Skip to main content
See Resource references for accepted reference kinds, lookup scopes, canonical identities and exact list filters. A VPC is a private network in one region, carved into subnets, with interfaces (NICs) allocated out of those subnets. Nothing in a VPC can reach the internet or be reached from it until you add a gateway and a route, which is deliberate: an address alone is never enough here. The service is regional. The endpoint carries the region: https://network.sa-saopaulo-1.basaltic.sh.

VPCs

Why the CIDR has to be private, and the one field you can only set at create.

Subnets

What “public” actually means, which addresses you don’t get, and what blocks a delete.

Interfaces

A NIC with its own identity, and what survives a detach from an instance.

Route tables and routes

The table a subnet uses is what makes it public or private.

Gateways

Internet, NAT and egress-only — and why creating one moves no traffic.

Floating IPs

The four things a reachable instance needs, only one of which is the address.

Security groups

Stateful allow rules, the default-deny posture, and what the platform enforces regardless.

Permissions

Every IAM action the service checks, and where a policy wildcard is wider than it looks.

Quotas and troubleshooting

What each refusal is telling you, the teardown order, and the one quota two features share.

API reference

Every endpoint, with the IAM action each one requires.

​
The shape of it

Three layers decide whether a packet arrives, and they fail in different ways.
1

Addressing

The VPC’s CIDR, the subnet’s slice of it, and the interface’s address out of that. All private, all decided at create — none of it makes anything reachable.
2

Routing

A gateway attached to the VPC, and a route in the subnet’s table pointing at it. This is what turns a subnet public or private, and it is the layer people skip.
3

Filtering

A security group on the interface. An interface in no group drops everything, so this is the last thing to get wrong and the first thing people check.
The order matters when something does not work. A routing problem looks exactly like a filtering problem from outside — both present as silence — so check the route before you start editing rules. Troubleshooting walks that split.

​
Everything here takes tags

Every resource in this service accepts a tags map and is authorized by CRN, so policies can name them precisely and condition on their tags. Permissions has the full action list and the places where a name-based CRN is broader than it appears.