VPC & Networking
What does zop.dev create for VPC & Networking?
zop.dev provisions a VPC with 3 subnet tiers (public, private and database) spread across availability zones, with an internet gateway, NAT gateways and route tables wired for each tier. The number of NAT gateways is the single decision that drives the ongoing cost.
| Field | Value |
|---|---|
| Cloud | aws |
An Amazon VPC is the isolated network foundation every other AWS resource lives in. zop.dev lays out a production-grade, three-tier network for you, so teams get secure segmentation between public-facing, application, and database workloads without hand-writing routing tables.
A VPC with public, private, and database subnets
VPC, three subnet tiers (public, private, db), internet gateway, Elastic IP, NAT gateway, three route tables with routes and associations, and an allow-TLS security group.
The subnets map and automatic NAT egress
Single subnets map input: vpc_cidr, public_subnets_cidr[], private_subnets_cidr[], db_subnets_cidr[], availability_zones[]. NAT egress is wired automatically for the private and db tiers.Routing and the TLS security group come along
Three-tier routing and TLS security group are created automatically alongside the VPC.
The three-tier split
Public subnets hold anything needing an inbound route from the internet: load balancers, bastions. Private subnets hold compute with outbound-only access through NAT. Database subnets hold datastores with no internet route at all.
That third tier is the one people skip when building by hand, and it is the one that matters most in a security review: a database subnet with no route to an internet gateway cannot be exposed by a misconfigured security group, because there is no path.
NAT gateways are the cost decision
Each NAT gateway costs roughly $32 a month before any data crosses it, plus a per-GB processing charge. One per availability zone is the resilient pattern and the expensive one. A three-AZ VPC starts at about $96 a month with zero traffic.
For a development VPC a single NAT gateway shared across zones cuts that to a third. It creates a zonal dependency, which is the correct tradeoff in an environment where an AZ failure means someone fixes it on Monday.
Once provisioned, this is also the most common finding on the idle-NAT-gateway rule.
VPC endpoints are the cheaper path for AWS services
Traffic to S3 and DynamoDB does not need to leave AWS. A gateway VPC endpoint routes it directly, costs nothing, and removes that traffic from the NAT gateway’s per-GB charge entirely.
For a workload that reads heavily from S3, this single change usually saves more than the NAT gateway costs.
What you get by default
vpc_cidr, public_subnets_cidr[], private_subnets_cidr[] and the database tier, with routing
and a TLS security group created automatically for each.