SysPad › Examples › Enterprise hybrid network
Enterprise hybrid network
Global Accelerator + NLB + GWLB secure ingress to an ALB/Fargate/Aurora app tier, with VPC Endpoint, NAT/IGW, Storage Gateway, and a Direct Connect + Transit Gateway link to an on-prem legacy system.
The connectivity reference architecture: inline firewall inspection on ingress, private AWS-service access, internet egress, hybrid backup, and on-prem integration - all in one enterprise network diagram.
- Throughput: 6,000 req/sec
- First to saturate: App DB
- Estimated cost: $327k/mo
How it works
- Global Accelerator
- Puts customers onto the AWS backbone at the nearest edge instead of routing them across the public internet for the whole trip. Bought for consistency, not raw speed.
- Firewall (GWLB)
- Every packet is inspected inline by a third-party appliance fleet before it reaches anything of ours. Two milliseconds on every request is the price of that policy, paid whether or not the traffic is suspicious.
- VPC Endpoint
- Config reads reach S3 without ever touching the internet or the NAT gateway. Cheaper per gigabyte than NAT, and it means the security review has one fewer route to argue about.
- NAT Gateway
- The only way out to the public internet, one per availability zone. Per-gigabyte processing charges make this a line item people discover rather than plan for.
- Storage Gateway
- On-prem systems keep writing to what looks like a local volume while the bytes trickle to AWS behind them. A nightly background flow, not request-path traffic.
- Transit Gateway
- One hub every VPC and the on-prem link attach to. The alternative is a mesh of peering connections that nobody can draw by the third year.
- Direct Connect
- A dedicated private line to the data centre, priced as a port you rent by the month whether or not traffic flows. Bought for predictable latency and for the compliance answer, not for bandwidth.