Cloud Networking: VPC Design, CDN, and DNS Explained
Cloud networking connects your compute, storage, and database resources securely and efficiently. Unlike on-premises networking where you own every switch and router, cloud networking is defined through software — virtual networks, programmatic routing, and API-driven configuration. According to the AWS re:Invent 2024 networking keynote, over 90% of cloud performance issues trace back to networking misconfigurations, making network architecture one of the highest-leverage skills for cloud practitioners.
Virtual Private Cloud (VPC)
A VPC is a logically isolated network within a cloud provider’s infrastructure. Every cloud resource you deploy — VMs, databases, load balancers, serverless functions — operates within a VPC. Getting VPC design right is critical because it forms the security and connectivity foundation for everything else.
CIDR block selection: Choose a CIDR range large enough for future growth. A /16 prefix (65,536 addresses) provides room for multiple environments without renumbering. Avoid overlapping CIDR ranges if you plan to connect VPCs across environments or on-premises networks via VPN or Direct Connect.
Subnet strategy:
- Public subnets contain resources that need direct internet access — load balancers, NAT gateways, bastion hosts
- Private subnets contain application servers that should not accept direct inbound internet traffic
- Isolated subnets contain databases and internal services that should have no internet path at all
Availability Zone (AZ) architecture: Deploy resources across at least two AZs for high availability. Each AZ is an isolated data center with independent power, cooling, and networking. A single-AZ deployment is an outage waiting to happen — if the AZ fails, the entire application goes down.
# AWS VPC creation
VPC_ID=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 --query Vpc.VpcId --output text)
# Public subnet (AZ 1)
aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block 10.0.1.0/24 --availability-zone us-east-1a
# Private subnet (AZ 1)
aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block 10.0.2.0/24 --availability-zone us-east-1a
# Public subnet (AZ 2)
aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block 10.0.3.0/24 --availability-zone us-east-1b
# Private subnet (AZ 2)
aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block 10.0.4.0/24 --availability-zone us-east-1b
# Internet Gateway for public subnets
IGW_ID=$(aws ec2 create-internet-gateway --query InternetGateway.InternetGatewayId --output text)
aws ec2 attach-internet-gateway --vpc-id $VPC_ID --internet-gateway-id $IGW_IDGCP’s VPC is global (not regional like AWS) — a single VPC spans all regions. This simplifies multi-region architectures but requires careful subnet planning to avoid cross-region traffic costs. Azure’s VNet is regional but supports VNet peering across regions for global connectivity.
Load Balancing
Cloud load balancers distribute incoming traffic across multiple targets (instances, containers, IP addresses) in one or more Availability Zones. They provide health checking, TLS termination, and auto-scaling integration.
Application Load Balancer (AWS ALB, GCP External HTTP(S) LB, Azure App Gateway) — operates at Layer 7 (HTTP/HTTPS), supporting content-based routing by hostname, path, headers, and query parameters. ALB is the standard choice for web applications.
Network Load Balancer (AWS NLB, GCP External TCP/UDP LB, Azure ILB) — operates at Layer 4 (TCP/UDP) with ultra-low latency (<1ms). NLB handles millions of requests per second and preserves client IP addresses. Ideal for performance-sensitive TCP workloads and integration with AWS PrivateLink.
Global load balancing — GCP’s External HTTP(S) Load Balancer uses global anycast IP, routing traffic to the closest healthy backend across regions. AWS Global Accelerator provides static anycast IPs with traffic routing optimization across the AWS global network.
aws elbv2 create-load-balancer \
--name excellentwiki-alb \
--subnets subnet-public-1a subnet-public-1b \
--security-groups sg-alb \
--type application
aws elbv2 create-target-group \
--name excellentwiki-tg \
--protocol HTTP \
--port 8080 \
--vpc-id $VPC_ID \
--health-check-path /health
aws elbv2 register-targets \
--target-group-arn arn:aws:elasticloadbalancing:... \
--targets Id=i-1234567890abcdef0 Id=i-0987654321fedcba0Content Delivery Network (CDN)
CDNs cache content at edge locations geographically closer to users, reducing latency by 50-80% and offloading origin servers. AWS CloudFront, GCP Cloud CDN, and Azure Front Door are the primary CDN services.
How CDN works: User requests route to the nearest edge location. If the content is cached (TTL still valid), the edge responds directly. If not, the edge fetches from the origin and caches the response for subsequent requests. Cache hit ratios of 80-95% are typical for static assets.
Origin options: S3, Cloud Storage, Blob Storage, Elastic Load Balancer, Application Load Balancer, or custom HTTP server. CloudFront supports multiple origins per distribution with behavior-based routing.
aws cloudfront create-distribution \
--origin-domain-name excellentwiki-assets.s3.amazonaws.com \
--default-root-object index.html \
--default-cache-behavior '{
"TargetOriginId": "S3-excellentwiki",
"ViewerProtocolPolicy": "redirect-to-https",
"MinTTL": 86400,
"DefaultTTL": 86400,
"MaxTTL": 31536000,
"ForwardedValues": {
"QueryString": false,
"Cookies": {"Forward": "none"}
}
}'CloudFront supports Lambda@Edge and CloudFront Functions for processing requests at the edge — useful for URL rewriting, A/B testing, authentication, and response header manipulation without modifying the origin application.
DNS (Domain Name System)
Cloud DNS services translate human-readable domain names (excellentwiki.com) to IP addresses. They provide global anycast DNS with low-latency resolution and built-in health checking:
- AWS Route 53 — fully qualified public and private DNS with health checks, latency-based routing, geo-routing, weighted routing, and failover routing
- GCP Cloud DNS — anycast DNS with programmable managed zones, DNSSEC, and integration with Cloud Load Balancing
- Azure DNS — integrated with Entra ID, supports alias records for Azure resources
Routing policies:
- Simple — routes all traffic to a single resource
- Weighted — distribute traffic across resources by percentage (canary deployments)
- Latency-based — route to the region with lowest latency for the user
- Geolocation — route based on user geographic location (content restrictions)
- Failover — route to primary resource; failover to secondary if health check fails
VPN and Hybrid Connectivity
Connecting on-premises networks to cloud VPCs enables hybrid architectures:
Site-to-Site VPN — Encrypted tunnels over the internet using IPSec. AWS VPN, GCP Cloud VPN, and Azure VPN Gateway support up to 1.25 Gbps per tunnel with redundant tunnels for high availability.
Direct Connect / Interconnect / ExpressRoute — Dedicated physical connections from your data center to the cloud provider’s network. Bandwidth from 50 Mbps to 100 Gbps with consistent latency and no internet dependency. AWS Direct Connect provides 99.99% availability with redundant connections.
Transit Gateway / Network Connectivity Center / Virtual WAN — Central hub for connecting multiple VPCs, VPNs, and Direct Connect connections. Simplifies network management for organizations with dozens or hundreds of VPCs.
Network Security
Security Groups — stateful instance firewalls. Traffic allowed out is automatically allowed back in (no need to define return rules). Default deny inbound, all outbound allowed.
Network ACLs — stateless subnet firewalls. Both inbound and outbound rules must be defined. Rules are evaluated in order (lowest number first). Use NACLs to add a second layer of defense and to block specific IP ranges at the subnet level.
WAF (Web Application Firewall) — Layer 7 protection against web exploits. AWS WAF, GCP Cloud Armor, and Azure WAF include managed rule groups for OWASP Top 10, CVE-specific protections, and common exploit patterns.
DDoS protection — AWS Shield Advanced ($3,000/month) provides cost protection against scaling attacks, 24/7 DDoS response team, and real-time visibility. GCP Cloud Armor Managed Protection includes Google’s global DDoS defense infrastructure. Azure DDoS Protection Standard covers all public endpoints in a VNet.
FAQ
What is the difference between a public subnet and a private subnet? A public subnet has a route to an Internet Gateway in its route table, allowing resources to receive inbound traffic from the internet. A private subnet routes through a NAT Gateway for outbound-only internet access. Resources in private subnets cannot be directly reached from the internet.
How do I connect VPCs across different regions? Use VPC Peering (AWS), VPC Network Peering (GCP), or VNet Peering (Azure). These connections use provider backbone infrastructure, not the public internet. For complex multi-VPC architectures, use Transit Gateway (AWS) or Network Connectivity Center (GCP).
Why is my CDN not caching content? Common causes: cache control headers missing or set to no-cache/no-store, query string randomization, authenticated requests bypassing cache, cookies forwarded to origin. Verify the HTTP headers on the origin response include Cache-Control with a reasonable max-age value.
When should I use a Network Load Balancer vs Application Load Balancer? Use ALB for HTTP/HTTPS applications needing content-based routing, path-based routing, or host-based routing. Use NLB for TCP/UDP workloads (gRPC, MQTT, SMTP), applications needing the client’s source IP, or extreme performance requirements (<1ms latency).
How do I monitor network traffic in the cloud? Enable VPC Flow Logs (AWS), VPC Flow Logs (GCP), or NSG Flow Logs (Azure) for IP traffic metadata. Use network monitoring tools like AWS Reachability Analyzer for path verification and AWS Network Manager for end-to-end network visualization.
What is Direct Connect and when should I use it? AWS Direct Connect, Azure ExpressRoute, and GCP Cloud Interconnect provide dedicated physical connections from your data center to the cloud provider. Use them when you need consistent network performance, large data transfer volumes (10+ TB/month), regulatory requirements for private connectivity, or real-time applications sensitive to internet latency variance.
How do I handle cross-VPC communication for microservices? Use VPC Peering (direct, encrypted connections) for simple topologies. For many VPCs, use Transit Gateway (AWS) or Network Connectivity Center (GCP) as a central hub. For Kubernetes cross-cluster communication, use a service mesh (Istio, Linkerd) with multi-cluster support or Cloud Service Mesh (GCP).
Cloud Security Guide — Cloud Architecture Patterns — Cloud Monitoring Guide