Inside the AWS Default VPC (and Why You'll Want Your Own)
Introduction: A guided tour of the default VPC that comes with every AWS account: subnets, route table, internet gateway, NACL and security group. Then how to create your own VPC. Every AWS account comes with a network you never asked for. It's already there, already wired to the internet, and it's the reason your first EC2 instance "just worked." It's called the default VPC . Before building a…
Every AWS account begins with a network you don't request: the default Virtual Private Cloud (VPC). This VPC is pre-configured with subnets, a route table, an internet gateway, Network Access Control Lists (NACLs), and security groups. It's already connected to the internet, which is why your first EC2 instance started working without any special setup.
A VPC in AWS is an isolated network inside the service where you can define your own IP range, subnets, and control traffic flow. The default VPC inherits these features, but you have the option to create your own customized VPC if needed.
The default VPC offers specific characteristics. Its IPv4 CIDR block is 172.31.0.0/16, providing 65,536 private IP addresses. By default, AWS manages the hardware resources, but you can opt to run your resources on shared AWS hardware, which is suitable for most use cases.
The default VPC includes a main route table and network ACL, both of which are essential for network traffic management. It also has a public DNS resolution and hostnames enabled, allowing instances in the VPC to have DNS names by default.
The default VPC comprises three subnets, each spanning a different Availability Zone. Each subnet has a range of 4,096 addresses, with 5 addresses reserved by AWS. By default, these subnets are public, meaning any resource launched here automatically receives a public IP address.
A route table governs how traffic navigates within the VPC. It has two routes: one directing internal traffic and another routing external traffic to the internet gateway. This setup allows subnets to be public, as traffic can flow to and from the internet.
An internet gateway serves as the gateway to the internet. It's attached to the VPC, acting as a door through which traffic can enter or leave. Two layers of firewall protect the VPC: Network Access Control Lists (NACLs) and security groups. The default NACL allows all traffic, while the default security group allows all outbound traffic. The main difference between the two is their scope: NACLs operate at the subnet level and are stateless, while security groups operate at the resource level and are stateful.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
