Cloud Networking

A cloud network is software pretending to be wires, and that means every routing decision is explicit and reviewable in a way a physical network never was. The cost of that explicitness is that nothing connects by default — every path between two resources exists because someone configured it, which is a feature once you stop fighting it.

Treat the network layout as a security boundary first and a connectivity convenience second. Every path that traffic can take should be one someone deliberately allowed, not one that happened to work.

1. Plan CIDR ranges before you provision anything

Subnet ranges are painful to change after resources are placed in them, and overlapping ranges are what block a future VPC peering or transit connection. Pick address space with room for growth and with an eye toward every network you might ever need to connect to — including a data center's existing ranges and other cloud accounts' VPCs.