Implement VPC segmentation with IPAM integration, dual-stack IPv4/IPv6, and multi-tenant isolation patterns
Network segmentation is critical for isolating workloads, limiting blast radius, and meeting compliance requirements. This skill covers multi-tier VPC design with IPAM integration and dual-stack IPv4/IPv6 support.
graph TB
subgraph "VPC Architecture"
subgraph "Public Tier"
ALB[Application Load Balancer]
NAT[NAT Gateway]
end
subgraph "Private Tier"
EKS[EKS Nodes]
Lambda[Lambda Functions]
end
subgraph "Isolated Tier"
RDS[(RDS Database)]
ElastiCache[(ElastiCache)]
end
end
Internet((Internet)) --> ALB
ALB --> EKS
EKS --> RDS
EKS --> ElastiCache
Private --> NAT --> Internet
| Tier | Internet Access |
|---|
| Use Case |
|---|
| Public | Direct (IGW) | Load balancers, bastion hosts |
| Private | Outbound only (NAT) | Application workloads, EKS nodes |
| Isolated | None | Databases, caches, sensitive data |
AWS IPAM provides centralized IP address management across accounts and regions:
Enable IPv6 for:
❌ Single subnet for all resources
❌ Overly permissive security groups (0.0.0.0/0)
❌ Database in public subnet
❌ Hardcoded IP addresses
❌ Not planning for growth (too small CIDR)
This example creates:
📁 Location: terraform/examples/network-segmentation/
# IPAM integration for centralized IP management
resource "aws_vpc_ipam_pool_cidr_allocation" "main" {
ipam_pool_id = var.ipam_pool_id
cidr = var.vpc_cidr # Or let IPAM auto-allocate
}
# Dual-stack VPC
resource "aws_vpc" "main" {
cidr_block = var.vpc_cidr
enable_dns_hostnames = true
enable_dns_support = true
assign_generated_ipv6_cidr_block = true # Enable IPv6
}
# Private subnet with IPv6
resource "aws_subnet" "private" {
vpc_id = aws_vpc.main.id
cidr_block = cidrsubnet(var.vpc_cidr, 4, count.index)
ipv6_cidr_block = cidrsubnet(aws_vpc.main.ipv6_cidr_block, 8, count.index)
assign_ipv6_address_on_creation = true
}
This example creates:
📁 Location: cdk/examples/network-segmentation/
// Dual-stack VPC with 3 tiers
const vpc = new ec2.Vpc(this, 'Vpc', {
ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
enableDnsHostnames: true,
enableDnsSupport: true,
subnetConfiguration: [
{ name: 'Public', subnetType: ec2.SubnetType.PUBLIC, cidrMask: 24 },
{ name: 'Private', subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, cidrMask: 24 },
{ name: 'Isolated', subnetType: ec2.SubnetType.PRIVATE_ISOLATED, cidrMask: 24 },
],
});
// Add IPv6 CIDR
const cfnVpc = vpc.node.defaultChild as ec2.CfnVPC;
cfnVpc.addPropertyOverride('AmazonProvidedIpv6CidrBlock', true);
// VPC Endpoints for AWS services (avoid NAT costs)
vpc.addGatewayEndpoint('S3Endpoint', { service: ec2.GatewayVpcEndpointAwsService.S3 });
vpc.addInterfaceEndpoint('SecretsManager', { service: ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER });
graph TB
Root[Root Pool: 10.0.0.0/8]
Region1[us-east-1: 10.0.0.0/12]
Region2[us-west-2: 10.16.0.0/12]
Prod[Production: 10.0.0.0/14]
Dev[Development: 10.4.0.0/14]
Root --> Region1
Root --> Region2
Region1 --> Prod
Region1 --> Dev
| Environment | CIDR Range | Notes |
|---|---|---|
| Production | /16 per VPC | Room for growth |
| Staging | /18 per VPC | Smaller but flexible |
| Development | /20 per VPC | Cost-effective |
✅ New greenfield deployments
✅ Public-facing workloads
✅ IoT/edge computing
✅ Kubernetes with IPv6
# IPv6-only subnet - no NAT gateway costs
resource "aws_subnet" "ipv6_only" {
vpc_id = aws_vpc.main.id
ipv6_cidr_block = cidrsubnet(aws_vpc.main.ipv6_cidr_block, 8, 100)
assign_ipv6_address_on_creation = true
enable_dns64 = true
enable_resource_name_dns_aaaa_record_on_launch = true
ipv6_native = true # IPv6-only
}