Amazon Virtual Private Cloud™ (AWS VPC) lets you provision a logically isolated section of the Amazon Web Services™ (AWS) cloud where you can launch Amazon AWS™ resources in a virtual network that you define. You have complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways. You can use both IPv4 and IPv6 in your AWS VPC™ for secure and easy access to resources and applications. AWS VPC™ provides all the same benefits as the rest of the AWS™ platform. You can instantly scale your resources up or down, select AWS EC2™ instances types and sizes that are right for your applications, and pay only for the resources you use—all within Amazon’s™ proven infrastructure. You can use AWS VPC™ to host multi tier web applications and strictly enforce access and security restrictions between your web servers, application servers, and databases. You can launch web servers in a publicly accessible subnet and application servers and databases in non publically accessible subnets. The application servers and databases can’t be directly accessed from the Internet, but they can still access the Internet via a NAT gateway to download patches.

You can control access between the servers and subnets using inbound and outbound packet filtering provided by network access control lists and security groups. To create an AWS VPC™ that supports this use case, you can select Amazon AWS VPC™ with public and private subnets in the Amazon AWS VPC™ wizard. You can easily customize the network configuration for your AWS Virtual Private Cloud™.  You can create a public facing subnet for your web servers that has access to the Internet, and place your backend systems such as databases in a private facing subnet with no Internet access. You can leverage multiple layers of security, including security groups and network access control lists, to help control access to AWS EC2™ instances in each subnet. Additionally, you can create a Hardware Virtual Private Network (VPN) connection between your corporate data center and your AWS VPC™ and leverage the AWS Cloud™ as an extension of your corporate data center. Web servers and application servers in your AWS VPC™ can leverage AWS EC2™ elasticity and auto scaling features to grow and shrink as needed. You can create an AWS VPC™ to support this use case by selecting VPC™ with public and private subnets and VPN access in the Amazon AWS VPC™ console wizard.

Extend Your Network Into The Amazon AWS cloud

You can move corporate applications to the cloud, launch additional web servers, or add more compute capacity to your network by connecting your Amazon AWS VPC™ to your corporate network. Because your Amazon AWS VPC™ can be hosted behind your corporate firewall, you can seamlessly move your IT resources into the cloud without changing how your users access these applications. You can select Amazon VPC™ with a Private subnet only and Amazon Hardware VPN™ access from the Amazon AWS VPC™ console wizard to create an Amazon AWS VPC™ that supports this use case. You can periodically backup your mission critical data from your data center to a small number of Amazon AWS EC2™ instances with Amazon AWS Elastic Block Store™ (Amazon AWS EBS) volumes, or import your virtual machine images to Amazon AWS EC2™. In the event of a disaster in your own data center, you can quickly launch replacement compute capacity in Amazon AWS™ to ensure business continuity. When the disaster is over, you can send your mission critical data back to your data center and terminate the Amazon AWS EC2™ instances that you no longer need. By using Amazon VPC™ for disaster recovery, you can have all the benefits of a disaster recovery site at a fraction of the normal cost.

Host Websites And apps In The Amazon AWS Cloud

Host a simple, public facing website. You can host a basic web application, such as a blog or simple website in an Amazon AWS VPC™, and gain the additional layers of privacy and security afforded by Amazon AWS VPC™. You can help secure the website by creating security group rules which allow the web server to respond to inbound HTTP and SSL requests from the Internet while simultaneously prohibiting the web server from initiating outbound connections to the Internet. You can create an Amazon AWS VPC™ that supports this use case by selecting VPC™ with a single public subnet only from the Amazon AWS VPC™ console wizard. You can create an Amazon AWS VPC™ where instances in one subnet, such as web servers, communicate with the Internet while instances in another subnet, such as application servers, communicate with databases on your corporate network. An IPsec Amazon AWS VPN™ connection between your Amazon AWS VPC™ and your corporate network helps secure all communication between the application servers in the cloud and databases in your data center.

Amazon AWS Virtual Private Cloud

You can create an AWS Virtual Private Cloud™ (VPC) quickly and easily using the AWS Management Console™. You can select one of the common network setups that best match your needs and press “Start AWS VPC Wizard™.” Subnets, IP ranges, route tables, and security groups are automatically created for you. AWS VPC™ provides advanced security features such as security groups and network access control lists to enable inbound and outbound filtering at the instance level and subnet level. In addition, you can store data in AWS S3™ and restrict access so that it’s only accessible from instances in your AWS VPC™. Optionally, you can also choose to launch Dedicated Instances which run on hardware dedicated to a single customer for additional isolation. All traffic to and from instances in your AWS VPC™ can be routed to your corporate data center over an encrypted IPsec hardware AWS™ VPN connection. Peer AWS VPCs™ together to share resources across multiple virtual networks owned by your or other AWS AWS™ accounts. You can connect to AWS S3™ without using an internet gateway or NAT, and control what buckets, requests, users, or groups are allowed through an AWS VPC endpoint for AWS S3™.

Features And Benefits

A variety of connectivity options exist for your Amazon Virtual Private Cloud™. You can connect your Amazon AWS VPC™ to the Internet, to your data center, or other Amazon AWS VPC’s™, based on the Amazon AWS™ resources that you want to expose publicly and those that you want to keep private. Connect directly to the Internet (public subnets)—you can launch instances into a publicly accessible subnet where they can send and receive traffic from the Internet. Combine connectivity methods to match the needs of your application—you can connect your Amazon AWS VPC™ to both the Internet and your corporate data center and configure Amazon AWS VPC™ route tables to direct all traffic to its proper destination. Connect to the Internet using Network Address Translation (private subnets)—private subnets can be used for instances that you do not want to be directly addressable from the Internet. Instances in a private subnet can access the Internet without exposing their private IP address by routing their traffic through a Network Address Translation (NAT) gateway in a public subnet. Securely connect securely to your corporate data center.