VPC Design
How virtual networks, subnets and connectivity are structured — decisions that are cheap now and extremely expensive to change later.
Definition
A virtual private cloud is an isolated network within a provider. Its design decides address space, segmentation, internet reachability, connectivity to other networks, and where the security boundaries sit.
The decisions that are hard to reverse
Address space allocation. Choose CIDR ranges that do not overlap with anything you might ever peer with — other VPCs, the corporate network, an acquired company's network, a partner. Overlapping ranges cannot be peered, and the remedy is re-addressing a live environment, which is among the least pleasant projects in infrastructure.
Size generously. Address space costs nothing and running out is painful, particularly with container platforms where every pod consumes an address. A subnet sized for VM-era density exhausts silently and presents as pods stuck pending.
Segmentation. Public subnets for load balancers, private for applications, isolated for data stores, with routing that makes the intended flows the only possible ones.
Environment isolation. Separate VPCs, ideally in separate accounts, for production and non-production. Shared networks between environments are how a test job takes down production.
Connectivity topology. Point-to-point peering does not scale — it is O(n²) relationships, and peering is not transitive. A hub-and-spoke or transit arrangement is the answer above a handful of VPCs, and adopting it before you need it is a common form of over-engineering.
The general principle
Blast radius. Every boundary is a decision about what fails together, what an attacker reaches after one compromise, and what a misconfiguration affects. Account boundaries are stronger than VPC boundaries, which are stronger than subnet boundaries, which are stronger than security groups.
Failure scenarios
- Overlapping CIDR ranges discovered during a merger or a partner integration.
- Subnets too small, exhausting addresses as pod density grows.
- A flat network where everything can reach everything, so one compromise is total.
- Shared production and non-production networks.
- Full-mesh peering grown past the point of comprehensibility, with nobody able to state what can reach what.
Trade-offs
Strong segmentation buys containment and auditability, and costs operational friction — more routes, more rules, more places for a legitimate flow to be blocked. The failure mode at the strict end is a team that opens broad rules to get work done, which is worse than a moderate design consistently applied.
Interview question
"Two companies merge and both use 10.0.0.0/16 for production. What are your options?"