AWS is a public cloud. Under the NIST definition, a public cloud is infrastructure provisioned for open use by the general public on the provider's premises, and that is how Amazon Web Services works. Inside it you can still build isolated networks with Amazon VPC, rent single-tenant hardware, or run AWS racks on site with AWS Outposts.
Key takeaways
- AWS is a public cloud provider: anyone can sign up, and workloads run on shared infrastructure in Amazon's data centres.
- A "virtual private cloud" (VPC) on AWS is a logically isolated network inside the public cloud, not a private cloud in the NIST sense.
- EC2 Dedicated Hosts give you a physical server reserved for your use, which helps with licensing and some compliance rules.
- AWS Outposts puts AWS-managed hardware on your premises, which makes a hybrid setup with the same APIs and tools.
- Under the shared responsibility model AWS secures the infrastructure, and you secure what you build and store on it.
What is the difference between a public and a private cloud?
The difference is who the infrastructure is provisioned for. A public cloud serves many unrelated customers; a private cloud serves one organisation only.
The NIST Definition of Cloud Computing (SP 800-145) is the reference most contracts and auditors use. It describes four deployment models:
- Public cloud: provisioned for open use by the general public and located on the provider's premises.
- Private cloud: provisioned for exclusive use by a single organisation. It can be owned and run by that organisation or a third party, on or off premises.
- Community cloud: shared by a specific group of organisations with common concerns, such as a set of public agencies.
- Hybrid cloud: two or more of these models bound together so that data and applications can move between them.
Ownership of the hardware is not the test. A private cloud can sit in a hosting provider's facility. What matters is whether the pool of resources is dedicated to one customer.
Why is AWS classed as a public cloud?
AWS is open to any company or individual with a payment card, and its services run on infrastructure that Amazon owns and operates in its own Regions. That matches the NIST public cloud model point for point.
In practice this means:
- Self-service: you create servers, databases and storage through a console or API in minutes, without a purchase order for hardware.
- Multi-tenancy: by default your virtual machines share physical hosts with other customers, separated by the hypervisor.
- Pay as you go: you pay for what you use, with discounts if you commit to a level of usage.
- Provider-run facilities: AWS runs the buildings, power, cooling, hardware and network. You never touch a physical server.
Microsoft Azure and Google Cloud are public clouds for the same reasons.
Is an AWS VPC a private cloud?
No. The name is confusing, but a VPC is a private network inside the public cloud, not a dedicated cloud.
AWS describes Amazon VPC as a way to launch resources in a logically isolated virtual network that you define. You choose the IP ranges, subnets, route tables and gateways. Other customers cannot reach your VPC unless you connect to them. The servers underneath are still shared AWS hardware.
For most security and data protection needs, that logical isolation is enough. Encryption, IAM policies, security groups and private connectivity (VPN or AWS Direct Connect) do the rest. You only need dedicated hardware when a licence, regulator or internal policy requires it.
Which AWS options give you private-cloud features?
AWS offers three main ways to get closer to a private cloud without leaving its platform.
| Option | What it is | Where it runs | Typical reason to use it |
|---|---|---|---|
| Amazon VPC | Logically isolated virtual network | AWS Region, shared hardware | Default network isolation for every workload |
| EC2 Dedicated Instances and Dedicated Hosts | Instances on hardware not shared with other AWS accounts; a Dedicated Host is a whole physical server for you | AWS Region, single-tenant hardware | Per-socket or per-core software licences, rules that forbid multi-tenant servers |
| AWS Outposts | AWS-managed racks or servers installed at your site | Your data centre or edge location | Low latency to factory or local systems, data that must stay on premises |
AWS says an EC2 Dedicated Host is a physical server fully dedicated for your use, which helps when organisations need dedicated rather than multi-tenant servers or want to bring their own licences. AWS Outposts is a family of fully managed services that delivers AWS infrastructure and services to on-premises or edge locations, from 1U and 2U servers up to 42U racks.
None of these turns AWS into a private cloud. They are tools to meet specific isolation, licensing or locality needs inside a public cloud or a hybrid design.
Public cloud, private cloud or hybrid: which fits your workloads?
Most organisations end up with a mix. Pick per workload rather than for the whole estate.
- Public cloud (AWS) fits variable or seasonal demand, new digital products, analytics and AI workloads, and teams that want managed databases and automation instead of hardware refreshes.
- Private cloud fits stable, predictable workloads with long hardware lifetimes, strict single-tenancy rules, or very large steady compute where you already own data centre capacity.
- Hybrid fits factories and sites that need local processing, core systems that cannot move yet, and phased migrations where both sides must work together for a while.
For EU and Nordic organisations, data residency is often the deciding question. You choose the AWS Region where data is stored (for example Stockholm for Sweden), and AWS states it will not move or replicate your content outside that Region without your agreement. Regulated sectors should map NIS2, GDPR and sector rules to concrete controls before deciding that a private cloud is the only option. Often it is not.
Who is responsible for security on AWS?
Both you and AWS, split by layer. AWS calls this the shared responsibility model.
AWS is responsible for security "of" the cloud: the hardware, software, networking and facilities that run its services. You are responsible for security "in" the cloud: identity and access, operating system patching on EC2, network rules, encryption settings and your data. In a private cloud you own every layer yourself. On AWS you hand over the bottom layers, but the configuration of everything you deploy stays on your side.
What moving from private infrastructure to AWS looks like
Swedish ski resort group Branäsgruppen ran its websites and booking systems on an on-premises VMware ESXi estate. Scaling for the December to April season was manual, and deployments required taking the environment down. Opsio planned and ran a migration to AWS using auto-scaling, multi-AZ deployment and managed databases.
The Branäsgruppen case reports a 40% improvement in average page responsiveness, a 40% reduction in total cost of ownership and 99.9%+ application uptime after the move. Web front-ends, middleware and databases that once needed manual scaling now grow and shrink with seasonal demand.
How Opsio helps
Opsio is an AWS Advanced Tier Services Partner with the AWS Migration Competency, with offices in Karlstad, Sweden and Bangalore, India. We help teams decide which workloads belong in public cloud, private cloud or a hybrid cloud setup, and then run them. Our AWS managed services cover 24/7 monitoring, patching, security baselines and cost control.
Frequently asked questions
Is AWS a public, private or hybrid cloud?
AWS is a public cloud. You can build a hybrid cloud with it by connecting your own data centre through VPN or Direct Connect, or by installing AWS Outposts on site. AWS itself is not a private cloud.
Is AWS IaaS, PaaS or SaaS?
AWS offers all three. EC2 and S3 are infrastructure as a service, services such as Elastic Beanstalk, Lambda and RDS sit closer to platform as a service, and AWS also sells some software as a service products. Public or private describes the deployment model, which is a separate question from the service model.
Is AWS GovCloud a private cloud?
No. AWS GovCloud (US) is two isolated AWS Regions, operated by US citizens, for government agencies and regulated customers with sensitive data. Access is restricted, but it is still AWS-run cloud infrastructure shared by eligible customers, so it is closer to a community cloud than a private one.
Is a private cloud more secure than AWS?
Not automatically. A private cloud gives you full control, and also full responsibility for physical security, patching and staffing. AWS handles the lower layers for you. Security outcomes depend mostly on configuration, access control and monitoring, whichever model you choose.
Can I keep data in Sweden or the EU on AWS?
Yes. You choose the Region where each resource runs, such as Europe (Stockholm). AWS commits not to move or replicate your content outside your chosen Regions without your agreement, except where needed to provide a service you started or to comply with the law. Check global services such as IAM or CloudFront separately.
Read more: what is a public cloud and what is a private cloud.
Related reading
Related Guides
Written By
Country Manager, Sweden
Johan leads Opsio's Sweden operations, driving AI adoption, DevOps transformation, security strategy, and cloud solutioning for Nordic enterprises. With 12+ years in enterprise cloud infrastructure, he has delivered 200+ projects across AWS, Azure, and GCP — specialising in Well-Architected reviews, landing zone design, and multi-cloud strategy.
Editorial standards: This article was written by the cloud practitioner named in the byline above. We revise it when the technology or regulation it covers changes; the dates on this page show the latest update. Opsio maintains editorial independence.