Capstone Project 7 — Cloud VPC Design¶
In this capstone project, you'll design a production-grade Virtual Private Cloud (VPC) architecture similar to those used by enterprise organizations running applications on AWS, Microsoft Azure, and Google Cloud Platform (GCP). You'll design highly available cloud networking with multiple Availability Zones, public and private subnets, Internet Gateways, NAT Gateways, load balancers, VPN connectivity, firewalls, and monitoring. This project focuses on architecture and production design rather than a single cloud provider, making the skills transferable across cloud platforms.
Learning Path¶
Course Progress
Project Objectives¶
By completing this project, you'll be able to:
- Design production cloud networking
- Build highly available VPC architectures
- Design public and private subnet layouts
- Configure routing and Internet access
- Secure cloud workloads
- Design hybrid connectivity
- Build enterprise-ready cloud networks
Skills Covered¶
This project combines concepts from:
- AWS VPC
- Azure VNet
- Google Cloud VPC
- Subnets
- Route Tables
- NAT Gateway
- Internet Gateway
- VPN
- Load Balancers
- Hybrid Networking
- Kubernetes Networking
Project Scenario¶
A company is migrating its applications from an on-premises data center to the cloud.
Requirements:
- Highly Available
- Secure
- Scalable
- Multi-AZ
- Internet Access
- Private Workloads
- Kubernetes Support
- Hybrid Connectivity
Your task is to design the cloud networking architecture.
Target Architecture¶
Internet
│
Internet Gateway
│
Public Load Balancer
┌───────────────┐
│ │
Public Subnet A Public Subnet B
│ │
NAT Gateway A NAT Gateway B
│ │
Private Subnet A Private Subnet B
│ │
Kubernetes Cluster
│
Database Subnets
│
VPN Gateway
│
On-Premises Network
Cloud Requirements¶
Deploy:
- Multi-AZ Architecture
- Public Subnets
- Private Subnets
- Database Subnets
- Bastion Host
- Kubernetes Cluster
- Monitoring
- VPN Connectivity
Network Design¶
Example CIDR:
Subnets:
| Subnet | CIDR |
|---|---|
| Public-A | 10.0.1.0/24 |
| Public-B | 10.0.2.0/24 |
| Private-A | 10.0.11.0/24 |
| Private-B | 10.0.12.0/24 |
| Database-A | 10.0.21.0/24 |
| Database-B | 10.0.22.0/24 |
Step 1 — Create VPC¶
Create:
The VPC provides isolated networking for all cloud resources.
Step 2 — Create Public Subnets¶
Deploy:
Resources:
- Load Balancer
- Bastion Host
- NAT Gateway
Step 3 — Create Private Subnets¶
Deploy:
Resources:
- Application Servers
- Kubernetes Nodes
- Internal APIs
Private workloads should not have direct Internet exposure.
Step 4 — Create Database Subnets¶
Deploy:
Only application servers should communicate with databases.
Step 5 — Configure Internet Gateway¶
Architecture:
Only public subnets should have direct Internet routing.
Step 6 — Configure NAT Gateway¶
Traffic:
Private resources receive outbound Internet access without becoming publicly reachable.
Step 7 — Configure Route Tables¶
Public Route Table:
Private Route Table:
Associate route tables with the appropriate subnets.
Step 8 — Deploy Load Balancer¶
Internet traffic:
The load balancer distributes traffic across Availability Zones.
Step 9 — Deploy Bastion Host¶
Purpose:
Never expose private servers directly to the Internet.
Step 10 — Deploy Kubernetes¶
Deploy cluster across:
- Private Subnet A
- Private Subnet B
Components:
- Worker Nodes
- Control Plane (Managed or Self-Managed)
- Ingress Controller
Step 11 — Deploy Database¶
Example:
Deploy across:
- Database Subnet A
- Database Subnet B
Enable automatic backups and high availability.
Step 12 — Configure Security Groups¶
Allow only required traffic.
Examples:
| Source | Destination |
|---|---|
| Load Balancer | Application |
| Application | Database |
| Bastion | Servers |
| VPN | Internal Network |
Adopt a least-privilege approach.
Step 13 — Configure Network ACLs¶
Protect subnets with stateless filtering.
Examples:
- Block Unauthorized Traffic
- Restrict Public Access
- Allow Required Services
Step 14 — Configure VPN¶
Architecture:
Enable secure hybrid connectivity.
Step 15 — Configure Monitoring¶
Deploy:
- Cloud Monitoring
- Flow Logs
- Metrics
- Alerts
- Dashboards
Monitor:
- Latency
- Packet Loss
- Traffic
- Firewall Activity
Step 16 — Enable Logging¶
Collect:
- VPC Flow Logs
- Firewall Logs
- Load Balancer Logs
- Kubernetes Logs
- VPN Logs
Logs support troubleshooting and security investigations.
Step 17 — Validate Connectivity¶
Verify:
- Internet Access
- Private Routing
- Database Access
- VPN Connectivity
- Kubernetes Networking
- DNS Resolution
Enterprise Cloud Architecture¶
Internet
│
Internet Gateway
│
Load Balancer
│
Private Kubernetes Cluster
│
Managed Database
│
VPN Gateway
│
On-Premises
Multi-AZ Design¶
Applications remain available during an Availability Zone failure.
Security Improvements¶
Implement:
- Private Subnets
- Least Privilege Security Groups
- Bastion Host
- VPN Access
- Encryption
- Network Segmentation
- Logging
- Monitoring
Validation Checklist¶
| Item | Status |
|---|---|
| VPC Created | ☐ |
| Public Subnets Created | ☐ |
| Private Subnets Created | ☐ |
| Database Subnets Created | ☐ |
| Internet Gateway Configured | ☐ |
| NAT Gateway Configured | ☐ |
| Route Tables Working | ☐ |
| Load Balancer Working | ☐ |
| VPN Configured | ☐ |
| Monitoring Enabled | ☐ |
Common Problems¶
| Problem | Solution |
|---|---|
| No Internet Access | Verify Route Tables |
| Private Instances Offline | Check NAT Gateway |
| Database Unreachable | Review Security Groups |
| VPN Failure | Verify Routing |
| Load Balancer Unhealthy | Check Health Checks |
Troubleshooting Commands¶
Verify routes.
Test connectivity.
DNS lookup.
Test HTTP.
Verify Kubernetes.
Bonus Challenges¶
Extend the project by:
- Deploying Multi-Region Networking
- Configuring Transit Gateway
- Building Hub-and-Spoke Architecture
- Deploying Service Mesh
- Configuring Private Endpoints
- Automating VPC Deployment with Terraform
- Deploying GitOps for Kubernetes
Learning Outcomes¶
After completing this project, you'll be able to:
- Design enterprise cloud networking
- Build highly available VPCs
- Deploy secure subnet architectures
- Configure hybrid networking
- Secure cloud workloads
- Build Kubernetes-ready networks
Project Deliverables¶
By the end of this project, you should have:
- Multi-AZ VPC Design
- Public Subnets
- Private Subnets
- Database Subnets
- Route Tables
- Internet Gateway
- NAT Gateway
- VPN Connectivity
- Load Balancer
- Architecture Documentation
Self-Assessment¶
Before moving to the next project, confirm:
- Can you design a production VPC?
- Can you separate public and private workloads?
- Can you configure routing correctly?
- Can you design highly available networking?
- Can you integrate on-premises and cloud networks?
- Can you secure cloud infrastructure?
- Can you document a complete cloud network architecture?
Summary¶
In this capstone project, you designed a production-grade cloud networking architecture suitable for AWS, Azure, or Google Cloud. You created a highly available VPC with public and private subnets, database isolation, Internet and NAT gateways, load balancing, hybrid VPN connectivity, monitoring, and security controls.
This project reflects real-world cloud architectures used by enterprises running mission-critical applications with high availability, security, and scalability requirements.
Key Takeaways¶
- Design VPCs with public, private, and database subnets for security and isolation.
- Use Internet Gateways for public access and NAT Gateways for secure outbound Internet access from private subnets.
- Distribute workloads across multiple Availability Zones to improve resilience.
- Protect resources using Security Groups, Network ACLs, and private networking.
- Integrate cloud and on-premises environments using VPN or dedicated connectivity.
- Continuously monitor networking, routing, and security with flow logs and cloud monitoring services.
What's Next?¶
Enterprise Network Troubleshooting Challenge
In the final capstone project, you'll complete the Enterprise Network Troubleshooting Challenge.
You'll diagnose and resolve realistic production networking issues involving DNS, DHCP, VLANs, routing, VPNs, firewalls, cloud networking, Kubernetes, and application connectivity. This end-to-end challenge will test everything you've learned throughout the Networking Mastery course and prepare you for real-world production environments.