A customer typically selects address ranges and subnets, configures routing and traffic controls, and connects workloads to other cloud networks, private environments, managed services, or the internet. VPC implementations and terminology vary by provider; the isolation is logical rather than physical.
VPC policy is assembled from components such as route tables, network access control lists, security groups, gateways, private service endpoints, peering, transit services, and flow logs. Identity policy and service-specific access rules remain separate controls and can expose resources even when their network path appears private.
Key points
Design addressing and routesPrevent overlapping ranges, unintended default routes, asymmetric paths, uncontrolled transit, and hidden dependencies across accounts, regions, and connected environments.
Minimize exposureUse private endpoints where appropriate, restrict inbound and outbound paths, govern public addresses and gateways, and block alternate management or service routes.
Observe and governCentralize ownership, configuration history, flow evidence, reachability analysis, name resolution, exception review, and testing of segmentation and failure paths.
Important limitation“Private” does not mean internet-disconnected, single-tenant hardware, encrypted, or secure by default. Permissive identities, routes, security groups, managed-service policies, endpoints, or connected networks can bypass the intended isolation.