Amazon Virtual Private Cloud

When you create a VPC, you can configure it based on the level of privacy you want. In the most private scenario, you can attach only a virtual private gateway, and create an IPsec tunnel between your VPC and home network. In this scenario, your EC2 instances have no direct exposure to the Internet.

In the most public scenario, you can attach only an Internet gateway to the VPC and enable traffic to flow between the Internet and all the instances in your VPC.

You can configure your VPC to be somewhere in between, with both a virtual private gateway and an Internet gateway. Here, some instances could receive Internet traffic (e.g., web servers), whereas others could remain unexposed (e.g., database servers). This is a common scenario for running a multi-tier web application in the AWS cloud.

These different scenarios are discussed in more detail in the Amazon VPC documentation.

You can configure routing in your VPC to control where traffic flows (e.g., to the Internet gateway, virtual private gateway, etc). With an Internet gateway, your VPC has direct access to other AWS products such as Amazon Simple Storage Service (Amazon S3). If you choose to have only a virtual private gateway with a connection to your home network, you can route your Internet-bound traffic over the VPN and control its egress with your security policies and corporate firewall. In the latter case, you incur additional bandwidth charges when accessing AWS products over the Internet.

You can use security groups and network ACLs to help secure the instances in your VPC. Security groups might be familiar if you're an Amazon EC2 user, and network ACLs might be familiar if you're a network administrator. Security groups act like a firewall at the instance level, whereas network ACLs are an additional layer of security that act at the subnet level.

By default, the instances you launch in your VPC have only private IP addresses. If you want an instance to have a public IP address, you can assign it an Elastic IP address, which is a static, public address you can assign to any instance in your VPC. For an instance in your VPC to be addressable from the Internet, it must have an Elastic IP address.

You can use Network Address Translation (NAT) to enable instances that don't have Elastic IP addresses to reach the Internet. You can set up the VPC's routing so that traffic from private instances goes through a special NAT instance that has an Elastic IP address. We provide a NAT Amazon Machine Image (AMI) that you can use for this purpose.

Amazon EC2 instances launched into a VPC have a tenancy attribute. Setting the instance's tenancy attribute to dedicated specifies that your instance will run on single-tenant hardware. Amazon VPCs have a related attribute called instance tenancy. Setting this instance tenancy attribute to dedicated specifies that only Dedicated Instances can be launched into the VPC.

For more information, go to Using EC2 Dedicated Instances Within Your VPC in the Amazon Virtual Private Cloud User Guide.