Amazon VPC and CIDR Basics
By the end of this lesson, you'll be able to:
- Explain what a VPC is and how it relates to the Regions and Availability Zones from Module 1
- Explain CIDR notation at a beginner level, including the relationship between a /16 and a /24
- Describe the pieces a VPC is built from: IP range, subnets, route tables, gateways, and security controls
Prerequisites: Module 5: "Project: Build a Simple Application Data Store"
A VPC is a network you define, not a physical place
A VPC (Virtual Private Cloud) is a logically isolated network that you define inside an AWS Region. This connects directly to Module 1: a VPC lives within a Region, and can span multiple Availability Zones within that Region — but a VPC itself is not a physical data centre or a piece of hardware. It's a logical boundary AWS enforces for you, inside which you control IP addressing, subnets, routing, and security.
CIDR: describing a range of addresses, not one address
A VPC is given an IP address range written in CIDR notation — for example, 10.0.0.0/16 (a fictional, commonly-used example range for teaching, not a value with any special significance of its own). The number after the slash describes how much of the address space is fixed versus available for use: a smaller number after the slash means a larger range of addresses, and a larger number means a smaller range.
The practical relationship worth knowing at a beginner level: a /16 range is large enough to be divided into many smaller /24 ranges. This is exactly how subnets work — a large CIDR block assigned to the VPC gets carved up into smaller CIDR blocks, one per subnet, rather than every subnet sharing the entire range.
What a VPC is actually built from
Across this module, a VPC's pieces are introduced one at a time:
- Subnets — smaller address ranges within the VPC's range, each tied to one Availability Zone (Lesson 2).
- Route tables — the rules that decide where traffic goes (Lesson 3).
- Gateways — components like an Internet Gateway that connect the VPC to the internet (Lesson 3) or NAT for controlled outbound-only access (Lesson 4).
- Security controls — Security Groups and Network ACLs, which control what traffic is actually allowed (Lesson 5).
This is the map for the rest of the module: each lesson from here takes one labeled piece of this diagram and goes deeper on it.
Exercise
A VPC is assigned the fictional range 10.0.0.0/16. Explain in your own words why this can be divided into multiple /24 subnet ranges, and what the relationship between /16 and /24 tells you about which one describes a larger range.
Show hint
A smaller number after the slash means more addresses are available — think about which of the two numbers leaves more room to divide up.
Amazon VPC and CIDR Basics Quiz
My Notes
Log in to keep private notes on this lesson.
Questions about this lesson
No questions yet — be the first to ask.
Log in to ask a question about this lesson.
Summary
A VPC is a logically isolated network you define inside an AWS Region, given its own IP address range in CIDR notation, which can then be divided into smaller subnet ranges spread across Availability Zones — the foundation every other networking concept in this module builds on.