Common Cloud Networking Mistakes

The mistakes that show up again and again

A handful of errors account for most networking pain. Overlapping CIDRs block future peering and VPNs, and fixing them means rebuilding. Undersized subnets run out of IPs once containers, load balancers or serverless functions arrive. Single-AZ dependencies, such as one NAT gateway or one VPN tunnel, quietly turn a multi-AZ design into a single point of failure. Stateless NACL rules without ephemeral port ranges cause mysterious timeouts. Missing return routes across peering or transit make traffic work in one direction only. Over-broad rules like 0.0.0.0/0 on admin ports or database ports invite attacks. Manual changes outside IaC drift from the code and get overwritten on the next apply. Treating peering as transitive leads to designs that cannot work. Almost every one of these can be caught in design review or with automated policy checks on IaC before deployment, which is far cheaper than discovering them in production.

Write the review checklist down

Turn this list into a pull-request checklist or an automated policy (for example, a rule that fails the build if a security group opens port 22 or 3389 to 0.0.0.0/0). Humans forget; pipelines do not.

Building on a narrow plot

Building a house on a plot with no room to extend is cheap today and very expensive when the family grows. An undersized subnet or overlapping CIDR is the same: harmless on day one, painful when you need to grow.

Quick check: A team's three-AZ application loses all outbound internet access when one AZ fails. What is the likely cause?

• The internet gateway is zonal
• Security groups are stateful
• All private subnets route through one NAT gateway in the failed AZ
• VPC peering is non-transitive