Skip to main content
Security & Access

Virtual Private Cloud (VPC)

Term 28 of 68 in the ERPStack technical glossary

What is Virtual Private Cloud (VPC)?

A Virtual Private Cloud (VPC) is an isolated private network carved out of a public cloud environment, allowing organizations to run servers and databases in a secure, custom network configuration.

Virtual Private Cloud (VPC) at a glance

Structure
2 subnet tiers: public for load balancers, private for application and PostgreSQL 18 workloads
Data tier rule
0 public IP addresses on database instances; reachable only from inside the network
Controls
Security groups for instance-level rules plus network ACLs at the subnet boundary
Defined by
Terraform, so the same topology is reproduced in 3 environments without hand-clicking
Built with
AWS networking defined in Terraform and applied by GitHub Actions, PostgreSQL 18 in private subnets, Kubernetes and Docker workloads beside it, Next.js 16 served through Vercel or a load balancer
Numbers that matter
2 subnet tiers; 0 public IP addresses on the data tier; 3 environments from 1 definition; 1 NAT gateway for outbound-only access
Compare with
A flat network, public endpoints on AWS or Microsoft Azure managed services, or 1 shared network across 3 environments
Commonly paired with
A Bastion Host, Terraform and GitHub Actions provisioning, Docker and Kubernetes workloads, PostgreSQL 18 in the private tier, RBAC and SSO above it, and SOC 2, ISO 27001 or FedRAMP Security Controls network evidence
Rule review
2 control layers, security groups and network ACLs; 3 environments each with 0 inbound paths to the data tier
What lives in the private tier
PostgreSQL 18 and Redis, Docker and Kubernetes nodes, and a Bastion Host as the 1 audited way in — every one of them with 0 public addresses.
Who reads the diagram
healthcare, finance and government assessors working to SOC 2, ISO 27001 or FedRAMP Security Controls, who sample the AWS or Microsoft Azure rules rather than the drawing.

How Virtual Private Cloud (VPC) works in production

VPCs isolate your cloud infrastructure from other cloud accounts. Within a VPC, engineers configure subnets, route tables, and gateways. By placing databases in private subnets and only exposing web load balancers in public subnets, systems are protected from automated port scans and DDoS attacks.

The ERPStack approach to Virtual Private Cloud (VPC)

We deploy all production ERP instances inside isolated VPC networks, configuring firewalls and private subnets to insulate sensitive custom records.

Frequently asked questions about Virtual Private Cloud (VPC)

What does a Virtual Private Cloud actually provide?

A network boundary you control inside shared infrastructure. A Private Cloud network lets you define subnets, routing and firewall rules so that application servers are reachable only through a load balancer and databases are reachable only from those servers. It converts security from a per-instance setting, which someone will eventually get wrong, into a topology where the unsafe path does not exist.

Why must databases sit in a private subnet?

Because exposure is what gets exploited. A managed database with a public endpoint is scanned continuously, and its safety then depends entirely on credentials never leaking. Placing it in a private subnet inside a Private Cloud means an attacker needs a foothold in the network first. Combined with Row-Level Security and least-privilege database roles, that gives 3 independent barriers rather than 1.

How do private workloads reach the internet?

Outbound only, through a gateway. Application servers in a Private Cloud private subnet usually need to call payment providers or fetch updates, which a NAT gateway allows without granting any inbound route. Where the destination is another service from the same provider, a private endpoint keeps that traffic off the public internet entirely, which is both faster and easier to justify in a security review.

Should each environment have its own network?

Yes. Sharing 1 Private Cloud network between production and staging means a compromised test workload has a route to production data, and it makes network rules ambiguous to review. Separate networks per environment, defined in Terraform so they are identical by construction, cost little and remove an entire category of accident — including the misconfigured rule that was only ever meant for staging.

Related reading

Explore Custom ERP Solutions by Location, Industry, and Alternatives

Global Architectures