Virtual Private Clouds (VPC)

What is a VPC?

A virtual private cloud is your own isolated network inside a cloud provider. You choose its private address range, divide it into subnets, and control routing and firewalls. Servers, containers, databases and load balancers get addresses from it.

Choosing the range

• Use private space, normally inside 10.0.0.0/8.
• Make it big enough to grow: a /16 per environment and region is common. Kubernetes and serverless functions can use many addresses.
• Never overlap with networks you may connect later: other VPCs, offices, partners, the VPN range. Overlapping networks can't be peered or routed to each other. Plan ranges centrally (AWS VPC IP Address Manager, Azure IPAM, or a simple shared spreadsheet).

import ipaddress

plan = {
    "office":        "10.0.0.0/16",
    "prod-eu":       "10.20.0.0/16",
    "staging-eu":    "10.21.0.0/16",
    "partner-vpn":   "10.20.128.0/20",
}
nets = {name: ipaddress.ip_network(cidr) for name, cidr in plan.items()}
names = list(nets)
for i, a in enumerate(names):
    for b in names[i + 1:]:
        if nets[a].overlaps(nets[b]):
            print(f"OVERLAP: {a} {nets[a]} and {b} {nets[b]}")
print("checked", len(names), "ranges")

OVERLAP: prod-eu 10.20.0.0/16 and partner-vpn 10.20.128.0/20
checked 4 ranges

Defining a VPC as code

resource "aws_vpc" "main" {
  cidr_block           = "10.20.0.0/16"
  enable_dns_hostnames = true
  tags = { Name = "prod-eu-west-1" }
}

See the Terraform tutorial to create networks like this as code.