AWS VPC with public and private subnets across us-east-1a demonstrates a foundational network isolation pattern using Internet Gateway and NAT Gateway. Internet traffic routes through the public subnet's IGW, while private subnet EC2 instances access external resources via NAT Gateway, maintaining inbound security. This architecture enforces least-privilege access with separate security groups controlling SSH from bastion hosts and HTTPS within the VPC. Fork this diagram to customize CIDR blocks, add multi-AZ redundancy, or extend with additional private subnets for databases and caches.