Highly Available AWS Architecture
More than one of everything that matters, and a failover somebody has actually performed.
From $849 5–10 days
AWS VPC & Network Architecture
Subnets, routing and security groups laid out so the next person can read them.
Price and scope
From $349
Typically $349–$799, fixed in writing before anything starts.
What moves it up
- Live workloads that have to be re-homed rather than a network built empty
- A VPN or a peering connection to something outside AWS
- More than one account, where routing and DNS have to agree across a boundary
What actually goes wrong
The default VPC is genuinely fine for a first deployment, which is why almost everything ends up staying in it. Then the shape of it starts costing you: every instance has a public IP because that is what a default subnet does, so "is this reachable from the internet" is answered by a security group rather than by routing. Those groups reference raw CIDR blocks instead of each other, so nobody can tell which rule exists for which service, and no one dares delete any of them.
How I find it
aws ec2 describe-vpcs --query 'Vpcs[].[VpcId,IsDefault,CidrBlock]'aws ec2 describe-route-tables — which subnets actually route through an internet gatewayaws ec2 describe-security-groups, read for rules naming a CIDR where a group id belongsaws ec2 describe-subnets --query 'Subnets[].[SubnetId,AvailabilityZone,MapPublicIpOnLaunch]'
What you get
- A VPC with public and private subnets across at least two availability zones
- Routing that decides what is reachable, so a security group is a second line rather than the only one
- Security groups that reference each other by id, readable as "the app may reach the database"
- VPC endpoints where they remove both a NAT charge and a route to the internet
- A network diagram that matches what is deployed, produced from the account rather than from intent
Questions
Can you rebuild the network without moving my servers?
Not entirely. A subnet cannot be re-shaped underneath a running instance, so anything moving between subnets is replaced or restarted in the new one. That is planned per workload and scheduled with you; nothing moves because it happened to be next in a list.
Is the default VPC actually a problem?
It is a problem the day something in it should not be on the internet and only a firewall rule is stopping it. Before that it is a shortcut, and shortcuts are fine until the thing behind them is holding customer data.
Will this reduce my NAT gateway bill?
Often, yes — VPC endpoints for S3 and DynamoDB take that traffic off NAT entirely, and it is usually the largest single line. Whether it is worth it depends on your traffic, which is why the figure comes from your bill rather than from a claim.
How many availability zones do I need?
Two, for anything you would be upset to lose. Three buys very little for most workloads this size and costs real money in cross-zone traffic, so I will not sell you one unless something in your architecture genuinely needs it.
If this is not quite it
EC2 Server Setup & Hardening
A server built the way you would build it on day 400, not day one.
From $199 1–2 days
Want this done?
Tell me what you are running and I will come back with a fixed price and a date. If it turns out you do not need this, I will say that instead.
Prefer to talk? Book a free call ↗ · Or hire me on Upwork ↗ · Typical reply within one business day.
Before you enquire
When I answer
Sunday to Thursday, 09:00–18:00 EET. Outside that I will still look, but I will not promise a time.
No 24/7 desk, and I will not pretend otherwise
One person, one time zone. If round-the-clock cover is what you need, you need a team, and I will say so rather than sell you a plan that cannot deliver it.
Your AWS bill stays yours
You pay Amazon directly and you keep control of the account. Nothing here resells your infrastructure or sits between you and your own billing.
A price that starts with "from" is a starting price
Every service page lists exactly what pushes a quote above it, before you ask. You get a fixed number in writing before any work begins.