Multi-AZ VPC architecture spanning us-east-1a and us-east-1b with public and private subnets, NAT Gateways, and VPN connectivity via Virtual Private Gateway. Internet Gateway routes inbound traffic to Bastion hosts in public subnets, while NAT Gateways enable outbound internet access for application servers in private subnets. Virtual Private Gateway establishes secure site-to-site VPN from corporate users through Customer Gateway, allowing direct private access to application tier without internet exposure. This design eliminates single points of failure, enforces network segmentation, and provides cost-optimized egress through redundant NAT Gateways across availability zones. Fork and customize this diagram on Diagrams.so to match your CIDR ranges, add additional subnets, or integrate AWS Systems Manager Session Manager for bastion-less access.