You are designing the network for a platform expected to run for a decade, spanning multiple regions, with acquisitions likely. What do you decide on day one and why?

The decision that cannot be undone

The address space allocation. It is chosen on day one, usually by whoever creates the first VPC, and it constrains the next decade.

Two failure modes, both expensive:

Too small. A /24 seems generous until a Kubernetes CNI assigns an address per pod rather than per node. A VPC CIDR cannot be meaningfully expanded in place — the remedy is a new VPC and a migration of everything in it.

Overlapping. Two networks with the same range cannot be peered or joined by VPN. An acquisition, a partner integration, or merging two teams' environments then requires renumbering one side, which means touching every allow-list, firewall rule and hard-coded address.

Given acquisitions are expected, overlap is the greater risk.

What to do

Allocate from a central register, one authoritative record for the whole organisation, including on-premises networks.

Reserve generously and leave gaps. Private address space is free. A /16 per region per environment with unallocated space between allocations costs nothing and preserves the ability to grow contiguously.

Check against the corporate network and likely acquisition targets. 10.0.0.0/16 and 192.168.1.0/24 are the ranges everyone else also chose — avoid them deliberately.

Plan for pod-per-address networking even if not using it yet.

Connectivity topology

Hub-and-spoke via a transit gateway, not a mesh of peerings.

Peering is non-transitive: A↔B and B↔C does not give A↔C. Full connectivity between N VPCs needs N(N−1)/2 peerings — ten VPCs is 45 connections, each with route entries maintained on both sides. Adding one network means touching every other.

With a transit gateway each VPC attaches once and routing is centralised. Keep peering for a small number of stable, high-volume paths where the transit gateway's per-gigabyte charge would outweigh the convenience.

Subnet layer

One subnet per tier per zone (three tiers × three zones = nine), sized for the five-year worst case because subnets cannot be resized either. Public versus private is determined solely by whether the route table has a route to an internet gateway — so route tables must be per tier, never shared by accident.