architecting-networks_skill

Overview

This skill designs secure, scalable cloud network architectures across AWS, GCP, and Azure using proven VPC/VNet patterns, subnet strategies, zero trust principles, and hybrid connectivity. It provides a decision framework for choosing flat, multi-VPC, hub-and-spoke, full mesh, or hybrid topologies and translates requirements into actionable design steps. Use it to plan connectivity, security segmentation, and cost-optimized network designs for cloud workloads.

How this skill works

The skill evaluates requirements (number of VPCs, latency, hybrid needs, compliance, budget) and maps them to network patterns and subnet strategies. It prescribes CIDR sizing, multi-AZ distribution, NAT gateway decisions, security group and NACL usage, observability via flow logs, and hybrid options (VPN vs. Direct Connect/ExpressRoute). It also offers cost tradeoffs and a step-by-step implementation workflow culminating in Infrastructure-as-Code recommendations.

When to use it

• Designing VPC/VNet topology for a new cloud environment
• Implementing network segmentation and microsegmentation for security
• Planning multi-VPC or multi-cloud connectivity and routing
• Establishing hybrid connectivity between on-premises and cloud
• Migrating from a flat network to a scalable, secure architecture

Best practices

• Choose pattern based on VPC count, latency needs, and centralized inspection requirements
• Plan non-overlapping CIDR blocks and reserve space for expansion
• Distribute production tiers across 3 AZs and dev/test across 1–2 AZs for cost control
• Favor security groups and identity-based controls; use NACLs sparingly for explicit denies
• Use VPC Flow Logs and monitoring to detect anomalies and validate zero trust controls

Example use cases

• Small single-environment app: Flat single VPC with three-tier subnets and a single NAT for cost savings
• Enterprise multi-account setup: Hub-and-spoke with Transit Gateway, centralized inspection, and Direct Connect
• Latency-sensitive pair of VPCs: Direct VPC peering (full mesh for <5 VPCs) to avoid TGW costs
• Hybrid backup or dev connectivity: Site-to-site VPN for temporary or low-throughput links
• Multi-cloud service mesh: Use consistent subnet and identity patterns across AWS, GCP, and Azure