AWS Multi-VPC Architecture & Production Network Isolation

Designing Secure AWS Multi-VPC Topologies

In enterprise cloud deployments, segregating development, staging, and production environments across multiple Virtual Private Clouds (VPCs) and AWS Accounts is standard best practice.

1. Transit Gateway vs VPC Peering

When connecting more than 3 VPCs, AWS Transit Gateway (TGW) serves as a centralized hub to prevent full-mesh peering sprawl.

# Create AWS Transit Gateway using AWS CLI
aws ec2 create-transit-gateway 
    --description "Core-Hub-Transit-Gateway" 
    --options AmazonSideAsn=64512,AutoAcceptSharedAttachments=enable

2. Bastion Host Architecture & AWS SSM Session Manager

Eliminate public SSH access on Port 22 by leveraging AWS Systems Manager (SSM) Session Manager for secure, audited command line access:

# Start interactive SSM session with an EC2 instance without opening port 22
aws ssm start-session --target i-0a1b2c3d4e5f67890

# Port forward remote PostgreSQL to local port 5433
aws ssm start-session 
    --target i-0a1b2c3d4e5f67890 
    --document-name AWS-StartPortForwardingSession 
    --parameters '{"portNumber":["5432"],"localPortNumber":["5433"]}'

3. S3 Bucket Hardening Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EnforceTLSRequestsOnly",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::production-backup-linuxlab",
        "arn:aws:s3:::production-backup-linuxlab/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}