Your Private Cloud

A VPC (Virtual Private Cloud) is an isolated slice of the AWS network that you control. It's your digital fortress.

1. Public vs Private Subnets

Public Subnets: Have a direct route to the **Internet Gateway (IGW)**. Use these for Load Balancers only.
Private Subnets: No direct internet access. Use these for your .NET APIs and Databases. This is the 'Standard Security' pattern.

2. The NAT Gateway

How does your private .NET API download a NuGet package or call a third-party payment API? It uses a NAT Gateway in the public subnet to send traffic out without allowing the internet to 'see' the API directly.

3. Architect Insight

Q: "How should I design my IP range (CIDR)?"

Architect Answer: "Use a large CIDR block like 10.0.0.0/16. It gives you 65,536 IPs. It costs nothing extra to have a large range, but it is PAINFUL to resize a VPC later. Also, ensure your VPC CIDR doesn't overlap with your office network's CIDR, or you'll never be able to connect them via VPN/DirectConnect."