The cloud is still networking
A VPC (AWS) or VNet (Azure) is your own private network in the cloud - you pick an address range and carve it into subnets, exactly like on-prem. Route tables decide where subnet traffic goes; the same IP, subnet and routing rules you already know still apply. The names change; the fundamentals don't.
Public vs private subnets
A public subnet has a route to an internet gateway, so its resources can be reached from and reach the internet. A private subnet has no such route - perfect for databases. To let private resources reach out (for updates) without being reachable inbound, you use a NAT gateway: outbound-only, just like NAT/PAT on-prem.
Security groups and NSGs
Instead of a central firewall, cloud uses per-resource stateful rules: security groups (AWS) or NSGs (Azure). You allow only the ports each tier needs - web tier 443 from anywhere, app tier only from the web tier, database only from the app tier. Least privilege, enforced close to the resource.
Hybrid connectivity and private access
Connect on-prem to cloud with a site-to-site VPN (encrypted over the internet) or a dedicated link (AWS Direct Connect / Azure ExpressRoute) for consistent performance. Private endpoints / PrivateLink let you reach a managed service over the private network instead of the public internet - and a common failure is DNS still resolving the service to its public IP because the private DNS zone isn't linked.