The private network in the cloud and the dedicated wire to your data center: the foundation of any serious hybrid architecture.
The VPC is your virtual data center: subnets, route tables, security groups and NACLs under your control. Direct Connect adds the dedicated physical link — stable latency and guaranteed bandwidth — while Transit Gateway connects dozens of VPCs and sites like a central router.
The stateful firewall per instance: microsegmentation without appliances.
AWS and SaaS services reached over private network: traffic that never goes out on the internet.
The multi-VPC router: environments, accounts and sites connected with central policies.
Managed inspection and traffic visibility: the cloud network as observable as the physical one.
The VPC is designed by CIDR and subnets (public/private per AZ), route tables, NAT gateways and stateful security groups + stateless NACLs. Toward home: Site-to-Site VPN or Direct Connect (up to 100G, with MACsec); across VPCs and accounts: Transit Gateway as hub, VPC peering for simple cases, PrivateLink to expose services without crossing the internet. VPC endpoints keep S3 and DynamoDB on the backbone.
The cloud as a new room: same logical network, same rules, latency under control.
Production, testing and DR in separate VPCs: blast radius contained by design.
Databases and APIs reached via PrivateLink: internet surface reduced to zero.