VPCs, Subnets & Routing
Every major cloud provider gives you the same starting primitive: an isolated, software-defined network that you control, sitting on top of the provider's physical infrastructure. AWS calls it a VPC (Virtual Private Cloud), Azure calls it a VNet (Virtual Network), GCP calls it a VPC network. The name changes; the idea does not.
What a VPC actually is
A VPC is a logically isolated network: you choose its address range, carve it into subnets, decide how traffic is routed between those subnets and the outside world, and attach firewalling on top. Two VPCs, even in the same account and region, cannot talk to each other by default - they are separate routing domains unless you explicitly connect them (see Private Connectivity).
The address range itself is just a block in CIDR notation - the same math
covered in IP Addressing and
Subnetting & CIDR. A VPC is usually given
a private range (a /16, say), and subnets are smaller blocks carved out of
it. Nothing about the addressing math is different in the cloud; what changes
is who draws the boundaries and enforces the routing.
Subnets
A subnet is a subdivision of the VPC's address range, and in every major provider a subnet lives in exactly one availability zone (AZ). This is why production designs create at least one subnet per AZ per tier: a subnet cannot span zones, so spreading load across zones means creating multiple subnets.
| Concept | AWS | GCP | Azure |
|---|---|---|---|
| Isolated network | VPC | VPC network | Virtual Network (VNet) |
| Subdivision | Subnet (one AZ) | Subnet (regional, spans zones) | Subnet (one region) |
| Routing config | Route table | Routes | Route table (UDR) |
| Internet edge | Internet Gateway | Default internet gateway | Internet path via public IP / NAT GW |
This is the one place the "subnet maps to an AZ" rule breaks: a GCP subnet spans all zones in a region, while an AWS subnet or Azure subnet is tied to a single zone. If you're moving a design between clouds, don't assume subnet boundaries carry over 1:1 with AZ boundaries.
Route tables
A route table is the actual mechanism that decides where a packet goes next: for each destination CIDR block, it lists a target (another subnet, an internet gateway, a NAT device, a VPN tunnel, a peering connection). Every subnet is associated with a route table, and that association - not the subnet's IP range - is what determines its behavior.
Public vs private subnets: what "public" really means
This is the detail that trips people up in interviews: a subnet is not
"public" because its instances have public IP addresses. A subnet is public
because its route table has a route to an internet gateway for
0.0.0.0/0 (all non-local traffic). An instance with a public IP address
sitting in a subnet whose route table has no route to an internet gateway is
still unreachable from, and cannot reach, the internet.
Public subnet = its route table sends default (0.0.0.0/0) traffic to an
internet gateway. Private subnet = it doesn't - default traffic instead
goes nowhere, or to a NAT device for outbound-only access (see
NAT Gateways & Egress).
So the routing table, not the IP assignment, is the source of truth. A common production pattern:
- Public subnet(s): load balancers, bastion hosts - anything that must accept inbound connections from the internet.
- Private subnet(s): application servers, databases - reachable only from inside the VPC, with outbound internet access (for patches, package downloads) routed through NAT rather than a direct internet gateway route.
Why this design repeats everywhere
The pattern of "one VPC, several AZs, a public/private subnet pair per AZ, a route table per subnet" shows up under every provider's branding because it solves the same two problems every cloud network has: isolating what should never be internet-reachable, and surviving the loss of a single availability zone. Once you see the route table as the actual decision point - not the IP address, not the subnet name - the rest of a VPC's behavior (and most of its outages) becomes a lot easier to reason about.