Why it matters
VPC design determines security, cost, and operational complexity. Bad VPC design can lock in poor choices for years. Getting it right up front is worth learning.
The architecture
A VPC is a private IP space (CIDR block like 10.0.0.0/16) in a region. It contains subnets, which are further partitioned CIDR blocks (10.0.1.0/24) associated with a single AZ.
Route tables control traffic flow. Each subnet has an associated route table listing destinations and targets. Traffic to VPC-local CIDRs stays local; traffic to 0.0.0.0/0 needs a gateway.
How it works end to end
Gateways: Internet Gateway (IGW) enables public internet access. NAT Gateway lets private subnets reach internet outbound only. Virtual Private Gateway (VGW) connects to on-premise via VPN. Transit Gateway (TGW) connects multiple VPCs.
Security Groups are stateful firewalls attached to network interfaces (ENIs). They filter traffic per instance.
Network ACLs are stateless firewalls at subnet level. Used less often; SGs cover most cases.