Practice: Networking for private, air-gapped and classified customer environments
Generated by Claude through GigAI 0.1.11.10 on 2026-10-12.
Main tool: AWS · AWS puts the private network, the private endpoints, the VPN attachment and the government partition in one documented object model, so a single practice stack covers every subtopic of this lesson. · Alternatives: Google Cloud with Private Service Connect and Azure with Private Link offer the same private endpoint pattern under different object names and DNS behaviour; Cilium or Calico enforce egress inside the cluster rather than at the cloud network edge; Harbor is a self-hosted registry for carrying images into a disconnected site instead of using a cloud registry behind an endpoint.
Every step links into the tool's own documentation; links were checked on 2026-10-12 · version 1
Setup (one time)
1. Read the getting started section and choose your practice target: a personal AWS account, or a local AWS emulator running in a container as the no-cost substitute.
Every later step creates network objects, so you need one place to create them that you can tear down freely. An emulator keeps the path on a laptop when a paid account is not an option.
Explained in: What is Amazon VPC? - Amazon Virtual Private Cloud (docs.aws.amazon.com), checked 2026-10-12
Done when: You can name the target you will use and it answers a request to list its virtual private clouds.
2. Install the AWS command line interface and configure a named profile that points at your practice target.
The console hides the object names you must know in a customer environment where only scripted access is allowed. A named profile also keeps practice work apart from any real account.
Explained in: What is Amazon VPC? - Amazon Virtual Private Cloud (docs.aws.amazon.com), checked 2026-10-12
Done when: A describe call for virtual private clouds returns a valid, possibly empty, list under your named profile.
3. Review which network pieces are billed by the hour and note which ones you will only lint as templates or run in the emulator.
Interface endpoints, VPN connections and load balancers cost money while they exist. Deciding up front what stays local avoids a surprise bill.
Explained in: What is Amazon VPC? - Amazon Virtual Private Cloud (docs.aws.amazon.com), checked 2026-10-12
Done when: You have a short list that marks each planned resource as either created for real, emulated locally, or template only.
Steps
1. Create a first virtual private cloud with one subnet and one route table in your practice target.
This is the smallest unit a customer deployment lives in. Building it by hand once makes the address range, subnet and route table relationship concrete.
Explained in: What is Amazon VPC? - Amazon Virtual Private Cloud (docs.aws.amazon.com), checked 2026-10-12
Done when: A describe call shows your virtual private cloud, its subnet and its route table with the address range you chose.
2. Write a one-page object map of the private connectivity model: service provider, endpoint service, service consumer, VPC endpoint and endpoint network interface.
Customer conversations about private access fail when the two sides mix up who owns the endpoint and who owns the service. The map gives you the vocabulary before you build anything.
Explained in: AWS PrivateLink concepts - Amazon Virtual Private Cloud (docs.aws.amazon.com), checked 2026-10-12
Done when: Your map names each object, which side owns it, and which direction a connection is initiated.
3. Query the network with the describe actions for subnets, route tables and endpoints, and save the output to a dated file as a baseline.
In a locked-down environment you prove a change by comparing state before and after, not by clicking around. A saved baseline is what you will diff in the following steps.
Explained in: Amazon VPC actions - Amazon Elastic Compute Cloud (docs.aws.amazon.com), checked 2026-10-12
Done when: A baseline file exists and a second capture taken right after shows no differences.
4. Create the private layout for a customer deployment: subnets in two zones with no internet gateway attached and no default route to the outside.
No public ingress and no open egress is the starting assumption for enterprise and government customers. Seeing what an internet gateway provides tells you exactly what is missing when it is absent.
Explained in: Enable internet access for a VPC using an internet gateway - Amazon Virtual Private Cloud (docs.aws.amazon.com), checked 2026-10-12
Done when: The route tables of your private subnets contain only local routes, and a diff against the baseline shows the new subnets.
5. Create a gateway endpoint for object storage and associate it with the private route tables.
A gateway endpoint is the simplest private path to a service and it changes routing rather than adding an interface. It is the first dependency you make reachable without the internet.
Explained in: AWS::EC2::VPCEndpoint - AWS CloudFormation (docs.aws.amazon.com), checked 2026-10-12
Done when: The private route tables show a new route that targets the endpoint, visible in a diff against the baseline.
6. Create an interface endpoint for one service with private DNS enabled; if you have no paid account, run this against the local emulator.
Interface endpoints are how most service calls stay on the private network. Private DNS is what lets unmodified software keep using the normal service name.
Explained in: Access AWS services through AWS PrivateLink - Amazon Virtual Private Cloud (docs.aws.amazon.com), checked 2026-10-12
Done when: The endpoint reports an available state and the service name resolves to a private address from inside the network.
7. Write an endpoint policy that limits what Kubernetes nodes in the private subnets may reach, and pair it with a default-deny egress NetworkPolicy in a local kind cluster.
Egress control works in layers: the cluster policy stops pods, the endpoint policy stops anything that gets past the cluster. Practising both shows which layer blocks which request.
Explained in: AWS PrivateLink concepts - Amazon Virtual Private Cloud (docs.aws.amazon.com), checked 2026-10-12
Done when: A pod request to an allowed target succeeds, and a request to a target outside the policy is refused.
8. Write a template that places an internal Network Load Balancer in front of your service and exposes it as an endpoint service; lint it locally when you cannot deploy it without cost.
This is the provider side of private connectivity: how your product is offered into a customer network without peering the two networks. Keeping it as a template makes it repeatable per customer.
Explained in: AWS::ElasticLoadBalancingV2::LoadBalancer - AWS CloudFormation (docs.aws.amazon.com), checked 2026-10-12
Done when: The template passes validation and declares an internal load balancer with an endpoint service that references it.
9. Read the page on connecting a virtual private cloud to remote networks and write down when you would pick a VPN, peering through a transit hub, or an endpoint.
Customers with on-premises systems need a network-level link, while a single service is better exposed through an endpoint. A VPN connection needs a remote gateway and is billed, so this stage is a reading step.
Explained in: Connect your VPC to remote networks using AWS Virtual Private Network - Amazon Virtual Private Cloud (docs.aws.amazon.com), checked 2026-10-12
Done when: You have a three-row note that states, for each option, what it connects and one case where it is the wrong choice.
10. Load your container images into a private registry reached only through endpoints, then deploy the workload with no outside route; use a local registry container as the substitute.
Air-gapped delivery means every image, chart and model file is carried in, because nothing can be fetched at run time. Deploying with the outside route removed is the only honest test of that.
Explained in: Access AWS services through AWS PrivateLink - Amazon Virtual Private Cloud (docs.aws.amazon.com), checked 2026-10-12
Done when: The workload starts with every image pulled from the private registry, and a list of run-time dependencies shows none that needs the internet.
11. Write a parameter set for a government region that swaps the region names and service endpoint names your templates and tools use; an actual deployment needs a separate government account, so validate the templates only.
Government regions are a separate partition with their own endpoints and not every service is present. Hard-coded commercial names are the most common reason a working stack fails there.
Explained in: Service Endpoints - AWS GovCloud (US) (docs.aws.amazon.com), checked 2026-10-12
Done when: No template or script contains a hard-coded commercial region or endpoint name, and each one resolves from the parameter set.
12. Reproduce the whole private stack from your templates in a clean target with one scripted run, then capture state and compare it with your saved baseline files.
A forward deployed engineer rebuilds the same network in each customer account, so the stack must come up from source with no manual steps. The comparison proves the rebuild matches what you tested.
Explained in: What is AWS PrivateLink? - Amazon Virtual Private Cloud (docs.aws.amazon.com), checked 2026-10-12
Done when: A clean target reaches the same set of subnets, routes and endpoints from one run, and the diff against your saved state shows only identifiers that differ.
Back to Networking for private, air-gapped and classified customer environments