Skip to main content
Version: v1.1

Networking Prerequisites

This page documents the network infrastructure required for an AosCloud deployment on AWS. It covers VPC design, subnet planning across availability zones, VPC endpoint requirements for private EKS communication, and security group rules governing traffic between services.

Prerequisites

Before configuring networking, review:

Single-VPC Architecture

AosCloud deploys all resources into a single VPC. This VPC hosts the EKS cluster, all managed services (Aurora PostgreSQL, DocumentDB, ElastiCache, EFS), VPC endpoints, and load balancers.

CIDR Planning

The base VPC CIDR defaults to 10.231.0.0/16 and is configurable per environment:

ParameterDefaultNetmask
Base VPC CIDR10.231.0.0/16255.255.0.0 (65,536 addresses)

A /16 block provides sufficient address space for all subnets. Choose a CIDR that does not overlap with your corporate network or other VPCs that may need peering/transit gateway connectivity in the future.

VPC Configuration

The VPC is created with:

  • DNS hostnames enabled (enable_dns_hostnames = true)
  • Default tenancy
  • An Internet Gateway attached for public subnets and NAT

Subnet Layout

The VPC address space is divided into purpose-specific subnets spread across availability zones.

Subnet Allocation Table

Given the default base CIDR 10.231.0.0/16:

SubnetApproximate RangePurposeAZs
EKS Private (pods)10.231.0.0/18 split into 3EKS node groups, pods, internal LB3
EKS Publicwithin 10.231.0.0/18Public load balancers, NAT Gateway3
Endpoints10.231.100.0/24VPC Interface Endpoints1
Aurora PostgreSQL~10.231.253.192/26 → 3× /28Aurora DB subnet group3
DocumentDB~10.231.255.128/26 → 3× /28DocumentDB subnet group3
ElastiCache~10.231.255.64/26 → 3× /28ElastiCache Redis subnet group3

EKS Subnets (Detail)

The EKS cluster creates its own subnets within the Kubernetes services CIDR block (10.231.0.0/18):

  • 3 private subnets — one per AZ, tagged kubernetes.io/role/internal-elb = 1. Used for node groups, pods, and internal load balancers. Each node joins the private route table with a default route via NAT Gateway.
  • 3 public subnets — one per AZ, tagged kubernetes.io/role/elb = 1. Used for internet-facing load balancers. Each has a default route to the Internet Gateway.
  • 1 NAT Gateway — placed in the first public subnet, providing outbound internet for private subnets.

Managed Service Subnet Groups

Aurora PostgreSQL, DocumentDB, and ElastiCache Redis each require a subnet group spanning multiple AZs for high availability:

ServiceSubnetsAZ CountPlacement
Aurora PostgreSQL3 subnets3Base VPC, private
DocumentDB3 subnets3Base VPC, private
ElastiCache Redis3 subnets3Base VPC, private
EFSMount targets in EKS pod subnets3EKS private subnets

EFS mount targets are placed directly in the EKS pod subnets rather than in dedicated subnets, because EFS clients (pods) must be in the same subnet or a routable subnet to access mount targets.

Network Topology Diagram

VPC Endpoints

EKS private clusters require VPC Interface Endpoints to communicate with AWS services without traversing the public internet. All endpoints are placed in the dedicated endpoints subnet and associated with both the base VPC default security group and the EKS cluster security group.

Required Endpoints

Twelve VPC endpoints provide private connectivity:

Service EndpointPurpose
com.amazonaws.<region>.ec2EKS node registration, ENI management
com.amazonaws.<region>.ecr.apiECR API calls for image manifest retrieval
com.amazonaws.<region>.ecr.dkrDocker image layer pulls from ECR
com.amazonaws.<region>.logsCloudWatch Logs for Fluent Bit log shipping
com.amazonaws.<region>.stsSTS for IRSA token exchange (pod IAM roles)
com.amazonaws.<region>.elasticloadbalancingALB/NLB provisioning by AWS Load Balancer Controller
com.amazonaws.<region>.autoscalingCluster Autoscaler integration
com.amazonaws.<region>.secretsmanagerCSI Secrets Store driver access to secrets
com.amazonaws.<region>.rdsAurora PostgreSQL API operations
com.amazonaws.<region>.s3S3 access (artifacts, backups)
com.amazonaws.<region>.elasticacheElastiCache management API
com.amazonaws.<region>.email-smtpSES SMTP endpoint for outbound email

All endpoints use Interface type. The S3 endpoint has private_dns_enabled = false (AWS limitation for S3 Interface endpoints), while all other endpoints have private_dns_enabled = true.

Endpoint Security

Each VPC endpoint is associated with:

  1. The base VPC default security group — allows traffic from all resources in the VPC
  2. The EKS cluster security group — allows traffic from EKS nodes and pods

This dual-attachment ensures both managed services and EKS workloads can reach AWS APIs through the endpoints.

Security Groups

AosCloud uses a combination of VPC default security groups and custom security groups to control network traffic.

Security Group Architecture

Security GroupVPCPurpose
Base VPC Default SGBase VPCApplied to managed services (Aurora, DocumentDB, Redis, EFS, endpoints)
EKS Cluster SGBase VPCApplied to EKS nodes; managed by EKS
EKS Public LB SGBase VPCCustom SG for internet-facing load balancers (optional)

Inter-Group Rules

EKS ↔ Base VPC (Bidirectional)

Full connectivity between the EKS cluster security group and the base VPC default security group. This permits EKS pods to reach managed services and VPC endpoints.

RuleDirectionProtocolPortsSource/Destination
eks_to_baseIngress on Base SGAll (-1)0–65535EKS Cluster SG
base_to_eksIngress on EKS SGAll (-1)0–65535Base VPC Default SG

Effect: Any pod running in EKS can communicate on any port with any resource in the Base VPC default security group (Aurora on 5432, DocumentDB on 27017, Redis on 6379, EFS on 2049, etc.), and vice versa.

Public Load Balancer (Optional)

When ingress security group rules are configured, a dedicated security group is created for the EKS public load balancer:

RuleDirectionProtocolPortsSource
Configurable ingressIngressPer rulePer rulePer rule CIDR
All egressEgressAll (-1)0–655350.0.0.0/0, ::/0

Configure ingress rules to restrict inbound traffic to specific ports and source CIDRs. For example, you might allow HTTPS (443) from all sources and a management port (10000) from internal networks only.

Port Requirements Summary

The following ports must be reachable between EKS pods and managed services (all within the VPC, governed by the EKS ↔ Base bidirectional rule):

ServicePortProtocolDirection
Aurora PostgreSQL5432TCPEKS → Aurora
DocumentDB27017TCPEKS → DocumentDB
ElastiCache Redis6379TCPEKS → ElastiCache
EFS (NFS)2049TCPEKS → EFS mount targets
AMQP (RabbitMQ in-cluster)5672TCPPod → Pod (Istio mesh)
AMQPS (RabbitMQ management)15672TCPPod → Pod (Istio mesh)
HTTPS (AWS endpoints)443TCPEKS → VPC endpoints

Outbound Internet Access

EKS private subnets access the internet through the NAT Gateway placed in the first public subnet. This is required for:

  • Pulling container images from external registries (when not cached in ECR)
  • Sending outbound email via SES (if VPC endpoint is insufficient)
  • Connecting to external APIs

The NAT Gateway has an Elastic IP. All egress from private subnets routes through 0.0.0.0/0 → NAT Gateway → Internet Gateway.

Route Tables

Route TableSubnetsDefault RouteAdditional Routes
EKS PrivateEKS private subnets, Endpoints subnet0.0.0.0/0 → NAT Gateway
EKS PublicEKS public subnets0.0.0.0/0 → Internet Gateway
Base VPC Default(implicit for non-EKS subnets)local only

The endpoints subnet is explicitly associated with the EKS private route table, ensuring that VPC endpoint traffic from EKS uses the correct routing path.

CIDR Planning Guidance

When choosing your VPC CIDR:

  1. Use a /16 block — the subnet calculations assume a full /16 and will produce incorrect results with smaller blocks
  2. Avoid RFC 1918 conflicts — ensure your chosen CIDR does not overlap with corporate VPN ranges or other AWS VPCs you may peer with
  3. Reserve space for growth — the default 10.231.0.0/16 leaves the rest of 10.0.0.0/8 available for other environments or services
  4. Staging offset — a +1 modifier is applied to the second octet for staging environments (e.g., 10.232.0.0/16 if base is 10.231.0.0/16), ensuring non-overlapping CIDRs across environments