What is a VPC, and how do an AWS VPC, an Azure VNet and a GCP VPC differ?
Show the answer
Say this first
A VPC is a private, isolated network you define inside a cloud provider: you pick the address space, cut it into subnets, and control routing and filtering. An AWS VPC and an Azure VNet are regional. A GCP VPC is global: one network spans every region, and only its subnets are regional.
Go deeper
What you get
- An address space you choose (RFC 1918 normally), split into subnets.
- Route tables that decide where traffic leaves each subnet.
- Stateful filters on instances or subnets (security groups, NSGs, firewall rules).
- Gateways for the outside world: internet, NAT, VPN, private circuits, peering.
The provider runs the actual forwarding in its own software-defined fabric. There is no broadcast and no real layer 2: ARP is answered by the hypervisor, and multicast is not supported by default.
Scope differences
| AWS VPC | Azure VNet | GCP VPC | |
|---|---|---|---|
| Scope | One region | One region | Global |
| Subnet scope | One AZ | Region (spans zones) | Region (spans zones) |
| Address space | Set on the VPC, /16 to /28, secondary CIDRs allowed | Set on the VNet, can add ranges | Set per subnet, no VPC-level CIDR |
| Routing and firewall objects | Per subnet route tables, per ENI security groups | Route tables per subnet, NSGs per subnet or NIC | Routes and firewall rules belong to the whole VPC |
Why the GCP model matters
In GCP two VMs in different regions of the same VPC talk over Google's backbone with no peering and no gateway. In AWS or Azure the same design needs one VPC or VNet per region plus peering or a transit hub between them.
They will ask next
Does a VPC have a broadcast domain like a VLAN?
No. The fabric is layer 3 underneath. Broadcast and multicast are not delivered between instances by default, and the hypervisor answers ARP for the subnet. That is why tricks such as gratuitous ARP failover between two VMs do not work in a VPC: you move a secondary IP or change a route instead.
What is the default VPC in AWS?
Every region gets one,
172.31.0.0/16, with a/20default subnet per AZ, an internet gateway and public IPs auto-assigned. It is handy for tests and a poor choice for production because its range collides with every other default VPC.
Traps
- Saying an AWS VPC spans regions. It is regional; only GCP VPCs are global.
- Treating a subnet like a VLAN where layer 2 tricks (VRRP, gratuitous ARP) just work.