Default VPC

New AWS users shouldn’t need to understand routing tables and gateways just to launch their first EC2 instance. The default VPC solves this by giving every account a ready-to-use, internet-connected network in every region the moment the account is created — a /16 CIDR, a public subnet in every AZ, an attached Internet Gateway, and a route table that already sends 0.0.0.0/0 traffic to it.

• AWS provisions exactly one default VPC per region, with CIDR 172.31.0.0/16.
• It includes one default subnet per AZ in that region, each a /20 slice of the VPC CIDR.
• All default subnets are public — their route table already points 0.0.0.0/0 at the attached Internet Gateway.

graph TD
subgraph VPC["Default VPC — 172.31.0.0/16"]
  IGW["Internet Gateway (auto-attached)"]
  subgraph AZa["AZ a"]
    SUBa["Default Subnet 172.31.0.0/20"]
  end
  subgraph AZb["AZ b"]
    SUBb["Default Subnet 172.31.16.0/20"]
  end
end
IGW --> SUBa
IGW --> SUBb
classDef subnet fill:#eaf7ec,stroke:#2e8b3d,stroke-width:2px,color:#1a3d20
class SUBa,SUBb subnet

The default VPC costs nothing on its own — same rule as any VPC. Because it launches instances with public IPs by default, though, it’s worth watching for unexpected Elastic IP or data-transfer charges if you leave test resources running.

• If you delete the default VPC, AWS does not recreate it automatically — you’d have to build an equivalent VPC manually (or contact support in older accounts).
• Instances launched into a default subnet without specifying a subnet get a public IPv4 address automatically — a common exam trap when comparing default vs. custom VPC behavior.
• New AWS accounts created after Dec 2023 in some regions may not get a default VPC automatically — know that this is opt-in/varies, and the exam tests the concept (public, pre-wired, one per region) more than that exact policy detail.
• A default VPC is otherwise a completely normal VPC — you can still add custom subnets, security groups, and route tables to it.