Networking

• VPC with /16 CIDR
• 3 public subnets (ALB, NAT)
• 3 private subnets (EKS, RDS, MSK)
• Security groups: least privilege
• NACLs for subnet-level filtering
• VPC endpoints for AWS services