Amazon VPC features

Amazon Virtual Private Cloud provides features that you can use to increase and monitor the security for your virtual private cloud (VPC):

  • Reachability Analyzer: Reachability Analyzer is a static configuration analysis tool that enables you to analyze and debug network reachability between two resources in your VPC. After you specify the source and destination resources in your VPC, Reachability Analyzer produces hop-by-hop details of the virtual path between them when they are reachable, and identifies the blocking component when they are unreachable. You can learn about how to get started with this feature here.
  • VPC Flow Logs: You can monitor your VPC flow logs delivered to Amazon S3 or Amazon CloudWatch to gain operational visibility into your network dependencies and traffic patterns, detect anomalies and prevent data leakage, or troubleshoot network connectivity and configuration issues. The enriched metadata in flow logs helps you gain additional insights into who initiated your TCP connections and the actual packet-level source and destination for traffic flowing through intermediate layers such as the NAT Gateway. You can also archive your flow logs to assisst in meeting certain compliance requirements. You can learn about how to get started with this feature here.
  • VPC Traffic Mirroring: VPC traffic mirroring allows you to copy network traffic from an elastic network interface of Amazon EC2 instances and then send the traffic to out-of-band security and monitoring appliances for deep packet inspection. With VPC traffic mirroring, you can detect network and security anomalies, gain operational insights, implement compliance and security controls, and troubleshoot issues. VPC Traffic Mirroring as a feature that gives you direct access to the network packets flowing through your VPC. You can learn about how to get started with this feature here.
  • Security Groups: Security groups act as a firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the instance level. When you launch an instance, you can associate it with one or more security groups that you've created. Each instance in your VPC could belong to a different set of security groups. If you don't specify a security group when you launch an instance, the instance is automatically associated with the default security group for the VPC. For more information, see security groups for your VPC.
  • Network Access Control List: A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC. Click here to read about the specific differences between security groups and network ACLs. 

Using other AWS resources with Amazon VPC

There are many resources that can be used with your virtual private cloud (VPC):

Easily connect Amazon VPCs, AWS accounts, and on-premises networks to a single gateway.
Establish private connectivity between VPCs and services hosted on AWS or on-premises, without exposing data to the internet.
Deploy network security across your Amazon VPCs with just a few clicks.
Extend your on-premises networks to the cloud and securely access them from anywhere.
Allow your VPC private subnet workloads to access the internet while preventing the internet from initiating a connection with those instances

Intended Usage and Restrictions

Your use of this service is subject to the Amazon Web Services Customer Agreement.

Learn more about Amazon VPC pricing

Visit the pricing page
Ready to get started?
Sign up
Have more questions?
Contact us