Architecting an Enterprise Network on AWS Cloud WAN
How to design a multi-region, multi-account AWS network on Cloud WAN, from segments and attachments to single-hop inspection, and the lessons from running one in production. Most enterprise AWS networks grow the same way. One VPC becomes fifty. One region becomes three or four. A Transit Gateway appears in each region, they get peered, and a team spends a growing share of its week keeping route…
Designing a multi-region, multi-account AWS network on Cloud WAN involves addressing the challenges that come with scaling enterprise networks. As VPCs and regions grow, route tables become increasingly difficult to manage and keep consistent across all of them. AWS Cloud WAN solves these issues by providing a global network that acts as a core network operated by AWS, with edges in each chosen region. These edges connect to VPCs, Transit Gateways, Direct Connect gateways, and VPNs.
Cloud WAN eliminates the problems of routing intent being spread across multiple documents and inspection being a double-hop process. By describing the entire network in a versioned JSON document called the core network policy, Cloud WAN allows you to maintain a consistent routing configuration across all regions.
In a Cloud WAN setup, each region becomes a core network edge, and AWS peers every edge with every other edge, eliminating the need for manual inter-region peerings and route management. Segments, which are routing domains that exist on every edge, facilitate the free communication between VPCs in different regions, as long as they are in the same segment.
Shared services, which usually include central logging, DNS, egress, and platform tooling, are isolated and reachable from every environment segment, but the shared services hub is not transitive, ensuring that traffic cannot bypass security measures.
External and inter-cloud segments are created for external VPNs, SaaS platforms, and partners, ensuring they are isolated and do not interfere with internal traffic. To implement this design effectively, it is essential to reserve an ASN range in the policy, choose a private range for each edge, and avoid changing it once it has been set.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
