Skip to main content

Network Architecture

The Multi-Region Shopping Mall network is designed based on a 3-tier VPC architecture. Each region has an independent VPC, and cross-region communication is handled through Transit Gateway Peering.

VPC Design​

CIDR Block Allocation​

RegionVPC CIDRPurpose
us-east-110.0.0.0/16Primary Region
us-west-210.1.0.0/16Secondary Region

us-east-1 Subnet Configuration​

TierAZ-aAZ-bAZ-cPurpose
Public10.0.1.0/2410.0.2.0/2410.0.3.0/24ALB, NAT Gateway
Private10.0.11.0/2410.0.12.0/2410.0.13.0/24EKS Worker Nodes
Data10.0.21.0/2410.0.22.0/2410.0.23.0/24Aurora, DocumentDB, ElastiCache, MSK, OpenSearch

us-west-2 Subnet Configuration​

TierAZ-aAZ-bAZ-cPurpose
Public10.1.1.0/2410.1.2.0/2410.1.3.0/24ALB, NAT Gateway
Private10.1.11.0/2410.1.12.0/2410.1.13.0/24EKS Worker Nodes
Data10.1.21.0/2410.1.22.0/2410.1.23.0/24Aurora, DocumentDB, ElastiCache, MSK, OpenSearch

3-Tier Architecture​

Role by Tier​

TierComponentsInternet AccessInbound Traffic
PublicALB, NAT GatewayDirectInternet → ALB
PrivateEKS Nodes, PodsVia NAT GatewayALB → EKS
DataAll data storesNoneEKS → Data stores

Transit Gateway Peering​

Transit Gateway Peering is used for cross-region communication.

Transit Gateway Route Tables​

us-east-1 TGW Route Table:

DestinationTargetPurpose
10.0.0.0/16VPC AttachmentLocal VPC
10.1.0.0/16Peering Attachmentus-west-2 VPC

us-west-2 TGW Route Table:

DestinationTargetPurpose
10.1.0.0/16VPC AttachmentLocal VPC
10.0.0.0/16Peering Attachmentus-east-1 VPC

Terraform Configuration​

# us-east-1 Transit Gateway
resource "aws_ec2_transit_gateway" "use1" {
  provider = aws.us-east-1

  description                     = "Multi-region TGW us-east-1"
  default_route_table_association = "enable"
  default_route_table_propagation = "enable"

  tags = {
    Name = "multi-region-tgw-use1"
  }
}

# us-west-2 Transit Gateway
resource "aws_ec2_transit_gateway" "usw2" {
  provider = aws.us-west-2

  description                     = "Multi-region TGW us-west-2"
  default_route_table_association = "enable"
  default_route_table_propagation = "enable"

  tags = {
    Name = "multi-region-tgw-usw2"
  }
}

# Transit Gateway Peering
resource "aws_ec2_transit_gateway_peering_attachment" "use1_usw2" {
  provider = aws.us-east-1

  peer_region             = "us-west-2"
  peer_transit_gateway_id = aws_ec2_transit_gateway.usw2.id
  transit_gateway_id      = aws_ec2_transit_gateway.use1.id

  tags = {
    Name = "tgw-peering-use1-usw2"
  }
}

Security Groups​

Security Group Configuration by Service​

Security Group Details​

ALB Security Group​

DirectionProtocolPortSource/DestinationPurpose
InboundTCP4430.0.0.0/0HTTPS traffic
InboundTCP800.0.0.0/0HTTP (redirect)
OutboundTCP8080EKS SGService forwarding

EKS Node Security Group​

DirectionProtocolPortSource/DestinationPurpose
InboundTCP8080ALB SGService traffic
InboundTCP443EKS Control PlaneAPI Server
InboundTCP10250EKS Control PlaneKubelet
InboundAllAllSelfPod-to-pod communication
OutboundTCP5432Aurora SGPostgreSQL
OutboundTCP27017DocumentDB SGMongoDB
OutboundTCP6379ElastiCache SGRedis/Valkey
OutboundTCP9096MSK SGKafka SASL
OutboundTCP443OpenSearch SGOpenSearch HTTPS
OutboundTCP4430.0.0.0/0AWS APIs, ECR

Aurora PostgreSQL Security Group​

DirectionProtocolPortSource/DestinationPurpose
InboundTCP5432EKS SGApplication access
InboundTCP543210.0.0.0/16Intra-region access
InboundTCP543210.1.0.0/16Cross-region replication

DocumentDB Security Group​

DirectionProtocolPortSource/DestinationPurpose
InboundTCP27017EKS SGApplication access
InboundTCP2701710.0.0.0/16Intra-region access
InboundTCP2701710.1.0.0/16Cross-region replication

ElastiCache Valkey Security Group​

DirectionProtocolPortSource/DestinationPurpose
InboundTCP6379EKS SGApplication access
InboundTCP6379SelfIntra-cluster communication

MSK Kafka Security Group​

DirectionProtocolPortSource/DestinationPurpose
InboundTCP9096EKS SGSASL/SCRAM authentication
InboundTCP9092EKS SGPlaintext (internal)
InboundTCP2181EKS SGZookeeper
InboundTCP909610.0.0.0/16Intra-region access
InboundTCP909610.1.0.0/16MSK Replicator

OpenSearch Security Group​

DirectionProtocolPortSource/DestinationPurpose
InboundTCP443EKS SGHTTPS API
InboundTCP9200EKS SGREST API
InboundTCP9300SelfInter-node communication

NAT Gateway​

Independent NAT Gateways are placed in each AZ for high availability.

NAT Gateway Pros and Cons​

ConfigurationAdvantagesDisadvantages
1 NAT per AZAZ failure isolation, no cross-AZ trafficIncreased cost (3x)
Single NATCost savingsSingle Point of Failure

Current configuration: 1 NAT Gateway per AZ (high availability priority)

VPC Endpoints​

VPC Endpoints are configured to allow Private subnets to access AWS services.

Endpoint Types​

EndpointTypeServicePurpose
S3Gatewaycom.amazonaws.region.s3Object storage
ECR APIInterfacecom.amazonaws.region.ecr.apiImage metadata
ECR DKRInterfacecom.amazonaws.region.ecr.dkrImage download
STSInterfacecom.amazonaws.region.stsIAM role assumption
CloudWatch LogsInterfacecom.amazonaws.region.logsLog delivery
Secrets ManagerInterfacecom.amazonaws.region.secretsmanagerSecret retrieval
KMSInterfacecom.amazonaws.region.kmsEncryption keys

Gateway vs Interface Endpoint​

CharacteristicGateway EndpointInterface Endpoint
CostFreeHourly + data processing
Supported ServicesS3, DynamoDB onlyMost AWS services
NetworkRoute table modificationENI creation (Private IP)
DNSUses public DNSPrivate DNS supported

Terraform Configuration​

# S3 Gateway Endpoint
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"

  route_table_ids = [
    aws_route_table.private_a.id,
    aws_route_table.private_b.id,
    aws_route_table.private_c.id,
  ]

  tags = {
    Name = "s3-gateway-endpoint"
  }
}

# ECR API Interface Endpoint
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true

  subnet_ids = [
    aws_subnet.private_a.id,
    aws_subnet.private_b.id,
    aws_subnet.private_c.id,
  ]

  security_group_ids = [aws_security_group.vpc_endpoints.id]

  tags = {
    Name = "ecr-api-endpoint"
  }
}

# Secrets Manager Interface Endpoint
resource "aws_vpc_endpoint" "secrets_manager" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.secretsmanager"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true

  subnet_ids = [
    aws_subnet.private_a.id,
    aws_subnet.private_b.id,
    aws_subnet.private_c.id,
  ]

  security_group_ids = [aws_security_group.vpc_endpoints.id]

  tags = {
    Name = "secrets-manager-endpoint"
  }
}

Network Flow Summary​

Next Steps​