Cloud Networking Design (Verbose)

Core Patterns

VPC and Subnet Topology

A VPC is a private IP space you own inside a region. Everything else — routing, isolation, egress control — is built from how you subdivide it. Two rules pay off for years: choose a CIDR big enough that you never renumber, and never let two networks you might one day connect share an address range.

VPC 10.20.0.0/16                         (one per region per account)

  AZ-a                        AZ-b                        AZ-c
  public  10.20.0.0/20        public  10.20.16.0/20       public  10.20.32.0/20
  private 10.20.64.0/20       private 10.20.80.0/20       private 10.20.96.0/20
  data    10.20.128.0/20      data    10.20.144.0/20      data    10.20.160.0/20

Three subnet tiers, spread across the AZs the region offers:

• public — a route to the internet gateway. Load balancers and, if you must, bastions. Nothing stateful.
• private — application/compute. Egress via NAT; no inbound from the internet.
• data — databases, caches. No internet route at all, reached only from the private tier via security-group references.

Availability zones are the failure domain. Spreading subnets across AZs is what lets a load balancer survive a zone outage — but see the cost pattern below, because that same spread is where inter-AZ charges accrue.

Routing and Egress

"Public" and "private" are not attributes of a subnet; they are consequences of its route table.

public route table                 private route table
  10.20.0.0/16 -> local              10.20.0.0/16 -> local
  0.0.0.0/0    -> igw                0.0.0.0/0    -> nat-gw
                                     s3-prefix    -> vpce (gateway endpoint)

A NAT gateway lets private instances reach out (package installs, third-party APIs) while blocking all unsolicited inbound. It is also metered on both throughput and hours, which makes it a quiet cost center. Route provider-managed services (object storage, etc.) through a VPC endpoint so that traffic bypasses the NAT path entirely.

Security Groups vs NACLs

Two mechanisms, deliberately different, and best used together.

	Security group	Network ACL
State	Stateful (return traffic auto-allowed)	Stateless (open both directions)
Scope	ENI / instance	Whole subnet
Rules	Allow only	Allow and deny
Ordering	All rules evaluated	Numbered, first match wins

Security groups are the workhorse. Reference other groups instead of IP ranges so the policy tracks the topology, not addresses:

lb-sg:    inbound 443 from 0.0.0.0/0
app-sg:   inbound 8080 from lb-sg          # only the LB may reach the app
data-sg:  inbound 5432 from app-sg         # only the app may reach the DB

Reserve NACLs for coarse, subnet-wide statements — "this data subnet never talks to the internet" — where a deny rule adds a guardrail a security group cannot express. Do not try to run fine-grained policy in NACLs; the stateless return-port bookkeeping will bite you.

Connecting Networks

Non-transitivity is the concept people rediscover painfully. If A peers with B and B peers with C, A still cannot reach C. Peering is a point-to-point relationship, and n VPCs fully meshed need n(n-1)/2 connections.

Pattern	When it fits	Watch for
VPC peering	2–3 VPCs, stable relationships	Non-transitive; mesh explodes
Transit gateway / Cloud Router	Hub-and-spoke across many VPCs/accounts	Central chokepoint; per-attachment + data cost
PrivateLink / PSC	Expose or consume one service privately	One service per endpoint, unidirectional
Site-to-site VPN / Direct Connect	On-prem hybrid	VPN over internet vs dedicated circuit trade-off

Move to a transit gateway before the peering mesh grows past a handful of VPCs. PrivateLink is not a network join — it publishes a single service endpoint into a consumer VPC, so the consumer reaches exactly that service and nothing else, with no CIDR coordination required. That property makes it the clean answer for overlapping-CIDR situations peering cannot solve.

Private Access to Managed Services

Every hop to a managed service over a public endpoint is a hop over the internet (or through NAT) that you are paying for and exposing. Two private paths:

• Gateway endpoint — a route-table entry for storage-class services. No ENI, typically no hourly charge, keeps that traffic on the backbone.
• Interface endpoint / PSC — an ENI with a private IP in your subnet fronting the service. Hourly + data cost, but private and DNS-integrated.

The payoff is threefold: data never traverses the public internet, you drop the NAT hop, and you usually avoid the egress charge that the public path would incur.

The Cross-AZ and Egress Cost Trap

This is the pattern that surprises teams at scale. Three costs compound:

1. Inter-AZ traffic is billed, generally in both directions, even inside one VPC. A service whose replicas gossip across three AZs pays per hop.
2. NAT gateway charges per hour and per gigabyte processed.
3. Internet egress dwarfs everything else — data leaving the cloud is the expensive direction; inbound is usually free.

The tension is real: spreading across AZs buys availability, and concentrating in one AZ buys cheapness and latency. Resolve it deliberately. Keep high-volume, latency-sensitive chatter (cache reads, replica sync) zone-local with topology-aware routing, while still placing enough capacity in each AZ to survive losing one. See cloud-cost-optimization for turning these into budgets and alerts, and cloud-provider-tradeoffs for how the billing shapes differ.

Common Anti-Patterns

❌ Overlapping CIDR ranges across VPCs or with on-prem. Peering and VPN both refuse to route between overlapping ranges, and you cannot fix it without renumbering a live network. ✅ Allocate non-overlapping blocks from a central plan (an IPAM) up front.

❌ Databases in public subnets "behind a security group". One misordered rule and the data tier is internet-reachable. ✅ Data tier in subnets with no internet route at all; reach it only from the app tier via group references.

❌ Security groups written with 0.0.0.0/0 or wide CIDRs internally. The policy no longer reflects who actually talks to whom. ✅ Reference source security groups by id, so rules track topology.

❌ A full mesh of peering connections. It grows quadratically and becomes unauditable. ✅ Hub-and-spoke through a transit gateway once past a few VPCs.

❌ Routing managed-service and inter-service traffic over public endpoints/NAT. You pay egress and NAT for traffic that could stay on the backbone. ✅ Private endpoints for managed services; keep intra-cloud traffic private.

❌ Ignoring which AZ traffic lands in. Chatty cross-AZ paths bill silently. ✅ Make placement and routing topology-aware; measure inter-AZ bytes.

Network Design Checklist

• VPC CIDRs allocated from a non-overlapping, room-to-grow plan
• Three-tier subnets (public / private / data) across multiple AZs
• Only load balancers and bastions have an internet-gateway route
• Stateful and application workloads sit in private/data subnets
• Security groups reference source groups, not IP ranges, internally
• NACLs used only for coarse, subnet-wide guardrails
• Peering vs transit gateway chosen by VPC count; non-transitivity understood
• Managed services reached via VPC/interface endpoints, not the internet
• Inter-AZ, NAT, and egress traffic measured and budgeted
• Latency-sensitive high-volume traffic kept zone-local where safe
• Hybrid links (VPN vs dedicated) chosen against throughput/latency needs