Overview

Define and manage your virtual networking: VPCs, subnets, firewall policies and rules, and the quotas that keep usage in check, all from a single console. Network gives you one place to design isolated, secure connectivity for your resources, with a model built to extend across the clouds you manage.

Every VPC is scoped to a workspace and a zone, and the connectivity you define here is what your compute instances and other resources attach to. The model is engine-agnostic: you work in terms of VPCs, subnets, and firewall rules, and the platform provisions them on the underlying network fabric.

Core resources

Virtual Private Clouds (VPCs): the top-level isolation boundary. A VPC is scoped to a workspace and a zone, owns a CIDR block, and parents the subnets and firewall policies inside it.
Subnets: a subdivision of a VPC’s address space. A subnet’s CIDR is a non-overlapping subset of its parent VPC, and its gateway IP is derived automatically when you don’t set one.
Firewall policies: a named collection of firewall rules attached to a VPC. A whole policy can be disabled at once, which stops all of its rules from being enforced.
Firewall policy rules: a single rule, with a direction (ingress or egress), an action (allow or deny), a priority, and one or more protocol matches with optional port ranges and source or destination CIDRs.
Quotas: a quota definition sets the default cap on how many network resources a container (organisation, workspace, or group) may consume; a quota limit overrides that default for a specific container.
Operations: the record returned by every network mutation. A resource’s provider-assigned id is filled in once the underlying network fabric finishes provisioning it.

Get started

Create a VPC and subnet Carve out your first isolated network.

VPCs and subnets The address model and how CIDRs nest.

Use cases

Reference architectures

Training and tutorials

Compute VMs attach to the subnets defined here.

Taxonomy Workspaces and groups that scope VPCs and quotas.

IAM Authorizes every network call.

Security baseline Platform-wide security guidance.