Designing VPC to host multiple businesses

Hi,

As soon as I hear the words "isolated" and "hosted customer", I immediately turn to the use of multiple VPCs. There is no explicit cost for creating separate VPCs and they provide the perfect tooling for customer segmentation. As for providing services, such as firewalls, inbound load balancing and so forth, consider using shared services as part of your hosting offer for your customers. Using tools like Transit Gateway, you can connect all of your VPCs, along with your shared networking services, described above. Using custom routing tables VPCs can still be isolated (with up to 5000 VPC attached to a single TGW) but benefit from using the shared ingress or even in-line firewall inspection.

Here is a link to a number of configurations possible using Transit GW, with one covering your exact situation, isolated VPCs using shared services -

https://docs.aws.amazon.com/vpc/latest/tgw/TGW_Scenarios.html

This article covers many AWS Network Firewall design configurations, but pay attention to the section "Centralized deployment model" :

https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/

Here is another awesome PDF walking through numerous reference designs using Transit Gateway:

https://d1.awsstatic.com/events/reinvent/2019/REPEAT_1_AWS_Transit_Gateway_reference_architectures_for_many_VPCs_NET406-R1.pdf

Hi,

Well, answer is it depends :)

I suggest a good read to this https://aws.amazon.com/blogs/security/security-practices-in-aws-multi-tenant-saas-environments/ which discusses different deployment models.

On top of that, have a look at best practices for tenant isolation with pros and cons: https://d1.awsstatic.com/whitepapers/saas-tenant-isolation-strategies.pdf

Hope it helps ;)