Connect VPCs privately

advanced

Scenario & brief

The application talks to a shared-services database in a separate VPC — but the traffic currently goes over the public internet, and both the app and the shared database are publicly exposed.

By the end, that cross-VPC traffic must never touch the public internet: neither the app nor the shared database should be reachable from outside, the database should accept traffic only from the app tier, and private-subnet egress still needs to work. The ALB is the one thing that should stay internet-facing.

2,000 rps peakp99 ≤ 200ms99.95% availdurability: criticalbudget $200/mo

Load Balancer

Networking

Subnet placement

Allowed ingress (security group)

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture0

Connectivity50

Requirements met33

Requirements

Load balancer is internet-facing — internet-facing (need internet-facing)
App in a private subnet — public subnet (need private subnet)
Shared database in a private subnet — public subnet (need private subnet)
Shared database not reachable from the internet — internet-reachable (need not internet-reachable)
Shared database accepts only the peered app tier — from internet (need only from app)
Private subnets egress via NAT — no NAT (need private egress via NAT)

Advisor

App in a private subnet: Move it to the private subnet.
Shared database in a private subnet: Move it to the private subnet.
Shared database not reachable from the internet: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.
Shared database accepts only the peered app tier: Restrict the security group to accept traffic only from app.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.