Network Architecture Design
Network architecture design tests whether you can turn application and business requirements into a hybrid cloud topology that is addressable, reachable, resilient and affordable. Questions rarely ask for a definition; they hand you constraints - number of virtual networks, regions, on-premises sites, latency targets, inspection requirements - and expect one defensible design with the trade-offs stated.
Address plan first
Allocate non-overlapping CIDR blocks per environment, region and account, sized for growth and summarizable into supernets so route tables stay small. Reserve ranges for shared services, inspection and transient workloads. Overlapping address space is the defect that no routing trick repairs later.
Topology and transitivity
Cloud virtual networks are regional constructs, and peering behaviour is the most examined fact: native VPC/VNet peering is non-transitive, so N networks in a mesh need N(N-1)/2 links, while hub-and-spoke with a transit gateway or virtual WAN needs N attachments. Use full mesh only for a handful of tightly coupled networks; use hub-and-spoke when you need centralized inspection, shared services or a single hybrid entry point.
Hybrid paths and failure domains
Compare dedicated private circuits, site-to-site IPsec VPN over the internet, and SD-WAN overlays. Dedicated circuits give predictable latency and jitter but take weeks to provision and need a VPN backup; internet VPNs provision in minutes but inherit internet variability. Give every path a failure domain: dual tunnels terminating on different edge devices, appliances spread across at least two availability zones, and a documented failover order.
Worked example
Requirement: 45 VPCs in three regions, on-premises access limited to shared services, all internet egress inspected centrally. A full mesh means 990 peerings, quota pressure, and still no inspection capability. The defensible answer is one hub VPC per region attached to a global transit gateway, spokes peered only to their regional hub, and inspection VPCs attached as their own routing segment. Spoke route tables send default and on-premises prefixes to the inspection attachment, and separate transit gateway route tables keep production and non-production apart. The reasoning chain is: requirements set the topology, quotas and non-transitivity eliminated the mesh, inspection forced centralization.
Traps that cost marks
Assuming peering is transitive; forgetting that overlapping CIDRs permanently break VPN and private-endpoint designs; designing zone redundancy but placing the stateful firewall in one zone; ignoring IP consumption by load balancers and pod networking; proposing a design with no cost or quota analysis.