Glossary
VPC
Meaning and details
A VPC is your own walled garden inside someone else's cloud: a private IP range, subnets you define, routing tables, and gateways that decide what talks to what. Databases can sit in a subnet with no route to the interne...
VPC meaning
A virtual private cloud: a logically isolated section of a public cloud where your resources run in a private network you control.
What is VPC?
A VPC is your own walled garden inside someone else's cloud: a private IP range, subnets you define, routing tables, and gateways that decide what talks to what. Databases can sit in a subnet with no route to the internet, reachable only by your application tier; a bastion or VPN is the single door a human uses. AWS, Google Cloud, Azure, Hetzner Cloud and every serious provider offer the construct, and misconfiguring it is simultaneously the most common and most preventable source of cloud security incidents.
Why it matters to an indie builder: the day a customer's security questionnaire asks where your database lives and who can reach it, a VPC with a private subnet is the difference between a checkbox and an email thread. Earlier than that, it is free defense in depth: even with a leaked credential, an attacker on the public internet cannot connect to a database that has no public address, which is the entire value proposition stated in one sentence.
A concrete example: a standard three-tier setup. The application servers hold public IPs behind a load balancer; the Postgres instance sits in a private subnet whose security group accepts traffic only from the app tier on port 5432; admin access flows through one bastion host requiring SSH keys. A leaked database password, the single most common leak vector, becomes nearly worthless: the password works only from inside a network the attacker is not in. Compare the default alternative, database bound to 0.0.0.0, where the same leak is a full breach within the hour.
Common mistakes: 0.0.0.0/0 on port 22 or 5432 because connectivity testing was easier that day and the rule survived, treating VPC peering or private links as optional once two services need to talk, public endpoints on internal services with security by obscurity, and no egress rules at all, which matters the moment a compromised box wants to exfiltrate or mine, outbound restrictions are the half of the firewall everyone forgets. The hosting and devops blocks on IndieBoot mark providers whose networking primitives make the right configuration the easy one.