What is a VPC?

A Virtual Private Cloud (VPC) is a logically isolated virtual network within a public cloud provider such as AWS, in which a customer launches resources while controlling its own IP address ranges, subnets, and routing configuration – a private network built entirely from the provider’s shared infrastructure.

Key takeaways

• A VPC is a customer-controlled, logically isolated network inside a public cloud.
• You define its IP address ranges, subnets, route tables, and security groups.
• Internet gateways and VPN gateways connect a VPC outward to the internet or on-prem.
• Transit gateways and VPC peering link multiple VPCs into one routed fabric.
• Versa reaches VPC workloads via IPsec to a gateway, or via VOS deployed inside it.

On this page: Why it matters · How it works · Types · VPC & Versa · FAQ

Why is a VPC important?

Public cloud infrastructure is shared by design – thousands of customers run workloads on the same physical servers. A VPC is the boundary that makes that safe: a private slice of address space and routing that nothing outside the VPC can see or reach unless explicitly permitted.

That isolation also makes a VPC a foundation for real network design, not a list of servers. Teams lay out subnets, route tables, and security groups the way they’d design an on-premises network – separating public-facing tiers from private ones. Because the address space is customer-defined, it can be numbered to avoid collisions when the network extends to on-premises sites or an SD-WAN fabric, making hybrid architecture practical instead of a NAT workaround.

What is a VPC?

A VPC is a virtual network environment that lets a customer launch cloud resources – virtual machines, load balancers, storage – inside a logically isolated section of a provider’s infrastructure. The customer defines the VPC’s IP address range as a CIDR block, then divides it into subnets, each tied to an availability zone. Route tables control traffic between subnets and outward.

Two components sit at the edge of most VPCs: an internet gateway, letting public-subnet resources reach and be reached from the internet, and security groups, stateful firewalls controlling which traffic is allowed to and from each resource. Everything else – VPNs, transit gateways, peering, load balancers – attaches to this base.

Types of VPC connectivity

A VPC rarely stands alone; how it connects to other networks falls into a few broad patterns. VPC peering links two VPCs directly, routing traffic between their private address spaces without touching the internet – simple, but it doesn’t scale once many VPCs need to reach each other. Transit gateway connectivity solves that with a managed routing hub: many VPCs and on-premises networks attach to one gateway, which exchanges routes dynamically over BGP and centralizes policy. Site-to-site VPN or dedicated circuits extend a VPC to an on-premises network or SD-WAN overlay over an encrypted tunnel, using a virtual private gateway as the endpoint. Multi-VPC environments generally converge on the transit gateway pattern; single-VPC deployments often start with a direct VPN.

VPC & Versa

Versa connects SD-WAN branches and remote SASE users to workloads inside a VPC using three models. The simplest is a site-to-site IPsec tunnel between the SASE Gateway and the VPC’s virtual private gateway, with eBGP exchanging routes – suited to a single VPC. For multiple VPCs or regions, the SASE Gateway instead peers with a transit gateway, centralizing routing. A third model deploys VOS itself as an EC2 instance inside the VPC, making it a full SD-WAN branch. See Versa Networks SASE Gateway Integration with AWS Cloud for how the three models compare, Deploy a VOS Branch in AWS Using Transit Gateway for a transit-gateway deployment spanning multiple VPCs, and VOS High Availability in AWS Using Gateway Load Balancer for redundant VOS instances inspecting VPC traffic.

Frequently asked questions

What is the difference between a VPC and a traditional network?

A VPC provides the same building blocks as a physical network – addressing, subnets, routing, firewalling – but built entirely from a cloud provider’s virtualized infrastructure. There’s no hardware to rack or cable; it’s all defined through a console or API.

Can a VPC connect to an on-premises network?

Yes. A VPC can reach an on-premises network through a site-to-site VPN, a dedicated circuit such as Direct Connect, or an SD-WAN overlay. Versa’s Secure SD-WAN fabric extends into a VPC over any of these paths, treating the workload as just another site on the network.

What is the difference between a VPC and a subnet?

A VPC is the overall isolated network; a subnet is a smaller IP range carved from its address space, tied to one availability zone. A VPC typically holds several subnets – for example, separate ones for management, WAN, and LAN traffic.

Is a VPC specific to AWS?

VPC is AWS’s name for the construct, but every major public cloud has an equivalent: Azure calls it a Virtual Network, and Google Cloud uses the same term. The underlying idea – a customer-controlled, isolated network – is common across providers.

How does Versa secure traffic to and from a VPC?

Versa inspects VPC traffic through an on-premises SASE Gateway reached over IPsec, or through VOS instances deployed inside the VPC as EC2 appliances. Either way, the traffic is subject to firewall, NAT, and SD-WAN policy as it enters, leaves, or moves between VPCs.

More on VPC

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about VPC, these are worth looking at next.