Networking

Eliminators (Hard Blockers)

Signals (Decision Criteria)

VPC Network

• Always → AWS VPC (1:1 deterministic)
• Preserve CIDR blocks, subnets, routing tables

Firewall Rules

• Always → AWS Security Groups (1:1 deterministic)
• Convert direction (ingress/egress) and IP ranges

Cloud Load Balancing

• HTTP/HTTPS + hostname/path routing → ALB (Layer 7)
• TCP/UDP + high throughput → NLB (Layer 4)
• TLS passthrough → NLB (Layer 4, no termination)
• For internet-facing ALB: terminate TLS on 443 and configure 80 as redirect-only to HTTPS (no direct HTTP forwarding).

Cloud DNS

• Always → Route 53 (1:1 deterministic)
• Preserve zone name, record types, TTLs

Cloud Interconnect

• Dedicated connection → AWS Direct Connect
• Temporary/dev connectivity → AWS Site-to-Site VPN (quicker, lower cost)

Cloud Armor

• DDoS protection + WAF rules → AWS WAF + AWS Shield Standard (Shield Standard is automatic, no extra cost)
• Rate limiting → AWS WAF rate-based rules
• Bot management → AWS WAF Bot Control
• IP allowlist/denylist → AWS WAF IP set rules

6-Criteria Rubric

Apply in order:

1. Eliminators: Does GCP config require AWS-unsupported features? If yes: switch
2. Operational Model: Managed (ALB, Route 53) vs Custom (VPN, custom routing)?
   • Prefer managed
3. User Preference: From preferences.json: design_constraints.compliance?
   • PCI or HIPAA: Neither framework mandates Direct Connect. Bias toward documented private connectivity between sites and AWS (e.g. AWS Direct Connect or Site-to-Site VPN with encryption, monitoring, and change control) — choose with your QSA / BAA / security team; many compliant designs use VPN-only or no hybrid link when all workloads stay in AWS.
   • FedRAMP: GovCloud and federal boundary requirements dominate; private connectivity is often part of the approved architecture — still confirm with your authorizing official / security team, not this advisor alone.
   • If compliance includes "ccpa" (CCPA / CPRA) → VPN or Direct Connect both acceptable; prioritize documented data paths, retention controls, and logging for consumer privacy workflows — not a forced Direct Connect gate.
   • If none of the above: VPN or public-internet paths are commonly acceptable when encrypted and documented.
4. Feature Parity: Does GCP config require AWS-unsupported features?
   • Example: GCP policy-based routing → Custom route table rules (AWS does this)
5. Cluster Context: Are other resources in cluster using specific load balancers? Match
6. Simplicity: Fewer resources = higher score

Examples

Example 1: VPC Network

• GCP: google_compute_network (auto_create_subnetworks=false, routing_mode=REGIONAL)
• Signals: Explicit subnets, regional routing
• Criterion 1 (Eliminators): PASS
• → AWS: VPC (us-east-1 region)
• Confidence: deterministic

Example 2: Firewall Rules

• GCP: google_compute_firewall (allow=[tcp:443], source_ranges=[0.0.0.0/0])
• Signals: HTTPS ingress, public
• → AWS: Security Group (ingress rule: 443/tcp from 0.0.0.0/0)
• Confidence: deterministic

Example 3: Cloud Load Balancing (HTTP + path-based)

• GCP: google_compute_forwarding_rule + google_compute_backend_service (path_matcher=[“/api/*” → api-backend])
• Signals: Path-based routing, HTTP/HTTPS
• Criterion 1 (Eliminators): PASS
• Criterion 2 (Operational Model): ALB (managed, L7)
• → AWS: ALB with target groups + listener rules (path-based)
• Confidence: inferred

Example 4: Cloud DNS Zone

• GCP: google_dns_managed_zone (dns_name=”example.com.”)
• Signals: Public DNS zone
• → AWS: Route 53 Hosted Zone (example.com)
• Confidence: deterministic

Output Schema