Design a VPC architecture for a multi-tier application that needs to be PCI-DSS compliant across 3 AWS regions with active-active failover.
Quick Answer
Use isolated VPCs per region with Transit Gateway for inter-region connectivity, separate subnets for each PCI scope tier, NACLs + security groups for defense in depth, and AWS PrivateLink for service-to-service communication.
Detailed Answer
Architecture
Per-Region VPC Design
- CIDR: Non-overlapping ranges (10.1.0.0/16, 10.2.0.0/16, 10.3.0.0/16) - Public subnet: ALB/NLB only (no direct internet access for apps) - App subnet (private): ECS/EKS workloads, NAT Gateway for outbound - Data subnet (isolated): RDS, ElastiCache — no internet route, no NAT - Management subnet: Bastion hosts, CI/CD agents, monitoring
PCI-DSS Requirements
- Network segmentation: Cardholder Data Environment (CDE) in isolated subnets with strict NACLs - Encryption in transit: TLS 1.2+ everywhere, mTLS between services - Flow logs: VPC Flow Logs to S3 + CloudWatch, retained for 12 months - WAF: AWS WAF on ALB with OWASP top 10 rules - No public IPs on any compute resource in CDE - PrivateLink: Access AWS services (S3, SQS, KMS) via VPC endpoints — no internet path
Multi-Region Active-Active
- Transit Gateway with inter-region peering for VPC-to-VPC routing - Route 53 latency-based routing with health checks for failover - Aurora Global Database for cross-region read replicas with <1s replication lag - DynamoDB Global Tables for multi-region active-active state - S3 Cross-Region Replication for static assets and backups
Security Layers
1. Route 53 → AWS Shield + WAF 2. ALB → Security Groups (allow only 443) 3. App tier → NACLs + SGs (allow only from ALB SG) 4. Data tier → NACLs + SGs (allow only from App SG, specific ports) 5. All tiers → VPC Flow Logs, GuardDuty, CloudTrail
Code Example
# Terraform VPC module for PCI-compliant architecture
module "vpc" {
source = "./modules/pci-vpc"
cidr_block = "10.1.0.0/16"
azs = ["us-east-1a", "us-east-1b", "us-east-1c"]
public_subnets = ["10.1.1.0/24", "10.1.2.0/24", "10.1.3.0/24"]
app_subnets = ["10.1.11.0/24", "10.1.12.0/24", "10.1.13.0/24"]
data_subnets = ["10.1.21.0/24", "10.1.22.0/24", "10.1.23.0/24"]
enable_flow_logs = true
flow_log_retention = 365 # PCI requires 12 months
enable_vpc_endpoints = ["s3", "dynamodb", "kms", "logs", "ecr.api"]
}Interview Tip
For compliance-focused design questions, lead with the regulatory requirements (PCI-DSS scoping, encryption, logging retention) and show how the architecture satisfies each one. Interviewers want to see you think about security as a first-class concern, not an afterthought.