# Networking

> Skill: Cloud Networking

- Skill: `sawrus/networking` (Agent Skill)
- Install (CLI): `npx skillmds@latest add sawrus/networking`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sawrus/networking/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: sawrus (https://skillmd.com/u/sawrus)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/sawrus/networking

---

# Skill: Cloud Networking

## When to load

When designing VPC topology, configuring security groups, setting up NAT, or reviewing network architecture.

## VPC Design (3-tier)

```
VPC (10.0.0.0/16)
├── Public subnets   (10.0.1.0/24, 10.0.2.0/24) ← ALB, NAT Gateway
├── Private subnets  (10.0.10.0/24, 10.0.11.0/24) ← App servers, K8s nodes
└── Isolated subnets (10.0.20.0/24, 10.0.21.0/24) ← RDS, ElastiCache
```

## Security Group Rules (Default-Deny)

```hcl
# App tier: only accepts traffic from ALB security group
resource "aws_security_group_rule" "app_from_alb" {
  type                     = "ingress"
  from_port                = 8080
  to_port                  = 8080
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.alb.id
  security_group_id        = aws_security_group.app.id
}

# DB tier: only accepts traffic from app security group
resource "aws_security_group_rule" "db_from_app" {
  type                     = "ingress"
  from_port                = 5432
  to_port                  = 5432
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.app.id
  security_group_id        = aws_security_group.db.id
}
```

## Cost Optimization

- Use VPC Endpoints for S3/DynamoDB to avoid NAT Gateway costs
- NAT Gateway: one per AZ in production (not one shared)
- Transit Gateway for multi-VPC connectivity (cheaper than VPC peering at scale)