Phase 1: Cloud Fundamentals

Virtual private clouds, subnets & CIDR notation

Beginner ~3 min read
Think of it this way A friendly analogy. Read this if the technical version feels dense. Show Hide

Imagine the entire internet, or what we call 'the cloud,' is like a gigantic table covered with all sorts of LEGO bricks. Anyone can grab bricks and build amazing things. But sometimes, you don't want to build your masterpiece right out in the open where everyone can touch it or add their own pieces. That's where a Virtual Private Cloud (we call it a VPC for short) comes in. Think of it like getting your very own special, dedicated building mat or baseplate on that huge LEGO table. It's still part of the big table, but it’s your private space. You can build your own LEGO city, castle, or spaceship on it, and no one else can mess with your creations unless you specifically invite them over. This means your LEGO projects are safe, organized, and truly yours.

Now, even on your special baseplate, you wouldn't just have one giant open space. You'd probably divide it into different sections, right? Maybe a busy downtown area for shops, a quiet park, or a secret hideout. These different sections on your baseplate are like 'subnets.' A subnet is just a smaller, organized division of your private building space. You create subnets to help organize your virtual 'stuff' – like a LEGO web server that helps people see your creations online, or a LEGO database where you store all your important minifigure names. For example, you might have a 'public' subnet that's like your LEGO storefront, open for anyone on the internet to visit. Then you'd have 'private' subnets, like your LEGO treasure vault or secret lab, which only your special LEGO security robots or other trusted pieces inside your VPC can reach. This helps keep important things extra safe.

Finally, how do you decide how big your baseplate is, or how you cut it up into these smaller subnets? That's where something called CIDR (pronounced 'spider,' but without the 's' at the start) notation helps. CIDR stands for Classless Inter-Domain Routing, but you don't need to remember that fancy name! It’s just a special, clever way to tell the computer precisely how much 'space' your personal baseplate needs on the big LEGO table, and then how to draw the lines to carve out those smaller subnet sections. It’s like saying, 'I want a really big baseplate for my VPC,' or 'I only need a medium-sized one, and I'll make one third of it a public shop and two thirds a private home.' This precise numbering system makes sure everyone gets exactly the right amount of virtual space they need, without wasting any, and helps computers know exactly where everything is located.

Imagine you're building a house in a massive shared neighborhood (the cloud). A Virtual Private Cloud (VPC) is like getting your own private plot of land and building a fence around it. It's a logically isolated section of the cloud provider's network where you can launch your resources (like virtual servers, databases, etc.) without them being directly accessible from the public internet or other cloud customers' networks unless you explicitly allow it. This isolation provides enhanced security, control, and makes sure your infrastructure operates in its own dedicated virtual space.

Inside your VPC "plot of land," you wouldn't just have one giant open space. You'd build rooms or sections for different purposes. This is where subnets come in. A subnet is a division of your VPC's IP address range. You create subnets to organize your resources, define different network paths, and apply specific security rules. For example, you might have a "public" subnet for web servers that need internet access and "private" subnets for databases or application servers that should only be accessible from within your VPC or other specific resources. Each subnet must reside entirely within a single Availability Zone, providing high availability for your applications.

Now, how do you define the size and address space of your VPC and its subnets? That's where CIDR (Classless Inter-Domain Routing) notation comes into play. CIDR is a standard way to represent a range of IP addresses. For instance, 10.0.0.0/16 defines an IP address range for your VPC. The /16 tells you how many bits are fixed for the network portion of the address, determining the total number of available IP addresses. A smaller number after the slash (like /16) means a larger network, while a larger number (like /24 for a subnet) means a smaller, more specific network. Using CIDR efficiently helps you plan your network, avoid overlapping IP ranges, and conserve IP addresses.

Key Takeaways

  • A VPC is your isolated, private network in the cloud, providing security and control.
  • Subnets are smaller subdivisions within a VPC, used to organize resources and control network access.
  • CIDR notation (10.0.0.0/16) defines the IP address range for both VPCs and subnets.
  • The number after the slash in CIDR determines the network size; smaller numbers mean larger networks.

Code Example

yaml
AWSTemplateFormatVersion: '2010-09-09'
Resources:
  MyVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16 # Defines the entire IP range for your VPC
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: MyCloudArchitectVPC

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC
      CidrBlock: 10.0.1.0/24 # A smaller range within the VPC, for public resources
      AvailabilityZone: us-east-1a
      MapPublicIpOnLaunch: true # Instances in this subnet get a public IP
      Tags:
        - Key: Name
          Value: MyPublicSubnet

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC
      CidrBlock: 10.0.10.0/24 # Another smaller range, for private resources
      AvailabilityZone: us-east-1a
      Tags:
        - Key: Name
          Value: MyPrivateSubnet

How this code works

This code defines the fundamental network structure for cloud resources. It first establishes a Virtual Private Cloud (MyVPC), which acts as an isolated virtual network environment within AWS. The CidrBlock: 10.0.0.0/16 assigns a large range of private IP addresses for this entire VPC. Within this network, EnableDnsSupport and EnableDnsHostnames are set to true, ensuring that resources can find each other using DNS names rather than just IP addresses, which is essential for most applications.

Next, the code creates two distinct sub-networks: PublicSubnet1 and PrivateSubnet1. Both use !Ref MyVPC to associate them with the main VPC, drawing their IP addresses from the VPC's overall CidrBlock. Each subnet gets a smaller, dedicated range, like 10.0.1.0/24 for the public one and 10.0.10.0/24 for the private. A crucial detail for PublicSubnet1 is MapPublicIpOnLaunch: true; without this, instances launched there would not automatically receive public IP addresses, preventing direct internet access, even if other public-facing configurations were in place. This distinction segregates resources based on their need for internet exposure.

Resources

Related Articles

Hand-picked reads to go deeper on networking basics.

Back to Cloud Architect Roadmap