Cloud Networking & VPC Design

Help me design a cloud networking and VPC architecture with these requirements:

Cloud Provider: [AWS/GCP/AZURE]
Number of Environments: [DEV/STAGING/PROD/OTHER]
On-Premises Connectivity: [YES WITH DETAILS/NO]
Multi-Region Requirements: [SINGLE REGION/MULTI-REGION]
Compliance Constraints: [DATA RESIDENCY/NETWORK ISOLATION REQUIREMENTS]
Expected Workload Types: [WEB APPS/MICROSERVICES/DATABASES/ML]

Design the network architecture across these six components:

1. VPC and Account Structure
- Design VPC topology including hub-and-spoke, shared VPC, or standalone models. Plan IP address allocation using RFC 1918 ranges with growth capacity and avoiding overlaps with on-premises networks. Define account or project structure with network segmentation per environment. Design subnet strategy with public, private, and isolated tiers across availability zones. Plan CIDR block sizing based on expected workload density and growth projections. Document IP address management procedures and allocation tracking.

2. Subnet Architecture and Routing
- Define subnet tiers including public subnets for load balancers, private subnets for application compute, and isolated subnets for databases. Design route table configurations for each subnet tier. Plan NAT Gateway or NAT Instance placement for outbound internet access from private subnets. Configure VPC endpoints or Private Link for AWS service access without internet traversal. Design routing for multi-VPC communication using Transit Gateway, VPC Peering, or PrivateLink. Implement route propagation from VPN or Direct Connect gateways.

3. Connectivity and Hybrid Networking
- Design Direct Connect or ExpressRoute architecture for on-premises connectivity with redundancy. Plan site-to-site VPN as backup or primary connectivity. Configure Transit Gateway for centralized multi-VPC and multi-account routing. Design inter-region connectivity using Transit Gateway peering or cloud backbone. Plan for third-party SaaS connectivity using PrivateLink or partner integrations. Address bandwidth requirements, latency targets, and failover scenarios. Document connection redundancy and failover testing procedures.

4. Security and Traffic Control
- Design security group strategy with layered rules following defense in depth principles. Configure network ACLs as a secondary control for subnet-level filtering. Implement AWS Network Firewall, Cloud Firewall, or Azure Firewall for centralized traffic inspection. Plan WAF deployment for web application protection at the edge. Design micro-segmentation using security groups and network policies. Implement traffic mirroring for security analysis and forensics. Configure VPC Flow Logs with appropriate retention and analysis tools.

5. DNS and Service Discovery
- Design Route 53, Cloud DNS, or Azure DNS architecture for public and private zones. Configure split-horizon DNS for internal versus external resolution. Implement private hosted zones for VPC-internal service discovery. Design DNS forwarding rules for hybrid resolution between cloud and on-premises. Plan for DNS-based traffic management using latency routing, geolocation, and failover. Configure health checks for DNS failover automation. Address DNS caching, TTL strategy, and propagation considerations.

6. Load Balancing and Traffic Management
- Design Application Load Balancer, Network Load Balancer, and Gateway Load Balancer placement. Configure target groups and health check parameters for reliable traffic distribution. Implement Global Accelerator or Cloud CDN for global traffic optimization. Design cross-region load balancing for multi-region deployments. Plan SSL and TLS termination strategy at load balancer versus backend. Configure connection draining, sticky sessions, and rate limiting as needed. Address WebSocket, gRPC, and other protocol-specific requirements.

For each component provide a network diagram in text form, CIDR allocations, specific service configurations, security considerations, cost implications, and operational procedures for common network changes.