Hybrid VPN architecture connecting on-premises Gobierno de Canarias infrastructure to a private EKS cluster via AWS Site-to-Site VPN and VPC Interface Endpoints. Traffic flows from the on-prem router through a Virtual Private Gateway into a DMZ Ingress VPC, then via VPC Link to a private API Gateway endpoint that routes requests to Internal ALBs fronting EKS node groups across two availability zones. The design enforces zero-trust principles with WAF protection, resource-based policies limiting API Gateway access to the Ingress VPC, and comprehensive observability through CloudWatch, CloudTrail, and GuardDuty. Fork this diagram to customize CIDR blocks, add additional VPCs, or integrate with your own hybrid network topology. The three-layer architecture (Access, Distribution, Core) provides clear blast radius isolation and simplifies troubleshooting across on-prem and AWS boundaries.