Virtual Private Cloud (VPC)
Term 28 of 68 in the ERPStack technical glossary
What is Virtual Private Cloud (VPC)?
A Virtual Private Cloud (VPC) is an isolated private network carved out of a public cloud environment, allowing organizations to run servers and databases in a secure, custom network configuration.
Virtual Private Cloud (VPC) at a glance
- Structure
- 2 subnet tiers: public for load balancers, private for application and PostgreSQL 18 workloads
- Data tier rule
- 0 public IP addresses on database instances; reachable only from inside the network
- Controls
- Security groups for instance-level rules plus network ACLs at the subnet boundary
- Defined by
- Terraform, so the same topology is reproduced in 3 environments without hand-clicking
- Built with
- AWS networking defined in Terraform and applied by GitHub Actions, PostgreSQL 18 in private subnets, Kubernetes and Docker workloads beside it, Next.js 16 served through Vercel or a load balancer
- Numbers that matter
- 2 subnet tiers; 0 public IP addresses on the data tier; 3 environments from 1 definition; 1 NAT gateway for outbound-only access
- Compare with
- A flat network, public endpoints on AWS or Microsoft Azure managed services, or 1 shared network across 3 environments
- Commonly paired with
- A Bastion Host, Terraform and GitHub Actions provisioning, Docker and Kubernetes workloads, PostgreSQL 18 in the private tier, RBAC and SSO above it, and SOC 2, ISO 27001 or FedRAMP Security Controls network evidence
- Rule review
- 2 control layers, security groups and network ACLs; 3 environments each with 0 inbound paths to the data tier
- What lives in the private tier
- PostgreSQL 18 and Redis, Docker and Kubernetes nodes, and a Bastion Host as the 1 audited way in — every one of them with 0 public addresses.
- Who reads the diagram
- healthcare, finance and government assessors working to SOC 2, ISO 27001 or FedRAMP Security Controls, who sample the AWS or Microsoft Azure rules rather than the drawing.
How Virtual Private Cloud (VPC) works in production
The ERPStack approach to Virtual Private Cloud (VPC)
We deploy all production ERP instances inside isolated VPC networks, configuring firewalls and private subnets to insulate sensitive custom records.
Frequently asked questions about Virtual Private Cloud (VPC)
What does a Virtual Private Cloud actually provide?
A network boundary you control inside shared infrastructure. A Private Cloud network lets you define subnets, routing and firewall rules so that application servers are reachable only through a load balancer and databases are reachable only from those servers. It converts security from a per-instance setting, which someone will eventually get wrong, into a topology where the unsafe path does not exist.
Why must databases sit in a private subnet?
Because exposure is what gets exploited. A managed database with a public endpoint is scanned continuously, and its safety then depends entirely on credentials never leaking. Placing it in a private subnet inside a Private Cloud means an attacker needs a foothold in the network first. Combined with Row-Level Security and least-privilege database roles, that gives 3 independent barriers rather than 1.
How do private workloads reach the internet?
Outbound only, through a gateway. Application servers in a Private Cloud private subnet usually need to call payment providers or fetch updates, which a NAT gateway allows without granting any inbound route. Where the destination is another service from the same provider, a private endpoint keeps that traffic off the public internet entirely, which is both faster and easier to justify in a security review.
Should each environment have its own network?
Yes. Sharing 1 Private Cloud network between production and staging means a compromised test workload has a route to production data, and it makes network rules ambiguous to review. Separate networks per environment, defined in Terraform so they are identical by construction, cost little and remove an entire category of accident — including the misconfigured rule that was only ever meant for staging.