TradAI Final Architecture - VPC & Networking¶

Version: 10.0.0 | Date: 2026-03-28 | Source: infra/foundation/modules/, infra/compute/modules/alb.py, infra/shared/tradai_infra_shared/config.py

TL;DR: Single VPC (10.0.0.0/16) in eu-central-1 with 6 subnets across 2 AZs (public, private, database). A cost-effective NAT instance (t4g.nano, ~$3/month) replaces NAT Gateway. 11 VPC endpoints (2 gateway + 9 interface) keep AWS API traffic off the public internet. ALB handles path-based routing to 4 ECS services.

1. VPC Layout¶

Region: eu-central-1 (default; overridable via Pulumi config or AWS_REGION env var)

Mermaid Diagram¶

graph TB
    IGW[Internet Gateway]

    subgraph VPC["VPC 10.0.0.0/16"]
        subgraph AZ1["eu-central-1a"]
            PUB1["Public 10.0.1.0/24<br/>ALB · NAT · IGW"]
            PRIV1["Private 10.0.11.0/24<br/>ECS · Lambda"]
            DB1["Database 10.0.21.0/24<br/>RDS PostgreSQL"]
        end

        subgraph AZ2["eu-central-1b"]
            PUB2["Public 10.0.2.0/24<br/>ALB"]
            PRIV2["Private 10.0.12.0/24<br/>ECS · Lambda"]
            DB2["Database 10.0.22.0/24<br/>RDS Multi-AZ"]
        end
    end

    IGW --> PUB1
    IGW --> PUB2
    PUB1 -->|NAT| PRIV1
    PUB1 -->|NAT| PRIV2
    PRIV1 --> DB1
    PRIV2 --> DB2

ASCII Diagram (Reference)¶

eu-central-1a                          eu-central-1b
+--------------------+                 +--------------------+
| public 10.0.1.0/24 |                 | public 10.0.2.0/24 |
|  ALB, NAT, IGW     |                 |  ALB               |
+--------------------+                 +--------------------+
| private 10.0.11.0/24|                | private 10.0.12.0/24|
|  ECS, Lambda        |                |  ECS, Lambda        |
+--------------------+                 +--------------------+
| database 10.0.21.0/24|               | database 10.0.22.0/24|
|  RDS PostgreSQL      |               |  RDS (Multi-AZ)      |
+--------------------+                 +--------------------+

Source: infra/shared/tradai_infra_shared/config.py lines 47-55, infra/foundation/modules/vpc.py

2. Subnets¶

Source: infra/shared/tradai_infra_shared/config.py SUBNETS dict

3. Route Tables¶

There is one route table per tier (not per-AZ). Both AZ subnets within a tier share the same route table.

The private route table's NAT route is not configured inline. It is added dynamically by the NAT route-updater Lambda when the NAT ASG launches an instance.

Source: infra/foundation/modules/vpc.py _create_route_tables()

4. Security Groups¶

All security groups are created in infra/foundation/modules/security_groups.py using SecurityRuleBuilder from infra/shared/tradai_infra_shared/core/security_rule_builder.py.

Port Definitions (CommonPorts)¶

4.1 ALB Security Group (tradai-alb-sg)¶

*Consolidated SG rules only created when is_consolidated_mode() is true (dev/staging).

4.2 ECS Security Group (tradai-ecs-sg)¶

4.3 Lambda Security Group (tradai-lambda-sg)¶

No ingress rules. Lambda is egress-only.

4.4 RDS Security Group (tradai-rds-sg)¶

No egress rules defined (uses default).

4.5 NAT Security Group (tradai-nat-sg)¶

4.6 VPC Endpoint Security Group (tradai-endpoint-sg)¶

4.7 Consolidated Security Group (tradai-consolidated-sg) -- dev/staging only¶

Only created when is_consolidated_mode() returns True.

Source: infra/foundation/modules/security_groups.py

5. NAT Instance¶

A cost-effective NAT instance replaces NAT Gateway, saving ~$32/month.

High Availability¶

The NAT instance runs in an Auto Scaling Group (min=1, max=1, desired=1) for automatic replacement on failure.

The Lambda and EventBridge rule are created before the ASG to prevent a race condition where the first instance launches before the event handling chain is ready.

User data is rendered from a Jinja2 template (infra/foundation/templates/nat-userdata.sh.j2) and configures IP forwarding, iptables NAT masquerading, EIP association, and source/destination check disabling.

Source: infra/foundation/modules/nat_instance.py

6. VPC Endpoints¶

6.1 Gateway Endpoints (free)¶

6.2 Interface Endpoints (~$65.70/month total)¶

All interface endpoints are placed in private subnets, use the endpoint security group, and have private DNS enabled.

Interface endpoints are created when both private_subnet_ids and endpoint_security_group_id are provided to the VpcEndpoints constructor.

Source: infra/foundation/modules/vpc_endpoints.py

7. Network ACLs¶

NACLs provide stateless subnet-level filtering as defense-in-depth on top of security groups.

7.1 Public NACL¶

Inbound:

Outbound:

7.2 Private NACL¶

Inbound:

Outbound:

7.3 Database NACL¶

Inbound:

Outbound:

This is the most restrictive NACL -- only PostgreSQL from private subnets, responses back.

Source: infra/foundation/modules/nacl.py

8. Application Load Balancer¶

Listeners¶

Default action for routing listeners: 404 fixed response. Path rules route to target groups.

Path Routing¶

Health Checks¶

All target groups use: healthy threshold 2, unhealthy threshold 3, timeout 5s, interval 30s, matcher 200.

Source: infra/compute/modules/alb.py, infra/shared/tradai_infra_shared/config.py ALB_PATH_PATTERNS

9. DNS & Service Discovery¶

Internal service-to-service communication uses AWS Cloud Map (not Route 53 public DNS).

Services register via Cloud Map and are addressable by name within the VPC. The MLflow tracking URI is constructed as http://mlflow.{namespace}:5000/mlflow.

Source: infra/shared/tradai_infra_shared/config.py get_sd_namespace(), get_mlflow_tracking_uri()

10. VPC Flow Logs¶

Flow logs capture source/destination IPs, ports, protocol, packet/byte counts, and accept/reject actions for all VPC traffic.

Source: infra/foundation/modules/vpc_flow_logs.py

Changelog¶

Dependencies¶