A VPC is your own isolated network, regional, never global.
Every other service in this deck attaches to one.
RegionA VPC lives entirely inside one Region
VPC (CIDR block)Spans every AZ in the Region automatically
SubnetsCarved from the VPC's CIDR, one AZ each
ResourcesEC2, RDS, ENIs — live inside exactly one subnet
Default VPC vs. custom VPC
DefaultCustom
Public subnetsEvery AZYou choose
Internet GatewayAttachedYou attach
Fit for productionNoYes
A VPC can extend its CIDR later with secondary ranges — but it can never shrink one. Size the first CIDR deliberately.