Multi-availability zone AWS architecture spanning eu-west-2 with hybrid on-premises connectivity via Direct Connect and NatWest DC integration. The design layers routable subnets (10.59.0.0/24) for bastion and NAT access with non-routable subnets (100.100.0.0/16) hosting EKS clusters, Vector databases, and AI microservices across three availability zones. API Gateway, Route 53, and ACM provide edge security and DNS, while CloudWatch, CloudTrail, and KMS enforce observability and encryption across the infrastructure. This architecture demonstrates enterprise-grade network segmentation, compliance-ready logging, and scalable Kubernetes workload isolation for AI-driven applications. Fork this diagram on Diagrams.so to customize subnets, add additional AWS services, or adapt the hybrid connectivity model for your organization.