Skip to main content
This page describes the shared network that every cloud-hosted system in the estate runs inside, and the connectivity this repo provisions.

​
Overview

The TalentID-Infra stack creates a single VPC that is shared by every cloud-hosted system in the estate. There is one VPC, in one account, in one region. All compute for TalentID, GKL Platform, Telemetry and SG-Infra runs inside it, and the shared MongoDB instance lives inside it too. This is the single most widely shared resource in the estate.

​
The VPC

  • Name: sgTalentIdVpc.
  • CIDR range: 172.17.0.0/22 (around 1000 addresses).
  • DNS hostnames and DNS support are both enabled.
  • Subnets: 6 subnets across 3 Availability Zones (eu-west-2a, eu-west-2b, eu-west-2c): 3 public and 3 private-with-egress, each a /25 block. This is the AWS CDK default topology and was not tuned in code.
  • NAT: the private subnets reach the internet through managed NAT gateways. The NAT gateway count is not pinned in the code (the CDK default is one per Availability Zone, which would be three here), so confirm the live count in the AWS console. NAT gateways are charged per hour and per GB.
  • Compute placement: the MongoDB instance and the application Lambdas run in the private-with-egress subnets. Nothing is publicly addressable at the instance level.

​
Security Groups

The model is built around security groups rather than IP allow-lists:
  • Lambda security group (LambdaSecurityGroup). Attached to downstream systems’ Lambdas. Allows all outbound. It acts as the trusted identity that the MongoDB security group allows in.
  • API Gateway endpoint security group. Used by the API Gateway VPC endpoint. Allows inbound HTTPS (443) from within the VPC range.
  • MongoDB security group. Defined in the MongoDB stack, but it completes the model: it allows inbound on 27017 only from the Lambda security group. See Shared MongoDB Instance.
Membership of the Lambda security group is what grants a workload access to the database.

​
API Gateway VPC Endpoint

The stack creates an interface VPC endpoint for the API Gateway execute-api service, placed in the private subnets, with private DNS enabled. This lets systems inside the VPC reach private API Gateway APIs without traffic leaving the AWS network, and means the standard execute-api hostname resolves to the endpoint from inside the VPC.

​
What Is Published For Other Systems

The stack writes its key network identifiers to SSM Parameter Store so downstream systems can find them at deploy time without hard-coding. These include the VPC id, the Lambda security group id and the VPC endpoint id. See Integration Surface and Configuration Contract.

​
Why It Is Built This Way

  • One shared VPC for the whole estate is simple and keeps networking cost down (one set of NAT gateways, one network to reason about). The cost is that there is no network isolation between systems. Every system shares the same address space and blast radius, so a network change here can affect everything at once. This is a major reason the repo is treated as the most sensitive in the estate, and a motivation for the SG-Infra pattern.
  • Security-group-based access, rather than CIDR allow-lists, is a reasonable identity-style approach and ties the database to approved workloads.
  • The default CDK topology (6 subnets across 3 Availability Zones) is convenient but was not tuned. The NAT gateway count in particular is worth confirming, because in a single shared VPC NAT is a recurring cost and a potential single point of failure for outbound traffic.

​
Key Files

Last modified on June 30, 2026