I've been studying subnetting and of course there's plenty I'm confused about. One issue is as follows: my company uses AWS. For our VPC let's say we have a private network address of 10.2.0.0 /16 CIDR. My question is this: I have a feeling that they can offer this private address to other companies as well. How is this possible? I realize I'm confused about something deeper, but then again, that's precisely why I'm asking this question. Thanks!
It's exactly the same way that any company can use, and reuse, the same private addresses. The private addresses don't get routed where they can conflict with each other.
I my company uses private addresses internally, and your company uses the same private addresses internally, there is no conflict since our two companies can only communicate through a different network, and the same private addresses in each company get translated to different addresses before reaching the other company.
A single company can do the same thing internally. NAT is not just to connect to the Internet, it can be used inside a company, too.
I don't know exactly how amazon does it but I can easilly see a few ways to engineer this.
The key thing to remember is that IP addresses only matter to IP routers and endpoints. An ethernet switch with VLANSs doesn't care if VLAN1 and VLAN2 have overlapping IP ranges, all it cares about is which vlan the packet is on and which MAC address it is flowing between. So if each companies virtual private cloud has it's own VLANs and it's own routers connecting those VLANs then it's not a problem for those virtual clouds to have overlapping IP space.
I belive some big router vendors have routers that can be partitioned into multiple logically independent routers but I can't seem to find a good source right now. Linux can do the same thing through the use of "network namespaces".
Or of course you could just use software routers (either the built in routing facilities in major operating systems or something from a router vendor) and run them inside VMs.
Or you could even have no routers on the cloud side at all and just have the cloud network tunneled back to your own network.
The real way this is done in Amazon is different from how you might imagine, as common solutions don't scale. They did a talk in 2013 about this at re:Invent, which you can watch on YouTube:
However, the more general answer is "IP addressing is a matter of perspective." More specifically, if your hosts never want to talk to the hosts of someone else who was allocated the same IP space, no one cares that you have the same IP addresses. If you do, and you want to talk to each other, then through the use of some mechanism like NAT, you will change the IP addresses of the the hosts in network A from the perspective of network B.