Virtual Private Cloud
also called VPC, VNet
A logically isolated network inside a cloud provider, with an address range you control and explicit rules for what may enter and leave.
The VPC is the primary network trust boundary in a cloud architecture, and its design is difficult to change later because everything gets addresses from it.
The decisions that are expensive to revisit: the CIDR range, which must be large enough for years of growth and must not overlap with any network you will ever need to peer with — including the corporate network and any acquisition. Overlapping ranges are the single most common cause of painful cloud networking work.
Then subnet layout: public subnets (routable to an internet gateway) for load balancers only, private subnets for compute, isolated subnets for data, spread across availability zones — since a subnet lives in exactly one zone, multi-AZ means one subnet per zone per tier.
Finally, how private traffic reaches managed services: a NAT gateway costs per hour and per GB and is a frequent surprise on the bill, whereas private endpoints keep the traffic off the public path and often cost less.