Introduction: A guided tour of the default VPC that comes with every AWS account: subnets, route table, internet gateway, NACL and security group. Then how to create your own VPC.

Every AWS account comes with a network you never asked for. It's already there, already wired to the internet, and it's the reason your first EC2 instance "just worked." It's called the default VPC.

Before building a VPC from scratch, it helps to know what AWS builds for you. So this article is a tour: first the default VPC and everything attached to it, then how to create your own. By the end, you'll know what each piece does and how they connect.

What's a VPC?

A Virtual Private Cloud (VPC) is your own isolated network inside AWS. You choose its IP range, split it into subnets, and control what can talk to what. A VPC lives in one region, and mine is in Europe (Stockholm) eu-north-1.

Coming from Azure? A VPC is the equivalent of a VNet, and both live in a single region. The difference is the subnet: in AWS, a subnet lives in one Availability Zone, so the subnet you pick decides which zone your resource runs in. In Azure, a subnet spans the whole region and you choose the zone per resource.

Meet the default VPC

In the console, search for VPC and open Your VPCs. My account lists exactly one, and the Default VPC column says Yes.

rt, NACL, igw

A few things stand out:

  • IPv4 CIDR 172.31.0.0/16: the range of private IP addresses this network can hand out. The /16 means 65,536 addresses.
  • Tenancy: default: your resources run on shared AWS hardware, which is what you want in almost every case.
  • Main route table and Main network ACL: two IDs we'll visit shortly.

Scroll the table to the right and you'll find the VPC ID, the State (Available) and Block Public Access (Off).

The VPC ID, state and Block Public Access columns

Select the row and a details panel opens at the bottom. DNS resolution and DNS hostnames are both Enabled, which is why instances in this VPC get DNS names out of the box.

For the big picture, click the VPC ID and open the Resource map tab. It shows 3 subnets, 1 route table and 1 network connection, which is an internet gateway. Everything below is just us zooming into this map.

Resource map of the default VPC

Subnets: one per Availability Zone

Open Subnets in the left menu. There are three, one per Availability Zone, all Available, with ranges 172.31.0.0/20, 172.31.16.0/20 and 172.31.32.0/20. Each /20 holds 4,096 addresses.

The three default subnets

Open one and check its details:

  • Availability Zone: eu-north-1b. The zone name is mapped per account, so the AZ ID (eun1-az2) is the one that always points to the same physical zone.
  • Available IPv4 addresses: 4091. AWS reserves 5 addresses in every subnet.
  • Default subnet: Yes and Auto-assign public IPv4 address: Yes. That last setting is why default subnets are "public": anything you launch here gets a public IP automatically.

Details of a default subnet

The route table: how traffic finds its way

Still inside the subnet, click the Route table tab. There are only two routes:

  • 172.31.0.0/16 → local: traffic inside the VPC stays inside the VPC.
  • 0.0.0.0/0 → igw-...: everything else goes to the internet gateway.

Route table tab of the subnet showing the local and internet gateway routes

That second route is what makes a subnet public. Open Route tables in the left menu to see the table itself. It's marked Main: Yes, and it has no explicit subnet associations. Subnets without an explicit association automatically use the main route table.

The main route table and its two routes

The internet gateway: the door

Under Internet gateways, you'll find one, with its state set to Attached to our VPC. Think of it this way: the gateway is the door, and the route is the sign pointing to it. Without both, nothing reaches the internet.

The internet gateway attached to the default VPC

Two layers of firewall: NACL and security group

Back on the subnet, the Network ACL tab says this subnet uses the VPC's default network ACL. Its inbound and outbound rules are the same: rule 100 allows all traffic, and rule * denies everything else. Rules are checked from the lowest number up, so the allow always wins and the deny never triggers.

Network ACL tab of the subnet with allow and deny rules

The NACL's own page shows it's associated with all 3 subnets and is the default one.

The default network ACL associated with 3 subnets

Then there's the default security group. Its outbound rule allows all traffic to anywhere (0.0.0.0/0), so anything inside can reach out freely.

The default security group's outbound rules

The difference between the two:

  • A network ACL works at the subnet level and is stateless: return traffic needs its own rule.
  • A security group works at the resource level (like an instance) and is stateful: return traffic is allowed automatically.

Azure comparison: both roles are played by Network Security Groups (NSGs), which can be attached to a subnet or to a network interface.

Create your own VPC

Now the fun part. Here are the steps:

  1. Open VPC > Your VPCs and click Create VPC.

create VPC

  1. Under Resources to create, pick one of two options:
    • VPC and more: a wizard that builds the VPC, subnets, route tables and more in one go. The preview shows project-vpc, 4 subnets across 2 AZs and 3 route tables, with a default range of 10.0.0.0/16. It's quick and convenient.
    • VPC only: just the network itself, with nothing else. I chose this one, because I want to build each piece by hand.

The VPC and more option with its preview of subnets and route tables

  1. Fill in the form. I set the Name tag to test, chose IPv4 CIDR manual input with 192.168.0.0/16, selected No IPv6 CIDR block, and kept Tenancy on Default. I left VPC encryption control on None, because the other modes carry additional charges.
  2. Click Create VPC.

The VPC only form filled in with name test and CIDR 192.168.0.0/16

Picking a CIDR: the block size must be between /16 and /28. Choose a range that doesn't overlap with your other networks (this is why I avoided 172.31.0.0/16), because overlapping ranges make peering or VPN connections painful later.

What you actually get

AWS confirms with a green banner, and the details tell the story. Compared to the default VPC, Default VPC is now No, and DNS hostnames is Disabled.

The Resource map is nearly empty:

  • Subnets (0)
  • Route tables (1): the main route table AWS creates automatically
  • Network connections (0)

The new VPC's details and resource map with zero subnets

There are no subnets and no internet gateway, so nothing can run in this VPC yet and nothing can reach the internet. To prove the new VPC didn't sneak any subnets in, I opened Subnets again: the list still shows only the 3 default ones.

The Subnets list still showing only the three default subnets

Conclusion

  • The default VPC is a ready-made network: one subnet per AZ, a route to an internet gateway, and permissive default rules.
  • A subnet is public because its route table points to an internet gateway, not because of its name.
  • NACLs guard subnets (stateless), and security groups guard resources (stateful).
  • VPC only gives you an empty shell, while VPC and more builds a full layout for you.
  • A new VPC starts with no subnets, so nothing can be deployed into it yet.

NOTE: The number of default subnets equals the number of Availability Zones in the region, so it varies by region.
My region is Stockholm (eu-north-1), which has 3 AZs, so you get 3 default subnets.
N. Virginia (us-east-1) has 6 AZs, so its default VPC has 6 default subnets. Most tutorials and screenshots use that region.
Other regions have 2, 3 or 4 AZs, so the count differs again.
A default VPC is per region. Every region has its own, each with its own 172.31.0.0/16 range. If you switch the region selector in the top bar, you’ll see a different default VPC and a different set of default subnets.
You can check this by switching to N. Virginia and opening Subnets. You should see 6, one for each AZ.

Next up in this series, I'll create subnets inside this new VPC and start turning an empty network into a working one.

Which would you rather see after that: an internet gateway and public subnet, or a private subnet with a NAT gateway? Let me know in the comments.