Ankush Panday

Enterprise Cloud & Container Platforms

Rabobank • Amazon EKS, ECS & GitOps

Architected a mission-critical fraud detection platform on EKS and led the migration of legacy apps to ECS. Implemented GitOps with ArgoCD, achieving sub-second latency and automated security compliance.

AWS Infrastructure Migration

WCC Group • Terraform & ECS Fargate

Led the end-to-end migration of 40+ on-prem workloads to AWS using Application Migration Service (MGN). Re-architected legacy systems for ECS Fargate, migrated a distributed Jenkins cluster, and established secure hybrid connectivity via AWS Client VPN.

Jaypee University of Information Technology

Why Do We Need a VPC?

Think of a VPC as your own private data center in the cloud. Without it, your resources would be floating in a shared space. A VPC gives you isolation, security, and complete control over your virtual networking environment, including your own IP address range, subnets, and route tables.

IP Addressing & The "Rule of 5"

Every VPC has a primary IPv4 CIDR block. As seen in our architecture diagram above, we are using the 10.0.0.0/16 network address block, which supports 65,536 IP addresses.

The Foundational Components

• Subnets: These are segments of your VPC's IP range. You use them to group resources based on security or operational needs.
• Availability Zones (AZs): Always spread your subnets across multiple AZs. If one data center goes down, your application stays alive in another. This is the "High Availability" gold standard.
• Route Tables: These contain a set of rules (routes) that determine where network traffic from your subnet or gateway is directed.

Public vs. Private Subnets: The "Internet Gateway" Rule

How do you know if a subnet is public or private? It's all in the Route Table:

• Public Subnet: Its route table has a path to an Internet Gateway (IGW). Resources here (like Load Balancers) can be reached from the outside world.
• Private Subnet: It has no direct route to the IGW. Resources here (like Databases) are shielded from the internet. They can only reach the internet via a NAT Gateway in a public subnet.

Two Layers of Firewalls

AWS provides a "belt and suspenders" approach to security:

• Security Groups (Stateful): They act at the Instance level. If you allow traffic in, the return traffic is automatically allowed. Think of them as your server's personal bodyguard.
• Network ACLs (Stateless): They act at the Subnet level. You must explicitly allow both inbound and outbound traffic. They are like bouncers at the front door of the whole building.

Advanced Connectivity & Scaling

• ENIs (Elastic Network Interfaces): Virtual network cards you can move between instances. Essential for licensing, high-availability clusters, or management networks.
• VPC Peering: A direct connection between two VPCs. Great for simple 1-to-1 connections.
• Transit Gateway (TGW): As you grow to hundreds of VPCs, peering becomes a nightmare. TGW acts as a central hub, connecting all your VPCs and on-premises networks in a hub-and-spoke model.
• VPC Endpoints (PrivateLink): Ever wanted to talk to S3 or DynamoDB without your traffic ever leaving the AWS private network? Endpoints allow you to reach AWS services privately, bypassing the public internet entirely.

Taking the Network to the Next Level

Once you've mastered the basics of subnets and firewalls, enterprise-scale cloud architecture demands more complex connectivity patterns. In this post, we explore how to scale, connect, and optimize VPCs for global workloads.

1. VPC Peering: The Private Highway

VPC Peering is a direct network connection between two VPCs that allows you to route traffic between them using private IP addresses.

• Cross-Region Peering: You can peer VPCs across different AWS regions. Your data stays on the AWS global backbone, never touching the public internet.
• The "Transitive" Trap: VPC Peering is not transitive. If VPC A is peered with VPC B, and VPC B is peered with VPC C, VPC A cannot talk to VPC C through VPC B. You would need a separate peering connection between A and C.
• Overlapping CIDRs: You cannot peer VPCs if their IP ranges overlap. This is the #1 reason to plan your IP space carefully!

2. Transit Gateway: The Central Hub

As your organization grows to dozens or hundreds of VPCs, managing thousands of peering connections (a "full mesh") becomes impossible. AWS Transit Gateway (TGW) acts as a central hub-and-spoke router.

• Connect thousands of VPCs and on-premises networks to a single gateway.
• Supports Transitive Routing: VPC A can talk to VPC C via the Transit Gateway.
• Simplifies management with a single point of control for network security and routing.

3. Hybrid Connectivity: VPN vs. Direct Connect

How do you connect your office or data center to the cloud?

• Site-to-Site VPN: Quick to deploy, uses the public internet (encrypted). Good for dev/test or small workloads.
• AWS Direct Connect (DX): A dedicated physical line from your data center to AWS. Provides consistent performance, higher bandwidth, and lower latency. Critical for production enterprise workloads.

4. PrivateLink & VPC Endpoints

Connecting to AWS services or 3rd-party SaaS applications without exposing your traffic to the internet:

• Gateway Endpoints: Free endpoints for S3 and DynamoDB. They live in your route table.
• Interface Endpoints (PrivateLink): Uses an ENI with a private IP in your subnet. This is how you reach services like Kinesis, EC2 APIs, or even your own custom services across different accounts/VPCs privately.

5. Global Acceleration

AWS Global Accelerator uses the AWS global network to route your users' traffic. It provides two static anycast IP addresses that act as a fixed entry point to your application. This can improve performance by up to 60% by avoiding internet congestion.

One of the most misunderstood areas in AWS networking is knowing when to use a NAT Gateway, PrivateLink, or VPC Endpoint. Engineers often default to NAT Gateway for everything—and then get a nasty AWS bill at the end of the month.

The "Point of No Return" for network complexity. Learn when to migrate from Mesh Peering to a Hub-and-Spoke Transit Gateway architecture, and how to manage the costs of scale.

The final piece of the networking foundation. Master Route 53 Private Hosted Zones, Resolver Endpoints, and hybrid cloud DNS architectures for true resilience.

Every enterprise AWS journey eventually reaches the hybrid connectivity question: how do your on-premises systems, data centers, and remote workers securely connect to your AWS infrastructure?

Mastering AWS network security: A deep dive into Network Firewall, Security Groups, and NACLs. Learn the DevSecOps approach to layered defense.

Building secure, cost-optimised infrastructure. A masterclass on OIDC, Permissions Boundaries, and Zero-Trust identity.

The defense-in-depth model. Learn how to orchestrate GuardDuty for threat intelligence, Security Hub for compliance posture, and WAF for edge protection.