Connect VPCs privately

advanced

Scenario & brief

The application talks to a shared-services database in a separate VPC — but the traffic currently goes over the public internet, and both the app and the shared database are publicly exposed.

Connect them privately (think VPC peering / Transit Gateway):

keep the ALB internet-facing,
put the app and the shared database in private subnets,
the shared database must be reachable only from the app tier and not from the internet, and
give the private subnets NAT for egress.

2,000 rps peakp99 ≤ 200ms99.95% availdurability: criticalbudget $200/mo

Load Balancer

Networking

Subnet placement

Allowed ingress (security group)

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture0

Connectivity50

Requirements met33

Requirements

Load balancer is internet-facing — internet-facing (need internet-facing)
App in a private subnet — public subnet (need private subnet)
Shared database in a private subnet — public subnet (need private subnet)
Shared database not reachable from the internet — internet-reachable (need not internet-reachable)
Shared database accepts only the peered app tier — from internet (need only from app)
Private subnets egress via NAT — no NAT (need private egress via NAT)

Advisor

App in a private subnet: Move it to the private subnet.
Shared database in a private subnet: Move it to the private subnet.
Shared database not reachable from the internet: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.
Shared database accepts only the peered app tier: Restrict the security group to accept traffic only from app.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.