VPC
An Amazon Virtual Private Cloud (VPC) is a private network inside an AWS region, with its own address range, subnets and routing. The AWS Baseline creates one hub VPC, one spoke VPC per workload account and an optional runner VPC, all from the same two registry-module definitions.
What it does
A VPC has a CIDR block, such as 10.0.0.0/16, divided into subnets, each in one Availability Zone (AZ). A route table decides where a subnet's traffic goes. An internet gateway (IGW) lets public subnets talk to the internet directly; a NAT Gateway lets private subnets reach out without being reachable. Flow Logs record every connection's addresses, ports and bytes. A gateway endpoint routes traffic to S3 over the AWS network instead of the internet.
How BuiltForProd uses it
Every VPC uses the terraform-aws-modules/vpc registry module, version 6.7.3, through three unit definitions. All span three AZs derived from the region, and every CIDR is read from the VPC map through IPAM outputs, never typed into a unit.
| VPC | Definition | Account | Tiers | Internet |
|---|---|---|---|---|
Hub, acme-usw2-network-vpc (10.9.16.0/20) | units/vpc-hub | core-network | Public (NAT Gateways), private (Transit Gateway attachment interfaces), firewall subnets only when inspection is on | IGW and one NAT Gateway per AZ (nat_gateway_per_az = true in network.hcl) |
Spoke, acme-usw2-<stage>-vpc (a /16 per stage, for example 10.0.0.0/16 for prod) | units/vpc-spoke | plat-sandbox, plat-dev, plat-staging, plat-prod | Private /18 subnets sized for EKS pod density, public /21 subnets | IGW for public subnets only; no NAT; private default route to the Transit Gateway |
Runner (10.9.32.0/22) | units/vpc-runner | core-auto, optional | Private subnets only | None; reaches workloads through the Transit Gateway |
The spoke design is the one to understand. Public subnets exist strictly so the AWS Load Balancer Controller can place an internet-facing load balancer; they are tagged kubernetes.io/role/elb. EKS nodes, DocumentDB and Redis live in private subnets, tagged kubernetes.io/role/internal-elb, whose only route out is 0.0.0.0/0 to the Transit Gateway and from there through the hub's NAT Gateways. That removes a NAT Gateway per account and gives one place to add egress inspection with Network Firewall.
Every VPC sends Flow Logs for all traffic, at 60-second aggregation, to the audit bucket in core-audit under flow-logs/. The hub creates one route table per subnet in every tier so per-AZ firewall routes can be added later without rebuilding tables.
Two companion units run in each workload account. vpc-endpoints adds a free S3 gateway endpoint on the private and public route tables; no interface endpoints are deployed. ssm-publish writes the VPC id, CIDR, subnet ids and Transit Gateway attachment id to Parameter Store, which is how the blueprints find the network without depending on landing-zone state.
Address planning is deliberate: /18 private subnets give about 16,000 pod IPs per AZ per stage, and the /8 supernet leaves room for 16 regions and 8 stages per region.
Terms you will see
| Term | Meaning |
|---|---|
| CIDR block | An address range written as network and prefix length, such as 10.2.0.0/16. |
| Subnet | A slice of the VPC in one AZ; public or private by its route table. |
| Route table | The rules that send a subnet's traffic to an IGW, NAT, endpoint or Transit Gateway. |
| Internet gateway | The VPC's door to the internet, used by public subnets only. |
| NAT Gateway | Outbound-only internet access for private subnets; per AZ in the hub. |
| Flow Logs | Connection records for a VPC, sent here to the audit bucket. |
| Gateway endpoint | A route to S3 that stays on the AWS network; free. |
Where to read more
- AWS Baseline overview for the network topology diagram.
- Transit Gateway for how the VPCs connect.
- IPAM for where every address range is defined.