multi-cloud-networking

You are a multi-cloud networking specialist. Design and secure connectivity across AWS, GCP, and Azure.

Multi-Cloud Connectivity Patterns

| Pattern | Latency | Throughput | Security | |---------|---------|------------|----------| | VPN (IPsec) | Medium | 1-3 Gbps | Encrypted, public internet | | Direct Connect / ExpressRoute / Interconnect | Low | 10-100 Gbps | Private, dedicated | | Cloud VPN + Cloud Router | Low | 10 Gbps (HA) | Encrypted, Google backbone | | Transit Gateway + TGW Peering | Low | 50 Gbps | AWS backbone | | SD-WAN | Medium | Variable | Encrypted, policy-based |

AWS Transit Gateway + GCP

# AWS -> GCP connectivity via VPN
resource "aws_vpn_connection" "to_gcp" {
  customer_gateway_id = aws_customer_gateway.gcp.id
  transit_gateway_id  = aws_ec2_transit_gateway.main.id
  type                = "ipsec.1"

  tunnel1_inside_cidr = "169.254.10.0/30"
  tunnel2_inside_cidr = "169.254.11.0/30"

  tags = { Name = "vpn-to-gcp" }
}

# GCP Cloud VPN to AWS
resources:
  - name: vpn-tunnel-to-aws
    type: compute.vpnTunnel
    properties:
      peerIp: 35.xxx.xxx.xxx
      sharedSecret: secret-key
      ikeVersion: 2
      localTrafficSelector:
        - 10.0.0.0/8
      remoteTrafficSelector:
        - 172.16.0.0/12
      targetVpnGateway: $(ref.vpn-gateway.selfLink)

Network Segmentation

# AWS — VPC with segmentation
resource "aws_vpc" "multi_cloud" {
  cidr_block = "10.0.0.0/16"
  tags = { Name = "multi-cloud-vpc" }
}

resource "aws_subnet" "private" {
  vpc_id     = aws_vpc.multi_cloud.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_ec2_transit_gateway_vpc_attachment" "main" {
  subnet_ids         = [aws_subnet.private.id]
  transit_gateway_id = aws_ec2_transit_gateway.main.id
  vpc_id             = aws_vpc.multi_cloud.id
}

# Network ACL (stateless)
resource "aws_network_acl" "dmz" {
  vpc_id = aws_vpc.multi_cloud.id
  ingress {
    protocol   = "tcp"
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 443
    to_port    = 443
  }
  egress {
    protocol   = "-1"
    rule_no    = 100
    action     = "deny"
    cidr_block = "0.0.0.0/0"
    from_port  = 0
    to_port    = 0
  }
}

Cloud Firewall Rules

# AWS Security Group (stateful)
aws ec2 authorize-security-group-ingress \
  --group-id sg-xxx \
  --protocol tcp \
  --port 3306 \
  --source-group sg-database

# GCP Firewall (stateful)
gcloud compute firewall-rules create allow-db \
  --network default \
  --allow tcp:3306 \
  --source-tags db-client

# Azure NSG
az network nsg rule create \
  --nsg-name app-nsg \
  --name allow-https \
  --priority 100 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --destination-port-ranges 443

Private DNS Resolution

# AWS Route53 Resolver
aws route53resolver create-resolver-rule \
  --domain-name "internal.example.com" \
  --rule-type FORWARD \
  --resolver-endpoint-id rslvr-in-xxx \
  --target-ips Ip=10.0.0.53,Port=53

# GCP Cloud DNS forwarding
gcloud dns managed-zones create private-zone \
  --dns-name "internal.example.com" \
  --visibility private \
  --networks https://www.googleapis.com/compute/v1/projects/p/global/networks/default

Monitoring

# End-to-end connectivity check
mtr -r -c 10 10.0.0.1

# Cloud-to-cloud latency
aws ec2 describe-regions --query 'Regions[].RegionName'
# GCP regions -> measure latency between cloud provider regions

# Flow logs
aws ec2 create-flow-logs --resource-type VPC --resource-id vpc-xxx
gcloud logging read 'resource.type="gce_subnetwork" AND jsonPayload.reporter="SRC"'

Security Checklist

□ All inter-cloud traffic encrypted (IPsec or private)
□ No inter-cloud traffic over public internet (use DX/EI/GCI)
□ VPC/network segmentation with NACLs/SGs
□ Private DNS resolution across clouds
□ Flow logs enabled on all VPCs
□ Cross-cloud IAM (STS / workload identity federation)
□ DDoS protection at each cloud edge
□ BGP with MD5 authentication for cloud routing
□ Regular latency and throughput testing

Tools Reference

| Tool | Purpose | Type | |------|---------|------| | Aviatrix | Multi-cloud networking | Commercial | | Alkira | Network cloud | Commercial | | Equinix Fabric | Interconnection | Commercial | | Cloudflare Magic Transit | Network interconnect | Commercial | | Terraform | Infrastructure as Code | Open source |