AWS VPC Design Patterns: Building Secure and Scalable Network Architectures

Amazon Virtual Private Cloud (VPC) is the foundation of your AWS infrastructure. A well-designed VPC architecture ensures security, scalability, and cost-effectiveness. In this guide, I'll share proven VPC design patterns used in production environments.

VPC Design Principles

Core Concepts

Isolation: Separate environments (dev, staging, prod) into different VPCs
Security: Defense in depth with multiple security layers
Scalability: Plan CIDR blocks for future growth
High Availability: Multi-AZ deployment for fault tolerance
Cost Optimization: Strategic NAT Gateway placement
Connectivity: Efficient inter-VPC and on-premises communication

Multi-Tier VPC Architecture

Three-Tier Network Design

┌─────────────────────────────────────────────────────────────┐
│                         VPC (10.0.0.0/16)                   │
├─────────────────────────────────────────────────────────────┤
│  Public Subnet (10.0.1.0/24)    │  Public Subnet (10.0.2.0/24)  │
│  - NAT Gateway                   │  - NAT Gateway                 │
│  - Application Load Balancer     │  - Application Load Balancer   │
│  - Bastion Host                  │  - Bastion Host                │
│  AZ: us-east-1a                  │  AZ: us-east-1b                │
├──────────────────────────────────┼────────────────────────────────┤
│  Private Subnet (10.0.11.0/24)  │  Private Subnet (10.0.12.0/24) │
│  - Application Servers           │  - Application Servers          │
│  - ECS/EKS Nodes                 │  - ECS/EKS Nodes                │
│  AZ: us-east-1a                  │  AZ: us-east-1b                │
├──────────────────────────────────┼────────────────────────────────┤
│  Database Subnet (10.0.21.0/24) │  Database Subnet (10.0.22.0/24)│
│  - RDS Primary                   │  - RDS Standby                  │
│  - ElastiCache                   │  - ElastiCache                  │
│  AZ: us-east-1a                  │  AZ: us-east-1b                │
└──────────────────────────────────┴────────────────────────────────┘

CloudFormation Implementation

AWSTemplateFormatVersion: '2010-09-09'
Description: Production-ready Multi-Tier VPC

Parameters:
  EnvironmentName:
    Type: String
    Default: production
    AllowedValues: [development, staging, production]
  
  VpcCIDR:
    Type: String
    Default: 10.0.0.0/16
    Description: CIDR block for VPC

Resources:
  # VPC
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-vpc
        - Key: Environment
          Value: !Ref EnvironmentName

  # Internet Gateway
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-igw

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC

  # Public Subnets
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-public-subnet-1
        - Key: Type
          Value: Public

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: 10.0.2.0/24
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-public-subnet-2
        - Key: Type
          Value: Public

  # Private Application Subnets
  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: 10.0.11.0/24
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-private-app-subnet-1
        - Key: Type
          Value: Private
        - Key: Tier
          Value: Application

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: 10.0.12.0/24
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-private-app-subnet-2
        - Key: Type
          Value: Private
        - Key: Tier
          Value: Application

  # Private Database Subnets
  DatabaseSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: 10.0.21.0/24
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-private-db-subnet-1
        - Key: Type
          Value: Private
        - Key: Tier
          Value: Database

  DatabaseSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: 10.0.22.0/24
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-private-db-subnet-2
        - Key: Type
          Value: Private
        - Key: Tier
          Value: Database

  # NAT Gateways
  NatGateway1EIP:
    Type: AWS::EC2::EIP
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-nat-eip-1

  NatGateway2EIP:
    Type: AWS::EC2::EIP
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-nat-eip-2

  NatGateway1:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGateway1EIP.AllocationId
      SubnetId: !Ref PublicSubnet1
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-nat-1

  NatGateway2:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGateway2EIP.AllocationId
      SubnetId: !Ref PublicSubnet2
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-nat-2

  # Route Tables
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-public-routes

  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet1

  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet2

  # Private Route Tables
  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-private-routes-1

  DefaultPrivateRoute1:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway1

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref PrivateSubnet1

  DatabaseSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref DatabaseSubnet1

  PrivateRouteTable2:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-private-routes-2

  DefaultPrivateRoute2:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway2

  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      SubnetId: !Ref PrivateSubnet2

  DatabaseSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      SubnetId: !Ref DatabaseSubnet2

Security Groups Architecture

Layered Security Groups

# Application Load Balancer Security Group
ALBSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupName: !Sub ${EnvironmentName}-alb-sg
    GroupDescription: Security group for Application Load Balancer
    VpcId: !Ref VPC
    SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: 0.0.0.0/0
        Description: HTTPS from internet
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0
        Description: HTTP from internet (redirect to HTTPS)
    SecurityGroupEgress:
      - IpProtocol: -1
        CidrIp: 0.0.0.0/0
    Tags:
      - Key: Name
        Value: !Sub ${EnvironmentName}-alb-sg

# Application Server Security Group
AppSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupName: !Sub ${EnvironmentName}-app-sg
    GroupDescription: Security group for application servers
    VpcId: !Ref VPC
    SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 8080
        ToPort: 8080
        SourceSecurityGroupId: !Ref ALBSecurityGroup
        Description: HTTP from ALB
      - IpProtocol: tcp
        FromPort: 22
        ToPort: 22
        SourceSecurityGroupId: !Ref BastionSecurityGroup
        Description: SSH from bastion
    Tags:
      - Key: Name
        Value: !Sub ${EnvironmentName}-app-sg

# Database Security Group
DatabaseSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupName: !Sub ${EnvironmentName}-db-sg
    GroupDescription: Security group for database
    VpcId: !Ref VPC
    SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 5432
        ToPort: 5432
        SourceSecurityGroupId: !Ref AppSecurityGroup
        Description: PostgreSQL from application servers
    Tags:
      - Key: Name
        Value: !Sub ${EnvironmentName}-db-sg

# Bastion Host Security Group
BastionSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupName: !Sub ${EnvironmentName}-bastion-sg
    GroupDescription: Security group for bastion host
    VpcId: !Ref VPC
    SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 22
        ToPort: 22
        CidrIp: 203.0.113.0/24  # Your office IP range
        Description: SSH from office
    Tags:
      - Key: Name
        Value: !Sub ${EnvironmentName}-bastion-sg

VPC Endpoints for AWS Services

Gateway Endpoints

# S3 VPC Endpoint
S3VPCEndpoint:
  Type: AWS::EC2::VPCEndpoint
  Properties:
    VpcId: !Ref VPC
    ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
    RouteTableIds:
      - !Ref PrivateRouteTable1
      - !Ref PrivateRouteTable2
    PolicyDocument:
      Version: 2012-10-17
      Statement:
        - Effect: Allow
          Principal: '*'
          Action:
            - s3:GetObject
            - s3:PutObject
            - s3:ListBucket
          Resource:
            - !Sub arn:aws:s3:::${DataBucket}/*
            - !Sub arn:aws:s3:::${DataBucket}

# DynamoDB VPC Endpoint
DynamoDBVPCEndpoint:
  Type: AWS::EC2::VPCEndpoint
  Properties:
    VpcId: !Ref VPC
    ServiceName: !Sub com.amazonaws.${AWS::Region}.dynamodb
    RouteTableIds:
      - !Ref PrivateRouteTable1
      - !Ref PrivateRouteTable2

Interface Endpoints

# ECR API Endpoint
ECRAPIEndpoint:
  Type: AWS::EC2::VPCEndpoint
  Properties:
    VpcId: !Ref VPC
    ServiceName: !Sub com.amazonaws.${AWS::Region}.ecr.api
    VpcEndpointType: Interface
    PrivateDnsEnabled: true
    SubnetIds:
      - !Ref PrivateSubnet1
      - !Ref PrivateSubnet2
    SecurityGroupIds:
      - !Ref VPCEndpointSecurityGroup

# ECR Docker Endpoint
ECRDockerEndpoint:
  Type: AWS::EC2::VPCEndpoint
  Properties:
    VpcId: !Ref VPC
    ServiceName: !Sub com.amazonaws.${AWS::Region}.ecr.dkr
    VpcEndpointType: Interface
    PrivateDnsEnabled: true
    SubnetIds:
      - !Ref PrivateSubnet1
      - !Ref PrivateSubnet2
    SecurityGroupIds:
      - !Ref VPCEndpointSecurityGroup

# CloudWatch Logs Endpoint
CloudWatchLogsEndpoint:
  Type: AWS::EC2::VPCEndpoint
  Properties:
    VpcId: !Ref VPC
    ServiceName: !Sub com.amazonaws.${AWS::Region}.logs
    VpcEndpointType: Interface
    PrivateDnsEnabled: true
    SubnetIds:
      - !Ref PrivateSubnet1
      - !Ref PrivateSubnet2
    SecurityGroupIds:
      - !Ref VPCEndpointSecurityGroup

# Secrets Manager Endpoint
SecretsManagerEndpoint:
  Type: AWS::EC2::VPCEndpoint
  Properties:
    VpcId: !Ref VPC
    ServiceName: !Sub com.amazonaws.${AWS::Region}.secretsmanager
    VpcEndpointType: Interface
    PrivateDnsEnabled: true
    SubnetIds:
      - !Ref PrivateSubnet1
      - !Ref PrivateSubnet2
    SecurityGroupIds:
      - !Ref VPCEndpointSecurityGroup

VPCEndpointSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupName: !Sub ${EnvironmentName}-vpc-endpoint-sg
    GroupDescription: Security group for VPC endpoints
    VpcId: !Ref VPC
    SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: !Ref VpcCIDR
        Description: HTTPS from VPC

VPC Flow Logs

Comprehensive Logging

VPCFlowLogRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Version: 2012-10-17
      Statement:
        - Effect: Allow
          Principal:
            Service: vpc-flow-logs.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: CloudWatchLogPolicy
        PolicyDocument:
          Version: 2012-10-17
          Statement:
            - Effect: Allow
              Action:
                - logs:CreateLogGroup
                - logs:CreateLogStream
                - logs:PutLogEvents
                - logs:DescribeLogGroups
                - logs:DescribeLogStreams
              Resource: '*'

VPCFlowLogGroup:
  Type: AWS::Logs::LogGroup
  Properties:
    LogGroupName: !Sub /aws/vpc/${EnvironmentName}
    RetentionInDays: 30

VPCFlowLog:
  Type: AWS::EC2::FlowLog
  Properties:
    ResourceType: VPC
    ResourceId: !Ref VPC
    TrafficType: ALL
    LogDestinationType: cloud-watch-logs
    LogGroupName: !Ref VPCFlowLogGroup
    DeliverLogsPermissionArn: !GetAtt VPCFlowLogRole.Arn
    LogFormat: '${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}'
    Tags:
      - Key: Name
        Value: !Sub ${EnvironmentName}-vpc-flow-log

Network ACLs

Defense in Depth

PublicNetworkAcl:
  Type: AWS::EC2::NetworkAcl
  Properties:
    VpcId: !Ref VPC
    Tags:
      - Key: Name
        Value: !Sub ${EnvironmentName}-public-nacl

# Allow inbound HTTPS
PublicNetworkAclEntryInboundHTTPS:
  Type: AWS::EC2::NetworkAclEntry
  Properties:
    NetworkAclId: !Ref PublicNetworkAcl
    RuleNumber: 100
    Protocol: 6
    RuleAction: allow
    CidrBlock: 0.0.0.0/0
    PortRange:
      From: 443
      To: 443

# Allow inbound HTTP
PublicNetworkAclEntryInboundHTTP:
  Type: AWS::EC2::NetworkAclEntry
  Properties:
    NetworkAclId: !Ref PublicNetworkAcl
    RuleNumber: 110
    Protocol: 6
    RuleAction: allow
    CidrBlock: 0.0.0.0/0
    PortRange:
      From: 80
      To: 80

# Allow ephemeral ports
PublicNetworkAclEntryInboundEphemeral:
  Type: AWS::EC2::NetworkAclEntry
  Properties:
    NetworkAclId: !Ref PublicNetworkAcl
    RuleNumber: 120
    Protocol: 6
    RuleAction: allow
    CidrBlock: 0.0.0.0/0
    PortRange:
      From: 1024
      To: 65535

# Allow all outbound
PublicNetworkAclEntryOutbound:
  Type: AWS::EC2::NetworkAclEntry
  Properties:
    NetworkAclId: !Ref PublicNetworkAcl
    RuleNumber: 100
    Protocol: -1
    Egress: true
    RuleAction: allow
    CidrBlock: 0.0.0.0/0

Cost Optimization: Single NAT Gateway Pattern

Development/Staging Environment

# Single NAT Gateway for cost savings
SingleNATGatewayEIP:
  Type: AWS::EC2::EIP
  Properties:
    Domain: vpc

SingleNATGateway:
  Type: AWS::EC2::NatGateway
  Properties:
    AllocationId: !GetAtt SingleNATGatewayEIP.AllocationId
    SubnetId: !Ref PublicSubnet1

# Both private subnets use same NAT Gateway
PrivateRouteTable1:
  Type: AWS::EC2::RouteTable
  Properties:
    VpcId: !Ref VPC

PrivateRoute1:
  Type: AWS::EC2::Route
  Properties:
    RouteTableId: !Ref PrivateRouteTable1
    DestinationCidrBlock: 0.0.0.0/0
    NatGatewayId: !Ref SingleNATGateway

PrivateRouteTable2:
  Type: AWS::EC2::RouteTable
  Properties:
    VpcId: !Ref VPC

PrivateRoute2:
  Type: AWS::EC2::Route
  Properties:
    RouteTableId: !Ref PrivateRouteTable2
    DestinationCidrBlock: 0.0.0.0/0
    NatGatewayId: !Ref SingleNATGateway  # Same NAT Gateway

Key Takeaways

Plan CIDR Blocks: Leave room for growth, avoid overlapping ranges
Multi-AZ Everything: Deploy across at least 2 availability zones
Layered Security: Use Security Groups + NACLs + VPC Flow Logs
VPC Endpoints: Reduce NAT Gateway costs for AWS service traffic
Cost vs. Availability: Balance NAT Gateway costs with HA requirements
Network Segmentation: Separate tiers (public, app, database)
Monitoring: Enable VPC Flow Logs for troubleshooting and security

Conclusion

A well-architected VPC is the foundation of secure, scalable AWS infrastructure. Start with these proven patterns and adapt them to your specific requirements. Remember: security and high availability should never be afterthoughts.

Building cloud infrastructure? Check out my Terraform posts for infrastructure as code best practices!

AWS VPC Design Patterns: Building Secure and Scalable Network Architectures

AWS VPC Design Patterns: Building Secure and Scalable Network Architectures

VPC Design Principles

Core Concepts

Multi-Tier VPC Architecture

Three-Tier Network Design

CloudFormation Implementation

Security Groups Architecture

Layered Security Groups

VPC Endpoints for AWS Services

Gateway Endpoints

Interface Endpoints

VPC Flow Logs

Comprehensive Logging

Network ACLs

Defense in Depth

Cost Optimization: Single NAT Gateway Pattern

Development/Staging Environment

Key Takeaways

Conclusion

Share this insight