Why architecture matters here
Cloud networking fails on CIDR overlaps (peering breaks), missing endpoints (data leaves the VPC), and security-group sprawl. Architecture matters because IPAM + policy + connectivity are joint concerns.
The architecture: every piece explained
The top strip is layout. VPC isolated network. Subnets AZ-local. Route tables direct traffic. Internet + NAT egress via IGW or NAT gateway.
The middle row is connectivity + policy. Peering + transit cross-VPC (transit gateway at scale). PrivateLink / endpoints for service access without internet. DNS zones for internal names. Security groups + NACL L3/L4 policy.
The lower rows are ops. Flow logs for audit. Observability. Ops — CIDR planning + IPAM + multi-region.
End-to-end flow
End-to-end: VPC A hosts app. Subnets across 3 AZs. Route table sends private subnets through NAT for egress. PrivateLink endpoint reaches S3 without internet. Security groups gate ports. Peering to VPC B with non-overlapping CIDR. Flow logs stream to central bucket.