What is a VPC?

So QuickCart needs two things at once:

• The app can reach the API, from anywhere in the world.
• Nobody can reach the database — except the API.

A VPC is how you get both.

A VPC — Virtual Private Cloud — is a private section of AWS’s network that belongs to your account. Other AWS customers can’t see into it, and the internet can’t reach anything inside it unless you open a way in.

It starts with a range of addresses

Every server in a VPC gets an internal address, like 10.0.11.24. When you create the VPC, you choose the range those addresses come from, written like 10.0.0.0/16. This way of writing a range is called CIDR.

The number after the slash is how many bits of the address are fixed. A smaller number means a bigger range. You don’t need to do the maths by hand yet — remember that /16 is big and /24 is small. The subnets lesson goes further.

Then you slice it into subnets

A subnet is a slice of the VPC’s range. Each subnet lives in exactly one availability zone — one physical data centre site. QuickCart’s VPC gets three kinds:

What makes a subnet public or private

This is the part people get wrong. There is no setting called public. Every subnet has a route table — a short list of rules saying where traffic goes. One line decides everything:

0.0.0.0/0 means anywhere I don’t have a more specific rule for — in practice, the internet.

The pieces, in one table

Everything inside the VPC can still talk to everything else inside it, through a route called local that every route table has and you can’t remove. That is how the API reaches the database: the database is unreachable from the internet, but not from its neighbours.

Below is QuickCart’s network. Send an order from the app and watch the path it takes. Then send an attack straight at the database. Switch the database subnet between private and public and try again.

What to notice: nothing about the database changed between the two attacks — not the server, not the password. Only one line in one route table. That is why the route table is the first thing to check when something is, or isn’t, reachable.

Free — nothing in this lab costs money.

You’ll build a small version of QuickCart’s network in the AWS console: a VPC, one public subnet, one private subnet, and the route that makes the difference. It takes about 15 minutes.

Before you start, check the region selector at the top right of the console says N. Virginia (us-east-1). Everything in this lab goes in that region.

1. Create the VPC

   AWSIn the AWS console: VPC→Your VPCs→Create VPC

   Field	Enter
   Resources to create	VPC only
   Name tag	quickcart-vpc
   IPv4 CIDR block	IPv4 CIDR manual input
   IPv4 CIDR	10.0.0.0/16
   IPv6 CIDR block	No IPv6 CIDR block
   Tenancy	Default

   Choose Create VPC.

   You should see

   The VPC’s details page, with State: Available.

2. Create two subnets

   AWSIn the AWS console: VPC→Subnets→Create subnet

   For VPC ID, choose quickcart-vpc. Then fill in the first subnet, choose Add new subnet, and fill in the second:

   Subnet name	Availability Zone	IPv4 subnet CIDR block
   quickcart-public-a	us-east-1a	10.0.1.0/24
   quickcart-app-a	us-east-1a	10.0.11.0/24

   Choose Create subnet.

   You should see

   Two subnets in the list. Right now both are private — neither has a route to the internet yet.

3. Create the internet gateway and attach it

   AWSIn the AWS console: VPC→Internet gateways→Create internet gateway

   Field	Enter
   Name tag	quickcart-igw

   Choose Create internet gateway. Then choose Actions → Attach to VPC, pick quickcart-vpc, and choose Attach internet gateway.

   You should see

   State: Attached. On its own this makes nothing public — no subnet is using the gateway yet.

4. Make the public subnet public

   AWSIn the AWS console: VPC→Route tables→Create route table

   Field	Enter
   Name	quickcart-rt-public
   VPC	quickcart-vpc

   Choose Create route table. On its Routes tab, choose Edit routes, then Add route:

   Destination	Target
   0.0.0.0/0	Internet Gateway, then quickcart-igw

   Choose Save changes. Then open the Subnet associations tab, choose Edit subnet associations, tick quickcart-public-a, and choose Save associations.

   You should see

   The route table lists two routes: 10.0.0.0/16 → local and 0.0.0.0/0 → igw-…. One subnet is associated. That subnet is now public. You changed a route table; you never touched the subnet itself.

5. Confirm the other subnet is still private

   AWSIn the AWS console: VPC→Subnets→quickcart-app-a→Route table

   You should see

   Only one route: 10.0.0.0/16 → local. No way to the internet. The subnet is private because of what is missing.

6. See the whole thing as a map

   AWSIn the AWS console: VPC→Your VPCs→quickcart-vpc→Resource map

   You should see

   A diagram: quickcart-public-a joined to quickcart-rt-public, which joins to quickcart-igw. quickcart-app-a joins to the VPC’s main route table, which goes nowhere outside.

7. Clean-up step: Clean up

   AWSIn the AWS console: VPC→Your VPCs→quickcart-vpc→Actions→Delete VPC

   AWS lists everything that will go with it: the subnets, the route table and the internet gateway. Type delete in the box and choose Delete.

   You should see

   The VPC is gone from the list, along with everything inside it. Nothing is left running.