Segmented AWS VPC architecture isolates ML training workloads across three VLANs: Management (10.0.1.0/24), Research (10.0.2.0/24), and ML Training (10.0.3.0/24). Remote researchers connect via VPN Gateway to a Core Router that distributes traffic through dedicated Distribution Switches to t3.small Dev Instances and SageMaker Training Jobs pulling data from S3. Network Firewall in the DMZ subnet inspects all egress traffic through NAT Gateway and Internet Gateway, enforcing security boundaries between research development and production training workloads. This design demonstrates best practices for multi-tenant ML environments requiring isolation, auditability, and controlled internet access for model training at scale. Fork this diagram on Diagrams.so to customize CIDR blocks, add GPU instance types, or integrate AWS PrivateLink endpoints for S3 access.