Lecture 7: Scope of VPC with respect to AWS Account, Region & AZ
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：08:18
- 来源：Udemy Lecture 42823386
- Slide 数量：4
- 画面切换：约 00:30、02:42、04:55
扫描说明
按页面英文 transcript 的 115 个时间点扫描视频，并在三个切换区间逐秒复核。相同幻灯片中的动画构建（Region、Availability Zone、VPC、Subnet 及 AWS 服务图标逐步出现）合并在同一小节中。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. AWS Account → Region & AZ → VPC
时间范围：00:00–00:30
总结 / Summary
中文
本节从鸟瞰视角（bird's-eye view）提出虚拟私有云范围（VPC scope）问题：一个虚拟私有云（Virtual Private Cloud, VPC）能否跨越多个 AWS 区域（AWS Regions）或多个 AWS 账户（AWS Accounts）承载资源（resources）？为了回答这个问题，需要先理解 AWS 账户（AWS Account）、AWS 区域（AWS Region）、可用区（Availability Zone, AZ）和 VPC 之间的层级关系。
English
This introduction frames the question from a bird's-eye view: can a Virtual Private Cloud (VPC) host resources across multiple AWS Regions or AWS accounts? Answering it requires understanding the hierarchy and scope of an AWS account, AWS Region, Availability Zone (AZ), and VPC.
Transcript
00:00 Hi, this is very short but a special lecture and I created this because many a times I get questions
00:06 something like can VPC host resources across AWS regions or across AWS account.
00:12 And hence it is very important that you see the VPC scope from the bird's eye view so that it is very
00:19 clear from the very beginning.
00:21 So in this lecture, let's try to relate how AWS account regions AZS and VPC relate to each other.
00:29 Okay, so a quick refresher about the regions and availability zone.
2. One Region = Multiple Availability Zones
时间范围：00:30–02:42
总结 / Summary
中文
AWS 的基础地理边界是 AWS 区域（AWS Region）。用户可以根据用户群位置（user location）和数据驻留要求（data residency requirements）选择区域。每个区域包含多个彼此隔离的可用区（Availability Zones, AZs），它们使用独立位置和冗余电力（redundant power）来支持高可用性（high availability）。VPC 的范围是区域级别（Regional scope）：每个 VPC 只能属于一个区域，跨区域部署需要创建不同的 VPC。不同区域中的 VPC 可以通过 VPC 对等连接（VPC Peering）、中转网关（Transit Gateway）等网络连接方案（network connectivity options）建立私有连接（private connectivity）。
English
An AWS Region is the fundamental geographic boundary in AWS. Customers choose Regions based on factors such as user location and data residency requirements. Each Region contains multiple isolated Availability Zones (AZs), designed with separate locations and redundant power to support high availability. A VPC has Regional scope: it belongs to exactly one Region, so a multi-Region deployment requires separate VPCs. VPCs in different Regions can communicate privately through connectivity options such as VPC Peering or Transit Gateway.
Transcript
00:33 Now in AWS everything starts with AWS region.
00:37 And as of today there are 32 regions with 102 availability zone.
00:41 And this number will grow in the future.
00:44 Now why there are so many regions?
00:46 So depending on your user base or you know, the data residency requirements, you can choose in which
00:53 region you want to deploy your workloads.
00:55 Now further, every region is made up of multiple availability zones or also called as AZS, and these
01:04 AZS provides the high availability for your workloads.
01:07 The way AZS are built, they are separated from each other and they have redundant power.
01:12 Their location is separate so that the natural disaster doesn't typically bring down two AZS at the
01:19 same time, and then you can deploy your application into multiple AZS so that even if one AZ goes down
01:24 for some reason, your application is still up and running into another AZ.
01:30 And all this really depends on your network architecture.
01:33 That means your VPC architecture, and we'll talk more about that shortly.
01:38 So here in this lecture we are going to talk about the VPC.
01:40 So if you ask me what's the scope of the VPC.
01:43 So the scope of the VPC is at region level.
01:47 That means when you create a VPC you create that in a particular AWS region.
01:51 Now consider that you are a global company and hence you use multiple AWS regions.
01:57 Now in that case you would have to create a different VPC in another AWS region.
02:02 And then you can have your applications deployed in both these VPCs in different AWS regions.
02:08 Now many a times these applications needs to communicate with each other.
02:12 And in that case you can connect these two VPCs over different network connectivity options that AWS
02:19 provides to you.
02:20 So if you heard about VPC peering or transit gateways, these are the ways in which you can connect
02:25 these VPC privately.
02:27 But more about that we will talk in the following section.
02:30 But you can have that private connectivity okay.
02:34 So from this slide I want you to take that VPC scope is at region level okay.
02:40 Now let's understand the VPC scope with respect to AWS account region and availability zones.
3. VPC Scope with respect to AWS Account, Region and AZs
时间范围：02:42–04:55
总结 / Summary
中文
AWS 账户（AWS Account）是顶层实体（top-level entity），一个账户可以使用多个 AWS 区域（AWS Regions），每个区域可以创建一个或多个 VPC。VPC 属于单个区域（Region），但可以横跨该区域内的多个可用区（Availability Zones, AZs）。虽然所有应用在逻辑上可以部署到一个 VPC，但最佳实践（best practice）是按照应用或项目在网络层（network layer）进行隔离。Amazon EC2 实例（Amazon EC2 instance）是可用区级资源（AZ-scoped resource），单个实例一次只能位于一个 AZ；它最终部署在哪个 AZ，由其所在的子网（Subnet）决定。
English
An AWS account is the top-level entity and can use multiple AWS Regions. Each Region can contain one or more VPCs. A VPC belongs to one Region but can span multiple Availability Zones within that Region. Although applications could logically share a single VPC, a common best practice is to isolate networks by application or project. An Amazon EC2 instance is an AZ-scoped resource and can reside in only one AZ at a time; the subnet selected for the instance determines that AZ.
Transcript
02:47 So everything is part of your AWS account.
02:50 So once you get your AWS account you can deploy your workload in any of the available AWS regions.
02:58 Right.
02:58 So there are all those regions for you.
03:00 And as you know, every region has multiple AZS.
03:03 Now some region can have like three AZS, some region can have 4 or 6.
03:09 That really depends on the size of the region.
03:11 So you can go to AWS documentation and check how many AZS are there in a particular region.
03:17 So if you talk about Mumbai region, there are three AZS.
03:19 And if we talk about the North Virginia region, it has six availability zones.
03:25 Now, as I said, when you create a VPC, you create that in a particular region.
03:30 So in different region there will be different VPC.
03:35 Now you can create as many VPCs that you want in a given region.
03:39 Typically AWS will put some default limit generally five VPCs, but you can definitely increase that
03:46 limit.
03:46 Now one question is why would you need multiple VPCs?
03:50 Logically speaking, you can deploy all your application into the single VPC, but with respect to the
03:57 best practices, it makes sense to isolate your network based on your application or your projects so
04:03 that maybe a finance application is within its own VPC and then air application is in its own VPC.
04:10 So there are these kind of best practices to isolate your application at the network layer.
04:17 So if you talk about the Mumbai region, you can see here that there is a VPC and it is spanning across
04:22 multiple availability zones.
04:24 Now if you heard about the AWS service called EC2, which is a virtual machine, then EC2 sits into
04:31 a particular AZ.
04:33 That means one EC2 machine cannot be in two AZS at the same time.
04:37 While launching the EC2 instance, you decide whether it has to be launched in AZ one or AZ two.
04:43 Now, if that's the case, then you know that EC2 is launched inside a VPC.
04:49 Then how do you make that decision in which AZ, the EC2 will be launched?
04:54 Now that is decided using the subnets.
4. AWS Services Scope with respect to VPC
时间范围：04:55–08:18
总结 / Summary
中文
子网（Subnet）只属于一个可用区（Availability Zone, AZ），而 VPC 属于一个 AWS 区域（AWS Region）。因此跨三个 AZ 部署 Amazon EC2 实例（Amazon EC2 instances），至少需要三个子网。Amazon EC2 和 Amazon RDS 是可用区级服务（AZ-scoped services）；弹性负载均衡器（Elastic Load Balancer, ELB）是 VPC 级服务（VPC-scoped service），可把流量分发到 VPC 内不同 AZ 的资源。Amazon S3 和 Amazon DynamoDB 属于区域级服务（Regional services），不部署在用户的 VPC 内；Amazon Route 53、AWS 身份与访问管理（AWS Identity and Access Management, IAM）以及账单服务（Billing）属于全球级服务（Global services）。
English
A subnet belongs to exactly one Availability Zone, while a VPC belongs to one AWS Region. Deploying Amazon EC2 instances across three AZs therefore requires at least three subnets. Amazon EC2 and Amazon RDS are AZ-scoped services. An Elastic Load Balancer (ELB) is VPC-scoped and can distribute traffic to resources in different AZs within the VPC. Amazon S3 and Amazon DynamoDB are Regional services and are not deployed inside the customer's VPC. Amazon Route 53, AWS Identity and Access Management (IAM), and Billing are Global services.
Transcript
04:57 So after you create the.
04:59 VPC.
04:59 You can create multiple subnets inside the VPC, and while creating this subnet you decide in which
05:06 AZ this subnet will be.
05:07 Right.
05:08 So here if you want to create EC2 instances in three different AZS then you will need at least three
05:16 subnets.
05:16 And then you can likewise create as many subnets as you want.
05:20 So subnet is mapped to the AZ and VPC is mapped to the AWS region.
05:27 So I hope that is clear.
05:28 So if you talk about the AWS services like EC2 or RDS, that is database service.
05:33 The scope of those services is AZ level, which means you have to carefully design your subnets for
05:41 those uses.
05:42 And then you can deploy these services into respective subnets.
05:46 Okay, I hope that is clear.
05:48 Now if you talk about other AWS services, for example, Elastic Load Balancer, it distributes the
05:54 incoming traffic across multiple machines inside your VPC.
05:58 And these machines can be in different availability zones.
06:02 So the ELB has a scope of VPC level.
06:07 That means it can distribute traffic across any of the AC inside that VPC.
06:12 So some of the AWS services will have the scope of the VPC.
06:17 So that's about some of the services which works at AZ level and the VPC level.
06:23 However, if you talk about the services for example S3 bucket, when you create a S3 bucket, you decide
06:30 the region for that bucket.
06:31 You never put S3 bucket inside your VPC.
06:34 That's because it's fully managed AWS service and AWS manages the network for S3.
06:40 So the scope of S3 is a regional right?
06:44 So you create a bucket, you decide in which region it should be, and then it can be accessed over
06:49 the internet.
06:50 Right.
06:51 So some of the AWS services will have the regional scope, which means they are not inside your VPC.
06:58 And finally, if you talk about the AWS services like route 53 which is a DNS service, it has a global
07:05 scope.
07:05 It doesn't sit into a particular AWS region they operate at globally.
07:10 Similarly other services, for example IAM, which is identity and access management, through which
07:16 you create multiple users into your AWS account.
07:19 It also has the global scope, which means IAM users can access any resources across any AWS region.
07:25 And similarly, billing service is like global, which means that you get a single bill at the end of
07:31 the day, irrespective of how many AWS regions you use.
07:36 Right.
07:36 So from this slide, uh, what I want you to take is that AWS account is a top level entity.
07:43 And then under that you get access to multiple AWS regions.
07:47 And then in every region you can create one or more VPCs.
07:51 And then in order to use multiple availability zone within the region, you have to create subnets inside
07:58 that VPC.
07:59 So that's it about this lecture.
08:01 So I hope it is clear that where VPC sits with respect to AWS account and the region and you can visualize
08:08 their placement.
08:09 So now we'll start with the basics of the VPC and further deep dive into VPC components.
08:15 So thanks for watching and stay tuned.
整讲总结 / Overall Summary
中文
AWS 账户（AWS Account）可以使用多个 AWS 区域（AWS Regions），每个区域可以创建多个虚拟私有云（Virtual Private Clouds, VPCs）。VPC 的范围是区域级别（Regional scope），它不能跨越区域，但可以横跨同一区域内的多个可用区（Availability Zones, AZs）。子网（Subnet）只属于一个 AZ，并决定 Amazon EC2 实例（Amazon EC2 instance）等可用区级资源（AZ-scoped resources）的部署位置。不同 AWS 服务具有不同范围：可用区级（AZ scope）、VPC 级（VPC scope）、区域级（Regional scope）或全球级（Global scope）。理解这些边界是设计高可用架构（highly available architecture）、网络隔离（network isolation）和多区域连接（multi-Region connectivity）的基础。
English
An AWS account can use multiple AWS Regions, and each Region can contain multiple Virtual Private Clouds (VPCs). A VPC has Regional scope: it cannot span Regions, but it can span multiple Availability Zones within its Region. A subnet belongs to one AZ and determines the placement of AZ-scoped resources such as an Amazon EC2 instance. AWS services may have AZ, VPC, Regional, or Global scope. Understanding these boundaries is fundamental to designing highly available architectures, network isolation, and multi-Region connectivity.
返回顶部 ↑