REL 2: How do you plan your network topology?

Workloads often exist in multiple environments. These include multiple cloud environments (both publicly accessible and private) and possibly your existing data center infrastructure. Plans must include network considerations such as intra- and inter-system connectivity, public IP address management, private IP address management, and domain name resolution.

Resources

AWS re:Invent 2018: Advanced VPC Design and New Capabilities for Amazon VPC (NET303)
AWS re:Invent 2019: AWS Transit Gateway reference architectures for many VPCs (NET406-R1)
What is Amazon Route 53?
What is Elastic Load Balancing?
What is Amazon CloudFront?
What Is a Transit Gateway?
What Is Amazon VPC?
Working with Direct Connect Gateways
Using the Direct Connect Resiliency Toolkit to get started
Multiple data center HA network connectivity
What Is AWS Global Accelerator?
VPC Endpoints and VPC Endpoint Services (AWS PrivateLink)
Amazon Virtual Private Cloud Connectivity Options Whitepaper
AWS Marketplace for Network Infrastructure
APN Partner: partners that can help plan your networking

Best Practices:

Improvement Plan

Use highly available network connectivity for your workload public endpoints

  • Ensure that you have highly available connectivity for users of the workload: Amazon Route 53, AWS Global Accelerator, Amazon CloudFront, Amazon API Gateway, and Elastic Load Balancing (ELB) all provide highly available public facing endpoints. You may also choose to evaluate AWS Marketplace software appliances for load-balancing and proxying.
  • Provision redundant connectivity between private networks in the cloud and on-premises environments

  • Ensure that you have highly available connectivity between AWS and on-premises environment: Use multiple AWS Direct Connect (DX) connections or VPN tunnels between separately deployed private networks. Use multiple DX locations for high availability. If using multiple AWS Regions, ensure redundancy in at least two of them. You might want to evaluate AWS Marketplace appliances that terminate VPNs. If you use AWS Marketplace appliances, deploy redundant instances for high availability in different Availability Zones.
  • Ensure IP subnet allocation accounts for expansion and availability

  • Plan your network to accommodate for growth, regulatory compliance, and integration with others: Growth can be underestimated, regulatory compliance can change, and acquisitions or private network connections can be difficult to implement without proper planning.
  • Prefer hub-and-spoke topologies over many-to-many mesh

  • Prefer hub-and-spoke topologies over many-to-many mesh: If more than two network address spaces (VPCs, on-premises networks) are connected via VPC peering, AWS Direct Connect, or VPN, then use a hub-and-spoke model like that provided by AWS Transit Gateway.
  • Enforce non-overlapping private IP address ranges in all private address spaces where they are connected

  • Monitor and manage your CIDR use: Evaluate your potential usage on AWS, add CIDR ranges to existing VPCs, and create VPCs to allow planned growth in usage.