VPN vs VPC: not rivals, different jobs

Two different readers land on this search. One is deciding how to connect an office, a remote engineer, or another cloud account to a private network sitting inside AWS, Azure, or Google Cloud — a real architecture question with a concrete answer. The other has seen “VPC” somewhere and wants to know if it is another name for the privacy VPN this site reviews. It is not. Our full VPN rankings cover that product, and the privacy case for one gets a direct answer on its own page: do you need a VPN at home. Everything below covers the cloud-networking term instead, where the two technologies are not competing for the same job — most real cloud deployments run both.

What a VPC actually is

A virtual private cloud is a private, logically isolated slice of a public cloud provider’s network, reserved for one account. AWS’s own documentation puts it plainly: Amazon VPC lets you “launch AWS resources in a logically isolated virtual network that you’ve defined,” one that “closely resembles a traditional network that you’d operate in your own data center.” Google’s version works at a wider scope. Its VPC documentation describes a VPC network as a global resource built from regional subnets, all tied together over Google’s own backbone, rather than a single-region construct. Microsoft uses a different name for the same idea: Azure calls it a Virtual Network, described in its own overview as “the fundamental building block for your private network in Azure,” letting virtual machines and other resources reach each other, the internet, and on-premises systems. Whichever name a provider uses, the resource itself carries no separate charge. AWS states there is no additional cost for creating and using a VPC, and Microsoft says the same about a Virtual Network.

That last point clears up the second reader’s confusion. NIST’s 2011 definition of cloud computing, still the reference standard for the field, defines a private cloud as infrastructure “provisioned for exclusive use by a single organization” — a company’s own dedicated environment, not a segment carved out of a shared provider. NIST’s document does not use the term “virtual private cloud” at all. A VPC is something narrower: a private, isolated slice of a public cloud provider’s shared infrastructure, not a private cloud in NIST’s sense, and not a consumer privacy product either. It has nothing to do with hiding personal browsing. It is where a company’s servers and databases live.

What a VPN adds that a VPC does not have by default

A VPC is quiet by default. AWS’s documentation for Site-to-Site VPN states the starting condition directly: an instance launched inside an Amazon VPC “can’t communicate with” a remote device — an office network, a home worker’s laptop, another company’s system — until something builds a path in. A VPN is one standard way to build that path: an encrypted tunnel between a customer’s own equipment and the VPC, terminating at a virtual private gateway or a transit gateway on AWS’s side. Azure’s Virtual Network overview lists the same two options directly on the resource itself — a point-to-site VPN for a single computer, a site-to-site VPN between an on-premises device and an Azure VPN gateway, both sent “through an encrypted tunnel over the internet.” Google draws the same line in its own VPC documentation: a VPC “connects to on-premises networks by using Cloud VPN tunnels,” a separate service layered on top of the network, not a feature built into it.

A dedicated private circuit is the other option, and it trades the public internet for a leased line instead of encrypting a path across it. AWS Direct Connect is built around exactly that trade: traffic “remains on the AWS global network and never touches the public internet,” removing the congestion and variable latency a VPN’s internet path can hit, at the cost of provisioning a physical connection rather than just software. Azure’s ExpressRoute and Google’s Cloud Interconnect do the equivalent job on their own clouds. None of this changes what a VPC is. It only changes how something outside it gets in.

VPC vs VPN, by what each one actually is

	VPC	VPN
What it is	A private, isolated network inside one cloud provider	An encrypted tunnel between two points
What it is for	Hosting servers, databases, and apps under your control	Reaching a private network from outside it, securely
Cost of the base resource	No separate charge on AWS or Azure to create the network itself	Billed by the connection-hour, the gateway, or the traffic, depending on provider
What is missing by default	Any path in from outside — isolation is the point	A network to connect to — a VPN needs an endpoint on both sides
How you extend it	A VPN, a private circuit like Direct Connect, or nothing at all if traffic never leaves the cloud	Point to point or site to site, wherever a private network exists
What providers call it	VPC on AWS and Google Cloud; Virtual Network on Azure	Site-to-Site VPN, Client VPN, VPN Gateway — the name varies by provider

How the pieces actually combine

Real deployments rarely pick one technology over the other. They combine them by scenario, and mapping actual traffic instead of definitions is what breaks the two framings that trip people up most: that a VPC is a kind of private cloud, and that a VPC and a VPN compete for the same job.

Common cloud-networking scenarios, and what actually connects them

Scenario	What connects it
A remote employee reaching an internal app hosted in a VPC	A client VPN or point-to-site VPN from the employee device to the VPC
A branch office linking permanently to a company cloud network	A site-to-site VPN, or Direct Connect and ExpressRoute for a dedicated line
Two services inside the same VPC talking to each other	Nothing extra — traffic stays inside the isolated network by default
Two VPCs in different regions or accounts sharing data	VPC peering or a transit gateway, not a VPN, unless the traffic also leaves the cloud
Someone wanting to hide personal browsing from an ISP	A consumer VPN subscription, not a VPC or a cloud account at all

What it actually costs to connect one to the outside

AWS publishes the clearest public breakdown of what a VPN connection into a VPC costs on top of the free network. A standard Site-to-Site VPN connection runs $0.05 an hour in AWS’s US East (Ohio) region; stepping up to a high-bandwidth 5 Gbps tunnel raises that to $0.60 an hour, and routing a connection through a VPN concentrator adds $1.95 an hour for the concentrator itself plus $0.01 an hour for each connection passing through it. Data leaving AWS over that tunnel is billed the same way any other outbound traffic is: the first 100 GB a month is free, the first 10 TB after that runs $0.09 per GB, and the next 40 TB drops to $0.085 per GB. Past roughly 50 TB a month the rate keeps falling, but AWS publishes those tiers on its EC2 pricing page rather than the VPN one.

Charge	Rate
Standard Site-to-Site VPN connection (1.25 Gbps)	$0.05 per hour
High-bandwidth Site-to-Site VPN connection (5 Gbps)	$0.60 per hour
VPN concentrator	$1.95 per hour, plus $0.01 per hour per connection
Data transfer out, first 100 GB/month	Free
Data transfer out, first 10 TB/month after that	$0.09 per GB
Data transfer out, next 40 TB/month	$0.085 per GB

The VPC itself has also picked up a new charge worth flagging: AWS’s current pricing page lists VPC Encryption Controls, an optional feature that enforces encryption inside a VPC, at $0.15 to $0.31 per hour for every non-empty VPC, varying by region — a cost on the network itself, separate from anything a VPN adds on top. Google Cloud VPN bills on a different structure entirely: an hourly charge per gateway, a separate monthly charge for IPsec traffic, and an hourly charge for any external IP address attached to a gateway but not carrying a tunnel. Google’s own pricing page confirms that three-part structure without exposing a flat per-unit rate in an easily quoted form, so treat the billing model as confirmed and check the exact figure at signup. Azure’s Virtual Network carries no charge of its own either — cost only starts once a VPN gateway is added, priced by the gateway tier chosen.

Choose a VPC on its own if

• Servers, databases, and internal apps only ever need to talk to each other, not to anything outside the cloud.
• A new cloud environment is being provisioned and nobody has decided yet how it will be reached from outside.
• Resources should stay isolated from the public internet by default, with no inbound path until one is explicitly added.

Add a VPN when

• An office, a remote worker, or another private network needs to reach resources inside the VPC.
• The connection is occasional or the bandwidth needs are modest — a VPN bills by the hour or the gateway, not for a dedicated physical line.
• The path needs to be encrypted end to end without provisioning a private circuit.

Consider a private circuit instead when

• Bandwidth is high and constant enough that the public internet’s variable latency is an actual bottleneck, not a theoretical one.
• A compliance requirement calls for traffic that never touches the public internet — the specific claim behind AWS Direct Connect, Azure ExpressRoute, and Google Cloud Interconnect.

None of the eight providers reviewed on this site sell VPC hosting, site-to-site VPN gateways, or private circuits — those are cloud-infrastructure products sold by AWS, Google, Microsoft, and specialist networking vendors, bought by a company’s IT or platform team, not a subscription an individual signs up for. Our guide to what a VPN is and how it works covers the mechanics behind the consumer-side tunnel these providers do sell, and our VPN vs VDI comparison covers the closest other architecture-level question on this site, for a company deciding how remote staff should reach internal systems.

Frequently asked questions

What is the difference between a VPN and a VPC?

A VPN is an encrypted tunnel between two points. A VPC is an isolated private network inside a cloud provider where resources actually run. One moves traffic securely; the other is a place resources live.

Can a VPN replace a VPC?

No. A VPN is a connection method with nothing to host. A VPC is where servers, databases, and applications are deployed. Removing the VPC leaves nothing for a VPN to connect to.

Do I need a VPN for my VPC?

Only if something outside the VPC needs to reach it — an office, a remote worker, or another network. A VPC that only serves traffic to other resources inside the same cloud account never needs one.

Can I access a VPC without a VPN?

Yes. Resources inside a VPC communicate with each other privately with no VPN involved, and a VPC can also expose a public endpoint through an internet gateway, or connect through a dedicated line like AWS Direct Connect instead of a VPN.

When should I use a VPN vs a VPC?

That framing does not quite apply — a VPC is what you build, a VPN is one way something outside reaches it. Use a VPN when an office, remote device, or outside network needs secure access into a VPC you already have.

What is a VPC in AWS?

Amazon VPC lets an account launch resources in a logically isolated virtual network, similar to a traditional data center network, without any base charge for the network itself.

Can a VPN connect to a VPC?

Yes. AWS documents connecting a VPC to an on-premises network with a Site-to-Site VPN, terminating at a virtual private gateway or transit gateway on the AWS side, encrypting the traffic between the two.

Is a VPC more secure than a VPN?

They are not comparable that way. A VPC provides isolation and access control for where resources sit; a VPN protects traffic in transit between two points. A typical cloud deployment needs both, not a choice between them.