In this session, we seek to address the many real-life conditions that lead to different VPC design scenarios. We break down the reasons why customers choose to deploy a single VPC as opposed to a multi-VPC approach. We also explore the architectures that lead to customers deploying advanced VPC designs, such as shared services VPCs or multi-region transit VPCs. The session explores in detail the tools you need to support these architectures, such as AWS Direct Connect, VPC peering, VPN, AWS Identity and Access Management (IAM), and resource tagging.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS re:INVENT
VPC Design Scenarios for Real-Life
Use Cases
D a v i d M u r r a y , E n t e r p r i s e S o l u t i o n s A r c h i t e c t m u r r a y d a @ a m a z o n . c o m
G e n e T i n g , S o l u t i o n s A r c h i t e c t g e n e t i n g @ a m a z o n . c o m
N o v e m b e r 2 8 , 2 0 1 7
N E T 3 0 8

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AGENDA
• Single/Few VPC Architectures
• Multi-VPC Architectures
• Accounts and VPC Designs – A Marriage Made in Heaven
• Global VPC Architectures
• Use Cases
• What Next
• Scenarios – Collaborative Architectures
• Where do I go to after this?

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
“Anyone who sits on top of the largest hydrogen-oxygen fueled system in the world,
knowing they’re going to light the bottom, and doesn’t get a little worried, does not
fully understand the situation.”
John Young, Astronaut, About to embark on a life-changing adventure

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Single-VPC Architecture
Image Credit NASA

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Single-VPC Architecture
Account 1
Quick Setup
Tight Perimeter
Control
Single Network
Topology
Single BGP Session
• Complexity
• Limits
• Tagging
• IAM
• Cost Control

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Use Cases - Single VPC
• Start Ups
• Small Enterprises
• Single Geographical Region
• Developer Mindset
Image Credit NASA

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multi-VPC Architecture
Image Credit NASA

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multi-VPC Architecture
Account 1 Account 2 Account 3Minimal Blast
Radius
Tight Limit &
Cost Control
Access Control
Multi-Account
Administration
Tedious
Endpoint
Security
Complex DNS
Strategy
BGP per VPC
Complex
Address
Management

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Use Cases – Multi-VPC
• Complex Enterprises
• Granular Billing
Requirements
• Infrastructure Mindset
Image Credit NASA

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• VPC decisions usually spawn out of the account
structure conversation
• Account structures are usually built around the
need for how granular you need control of:
• Security
• Billing
• AWS Limits
• Blast Radius
• Larger enterprises tend to want granular controls
around security and billing
Accounts and VPCs – A Happy Marriage
Image Credit NASA

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Shared Services VPC Architecture
Image Credit NASA

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Typical Shared Services VPC Resources
Account 1
DNSDirectory
Services
Security
Appliances
Central
Repositories
Reduced Cost
and Overhead
Centralized
Management
Visibility
Must Design
for Resilience
Discipline
Network
Design
Direct Connect

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Shared Services VPC Communications
AWS
Region
Shared
Services

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Use Cases - Shared Services VPC
• Infrastructure Mindset
• Resource Consolidation
• Centralized Security
Image Credit NASA

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Global Transit VPC Architecture
Image Credit Pexel

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Transit VPC at a Glance
Direct
Connect
Global
network
connectivity
AWS
Network
Backbone
More complex
engineering

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Transit VPC Architecture

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Use Cases – Transit VPC
• Inter-VPC Communications
• Multi-Region Architectures
• Third-Party Cloud
Connectivity
Image Credit NASA

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Where do I start?
Image Credit Pexels

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Start With Your Business
• How Complex is my business?
• How many Business Units do I have?
• How do we budget across the business
units?
• A single IT budget
• Each BU controls own budget
• Does each BU work on its own project or
share the workload?
• What are our Security/Compliance
requirements?
Where do I start?
Image Credit Blue Origin

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Then look at the people?
• Do we have an Infrastructure or
Developer Mindset?
• Who will be managing the cloud
environment?
• Do they have a traditional
infrastructure background?
• Will developers be building and
running their own environment(s)?
Where do I start?
Image Credit NASA

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Finally look at the technical requirements
• Do we require Hybrid connectivity to on
premise?
• Do we need a multi region architecture ?
• How comfortable are we with using
native cloud based security to control
access between workloads?
• Do we have requirements for expensive
vendor equipment?
Where do I start?
Image Credit Pexels

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What Next
Image Credit NASA

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Break into teams …
Image Credit NASA

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• SID331: Architecting Security and Governance
Across a Multi-Account Strategy (Session)
• SID335: Implementing Security and Governance
Across a Multi-Account Strategy (Chalk Talk)
• ENT324: Automating and Auditing Cloud
Governance and Compliance in Multi-Account
Environments (Session)
• SID311: Designing Security and Governance Across
a Multi-Account Strategy (Workshop)
• SID308: Multi-Account Strategies (Chalk Talk)
Take one giant step … to these sessions
Image Credit NASA

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!