs and introducing unnecessary exposure. VPC Interface Endpoints and Gateway Endpoints keep traffic entirely within the AWS network backbone and the VPC boundary.

✓ Do: Create a Gateway Endpoint for S3 and DynamoDB (free of charge) and Interface Endpoints for services like Secrets Manager, SSM, and ECR, updating route tables so private subnet traffic to these services resolves to the endpoint ENI.
✗ Don't: Do not route all AWS API calls through a NAT Gateway as the sole path—this creates a cost-scaling problem (NAT Gateway charges per GB processed) and means your S3 bucket access traffic technically traverses an AWS public endpoint rather than staying private.

How Docsie Helps with VPC

Build Better Documentation with Docsie

Join thousands of teams creating outstanding documentation

Start Free Trial