Diagram Literacy: Translating Logical Architecture to Physical Subnets
How to read, author, and map high-level cloud architecture boxes into concrete VPC CIDR blocks, route tables, and Availability Zones.
1. Business Problem & Context
Junior engineers frequently view architecture diagrams as simple flowcharts connecting boxes. However, placing an RDS database in the same logical tier as a public web server without understanding subnet boundaries leads to severe security vulnerabilities.
2. Requirements & Constraints
- Visual Clarity: Clearly distinguish between Edge, Public Ingress, Private Compute, and Isolated Data tiers.
- Multi-AZ Representation: Show redundant instances in at least two Availability Zones.
3. Architecture Overview & Data Flow
Interactive Architecture Diagram (Use controls to zoom & pan)
4. AWS Services Used & Rationales
AWS Services Architecture Rationale
Concrete reasons why these specific services were chosen over alternatives
| Service | Category | Architectural Rationale ("Why this service?") |
|---|---|---|
| Amazon VPC | Networking | Creates a dedicated virtual network isolated from other AWS tenants. |
| Internet Gateway (IGW) | Networking | Enables public route tables to map public IPs to internet destinations. |
| NAT Gateway | Networking | Allows private subnets to download software patches without accepting inbound internet connections. |
5. Key Design Trade-offs
Architecture Decision & Trade-Off Matrix
Evaluating alternative approaches under real-world constraints
Single Public Subnet Everything
- + Simplest setup
- + No NAT gateway costs
- − Critical security violation
- − Databases directly reachable if security groups misconfigured
Tiered Subnet Isolation (Chosen)
✓ Chosen Design- + Defense-in-depth
- + Databases physically unreachable from the internet
- + Clear audit boundaries
- − Requires NAT Gateway or VPC Endpoints for egress
6. Implementation Highlights
Network Planning CIDR Math Blueprint for /16 VPCs
VPC CIDR: 10.0.0.0/16 (65,536 Total IPs)
├── Public Subnet AZ-A: 10.0.1.0/24 (251 usable IPs) -> Route to IGW
├── Public Subnet AZ-B: 10.0.2.0/24 (251 usable IPs) -> Route to IGW
├── Private App AZ-A: 10.0.10.0/24 (251 usable IPs) -> Route to NAT-A
├── Private App AZ-B: 10.0.20.0/24 (251 usable IPs) -> Route to NAT-B
├── Isolated DB AZ-A: 10.0.100.0/24(251 usable IPs) -> Local VPC Only
└── Isolated DB AZ-B: 10.0.200.0/24(251 usable IPs) -> Local VPC Only7. Results & Key Metrics
- Zero Inbound Exposure for persistent data stores.
- 100% Alignment with AWS Well-Architected Security Pillar.
8. Key Architectural Takeaways
Golden Rule: Never draw an arrow on an architecture diagram without knowing the exact protocol, port, security group rule, and subnet routing table that enables it.
