AWS VPC patterns: Real-world trade-offs for scaling cloud infrastructure

This review examines common AWS VPC architectural patterns—hub-and-spoke and full mesh—detailing their operational complexities, cost implications, and suitability for growing cloud platforms.

TL;DR

Best for: Organizations requiring centralized network control, strong security, and hybrid connectivity across multiple AWS accounts should implement a Hub-and-Spoke architecture. Skip if: Your AWS footprint involves only a few VPCs with minimal inter-service communication, or if you prioritize absolute lowest latency between services over centralized control. Full Mesh patterns quickly become unmanageable. Bottom line: Hub-and-Spoke offers robust control and scalability for large, complex AWS environments, but its cost and operational overhead demand careful upfront design, especially when integrating traffic inspection.

METHODOLOGY

This v0 review draws on Oscar Gaviria's published claims at dev.to/oscar_gaviria_2b862594738/disenando-vpcs-en-aws-patrones-reales-hub-spoke-mesh-multi-account-3953, accessed on 2026-05-19. The review covers the architectural patterns (Hub-and-Spoke, Full Mesh) and their associated trade-offs, cost estimates, and operational considerations as described by the founder. It also incorporates the founder's specific advice on when to use each pattern and critical design pitfalls. This initial assessment does not include independent performance benchmarks, long-term workflow integration analysis, or testing of edge cases beyond those explicitly mentioned in the source. Update cadence: This review will be re-tested and updated when founder claims diverge from observed behavior in production, or when new architectural patterns gain significant traction.

WHAT IT DOES

Oscar Gaviria's article details two primary AWS Virtual Private Cloud (VPC) architectural patterns, emphasizing that a VPC should be seen as the foundation for security, connectivity, and scalability, not an isolated technical component. The article highlights how common initial setups—a single VPC with public/private subnets and a NAT Gateway—become bottlenecks as platforms grow.

Hub-and-Spoke architecture

This pattern separates central connectivity services from application workloads. A central "hub" VPC hosts shared services like VPN/Direct Connect, NAT Gateways, firewalls, and traffic inspection. "Spoke" VPCs contain applications, microservices, and isolated environments. Connectivity between spokes and the hub is typically established using AWS Transit Gateway (TGW) for scale, or VPC Peering for simpler cases. Gaviria recommends Hub-and-Spoke for multi-account architectures, centralized network control, strict security requirements, and hybrid connectivity scenarios.

Full Mesh connectivity

In a Full Mesh pattern, each VPC connects directly to every other VPC using VPC Peering, eliminating a central point of control. This design prioritizes minimal latency between services. Gaviria suggests this pattern for environments with few VPCs and low complexity. The core issue with Full Mesh, as highlighted, is its poor scalability. As the number of VPCs increases, the number of required peering connections grows exponentially, leading to significant operational overhead.

WHAT'S INTERESTING / WHAT'S NOT

Gaviria's emphasis on viewing VPCs as foundational rather than isolated components is a critical, often overlooked, perspective for indie founders. The article directly addresses the common pitfall of starting with a single VPC and encountering scalability issues later. This proactive design thinking is valuable.

The detailed trade-offs for Hub-and-Spoke are particularly insightful. The founder explicitly calls out the base cost of a Transit Gateway, stating that "A Transit Gateway with 10 VPCs attached in us-east-1 has a base cost of ~$219/month just in attachment fees, before processing a single byte." This concrete cost estimate provides immediate value for budgeting. Furthermore, the warning about East-West traffic costs potentially exceeding workload costs is a crucial operational detail. The mention of asymmetric routing when integrating AWS Network Firewall in the hub is a specific, high-impact design flaw that can break production implementations if not considered from the outset. This level of detail moves beyond generic advice.

What's less interesting, or rather, what's not as deeply explored, is the full scope of multi-account strategies. While the article's title mentions "multi-account," the body primarily integrates this concept into the "When to use it" section for Hub-and-Spoke, rather than detailing distinct multi-account patterns or the specific organizational benefits and challenges beyond network isolation. The "Full Mesh" pattern is presented more as an anti-pattern for growth, with its scaling issues clearly articulated but without a deeper exploration of scenarios where its low-latency benefit might genuinely outweigh its complexity for niche use cases.

PRICING

AWS Transit Gateway (TGW) with 10 VPCs attached in us-east-1 has a base cost of approximately $219/month in attachment fees, prior to any data processing. This pricing snapshot is accurate as of 2026-05-19.

VERDICT

For indie founders anticipating significant growth or operating in environments with strict security and compliance needs, the Hub-and-Spoke pattern is the recommended architectural choice. Its centralized control over network ingress/egress and traffic inspection capabilities, while complex, provides a robust foundation for scaling. However, be prepared for the operational overhead and the non-trivial base cost of AWS Transit Gateway, which can start at around $219/month for even a modest setup. The Full Mesh pattern, while offering minimal latency, scales poorly and is only advisable for very small, static environments with limited inter-VPC communication. Do not implement Full Mesh if you expect your application footprint to grow beyond a handful of VPCs; the management burden will quickly become unsustainable.

WHAT WE'D TEST NEXT

Our next steps would involve setting up a Hub-and-Spoke architecture with varying numbers of spoke VPCs and simulating East-West traffic patterns to independently verify the cost implications of Transit Gateway data processing. We would also implement AWS Network Firewall in the hub VPC to test the asymmetric routing claim, specifically measuring its impact on application performance and connection stability. Further testing would explore the operational complexity of managing route tables across a growing number of VPCs and the latency differences between TGW and VPC Peering in real-world application scenarios. We would also investigate specific multi-account strategies and their integration with these network patterns.

Pull quote: “A Transit Gateway with 10 VPCs attached in us-east-1 has a base cost of ~$219/month just in attachment fees, before processing a single byte.”