Network segmentation in cloud environments

In cloud environments, the user cannot really have control over switches to segment VLANs depending on the architecture of the application.

However, cloud providers do offer us an approach to segment the network through various services. AWS allows us to do this with the help of VPC.

In the following screenshot, we can see that there are two VPC with different CIDR, each for Development and Production environments:

Ideally, this seems to be a proper approach but still, this is not the best practice. With the feature of VPC peering, two VPC within the same region can communicate with each other. It just takes two minutes to set up the peering.

So, many architectures are now being built in a way that development and production VPC are in the different region itself, so there can be no direct linkage, for example:

• Development VPC–us–east
• Production VPC–ap–southeast