VPC (Virtual Private Cloud)

A VPC (Virtual Private Cloud) is your own logically isolated private network inside a public cloud. You define its IP address ranges, subnets, routing, and firewall rules; everything you launch runs inside it, unreachable by other customers, or the internet, unless you deliberately open a path.

In plain terms

It’s the cloud equivalent of your office network behind its own router and firewall, except software-defined and created in minutes. A typical setup: a VPC with a public subnet holding a load balancer that accepts web traffic, and private subnets holding the app servers and database, which have no direct internet exposure at all. AWS and Google Cloud call this a VPC; Azure calls the same thing a Virtual Network (VNet).

Why it matters when you migrate

• It’s your first real build decision. Its IP ranges must not overlap your on-premise network, or the VPN/private link you need during migration won’t route. Plan this in your landing zone before moving anything.
• It’s the security perimeter. Which subnets are public vs. private, and what the firewall rules allow, decide most of your exposure, the majority of cloud breaches trace to misconfigured network paths, not exotic exploits.
• It’s nearly free, but its plumbing isn’t. The VPC itself costs nothing; NAT gateways, VPNs, and cross-zone traffic inside it are billable line items worth estimating up front.