Overview
Architecture, standardization and evolution of the AWS networking layer used as the foundation for applications, Kubernetes and platform integrations in a multi-account environment.
Context
Networking was the foundational layer of the entire SaaS platform. With +20 AWS accounts and multiple EKS clusters, the network needed to support public and private services, cross-account connectivity, platform integrations and predictable growth — all while optimizing NAT and data transfer costs.
Challenge
Reduce direct exposure, control traffic paths and maintain high availability while considering operational costs of NAT Gateway, data transfer and endpoints. Every networking decision simultaneously impacted security, performance, cost and troubleshooting capacity.
My role
- VPC, public and private subnet, routing table and segmentation architecture
- Public connectivity via Internet Gateway and private connectivity via VPC Endpoints and NAT Gateway
- Egress-Only Internet Gateway for controlled outbound IPv6 traffic
- Security groups, load balancing and cross-component, cross-account connectivity
- DNS, name resolution and managed AWS service integration
- Troubleshooting, traffic analysis and network cost optimization
- Network infrastructure as code with Terraform
Architecture
The design separated public and private layers, routing traffic through controlled entry points and using private connectivity (VPC Endpoints) to AWS services when appropriate. Subnet segmentation complemented by security groups created multiple control layers. Cross-account and cross-region routing standardized for predictability.
Technical decisions
- Clear separation between publicly exposed components and private services
- Explicit route and traffic path control with segmented routing tables
- VPC Endpoints to reduce NAT traffic and optimize costs
- High availability considered from initial design — multi-AZ as standard
- Security, performance and data transfer cost evaluated together
Security & governance
Reduced direct exposure and the combination of subnet segmentation, routes and security groups applied defense in depth. Internal services were not publicly accessible; outbound traffic controlled via NAT Gateway and Egress-Only Internet Gateway; cross-account connectivity followed defined and auditable patterns.
Automation
All network infrastructure was represented as Terraform code, enabling cross-account standardization, pre-application change review and reproducibility. CI/CD pipelines applied network configurations with the same governance flow as other platform layers.
Engineering challenges
Cloud networking extends traditional network fundamentals with managed services, automation and data-flow pricing models. Understanding how NAT Gateway, data transfer and VPC Endpoints impact operational cost was an essential part of architectural decision-making, not a retrospective financial concern.
Results
- Predictable network topology prepared for account and workload growth
- Improved cross-component connectivity troubleshooting capacity
- Networking decisions informed by security, performance and cost simultaneously
- Network infrastructure versioned and standardized across multiple accounts