4) Cloud Networking

# AWS — VPC public/privé avec NATGW (extraits)
aws ec2 create-vpc --cidr-block 10.10.0.0/16
aws ec2 create-subnet --vpc-id vpc-xxx --cidr-block 10.10.1.0/24 --availability-zone a
aws ec2 create-subnet --vpc-id vpc-xxx --cidr-block 10.10.2.0/24 --availability-zone b
aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway --vpc-id vpc-xxx --internet-gateway-id igw-xxx
# NAT Gateway
aws ec2 allocate-address
aws ec2 create-nat-gateway --subnet-id subnet-public --allocation-id eipalloc-xxx
# Routes
aws ec2 create-route-table --vpc-id vpc-xxx
aws ec2 create-route --route-table-id rtb-public --destination-cidr-block 0.0.0.0/0 --gateway-id igw-xxx
aws ec2 create-route --route-table-id rtb-private --destination-cidr-block 0.0.0.0/0 --nat-gateway-id nat-xxx

# Azure — VNet + Subnets + NSG (extraits)
az network vnet create -g rg-net -n vnet-prod --address-prefix 10.20.0.0/16
az network vnet subnet create -g rg-net --vnet-name vnet-prod -n snet-public --address-prefixes 10.20.1.0/24
az network vnet subnet create -g rg-net --vnet-name vnet-prod -n snet-private --address-prefixes 10.20.2.0/24
az network nsg create -g rg-net -n nsg-web
az network nsg rule create -g rg-net --nsg-name nsg-web -n AllowHTTP --priority 100 \
  --access Allow --protocol Tcp --direction Inbound --destination-port-ranges 80

# GCP — VPC custom mode + subnets
gcloud compute networks create vpc-prod --subnet-mode=custom
gcloud compute networks subnets create prod-eu1 --network=vpc-prod --range=10.30.1.0/24 --region=europe-west1
# Firewall rules (équivalent SG)
gcloud compute firewall-rules create allow-http --network vpc-prod --allow tcp:80 --direction=INGRESS

# AWS — VPC peering
aws ec2 create-vpc-peering-connection --vpc-id vpc-a --peer-vpc-id vpc-b
aws ec2 accept-vpc-peering-connection --vpc-peering-connection-id pcx-xxx
# Propager routes
aws ec2 create-route --route-table-id rtb-a --destination-cidr-block 10.20.0.0/16 --vpc-peering-connection-id pcx-xxx

# Azure VNet peering
az network vnet peering create -g rg -n peeringAB --vnet-name vnetA --remote-vnet vnetB --allow-vnet-access
# GCP VPC peering
gcloud compute networks peerings create a-to-b --network=vpc-a --peer-network=vpc-b

• Shared VPC (GCP) : projets « service » consomment sous-réseaux d’un projet « hôte ».
• VPC Endpoints (AWS) pour S3/DynamoDB/privés; évite NAT/egress.

• Coûts data-transfer **inter-AZ/région**; surveiller métriques sur peering.
• VPC Flow Logs par interface; Reachability Analyzer (AWS) pour path.

# AWS Transit Gateway (extraits)
aws ec2 create-transit-gateway --description "Core TGW"
aws ec2 create-transit-gateway-vpc-attachment --transit-gateway-id tgw-xxx --vpc-id vpc-a --subnet-ids subnet-1 subnet-2
# Tables de routes TGW (isolation par domaine)
aws ec2 create-transit-gateway-route-table --transit-gateway-id tgw-xxx

# Azure vWAN/Hub (extrait)
az network vwan create -g rg -n vwan-core
az network vhub create -g rg --name hub-eu --address-prefix 10.255.0.0/23 --vwan vwan-core --location westeurope

# GCP — Cloud Router + HA VPN
gcloud compute routers create cr-eu --network vpc-prod --asn 65010 --region europe-west1
gcloud compute vpn-tunnels create ha-tunnel \
  --peer-address=X.X.X.X --router=cr-eu --ike-version=2 --shared-secret=... --region=europe-west1

• Modèle « inspection VPC » avec **Gateway Load Balancer** (AWS) pour FW virtuels.
• Azure Firewall Manager / GCP FW rules centralisées; hairpin/egress design.

# Exemple strongSwan + BGP (FRR) côté on-prem
# IPsec fixe, BGP pour routes dynamiques
vtysh -c "conf t" -c "router bgp 65000" -c "neighbor 169.254.1.1 remote-as 64512" \
      -c "address-family ipv4 unicast" -c "network 10.0.0.0/16"

# AWS Direct Connect — création VIF privé (extrait CLI)
aws dx create-private-virtual-interface --connection-id dxcon-xxx --new-private-virtual-interface-location region \
 --new-private-virtual-interface-asn 65010 --vlan 101 --address-family ipv4

• Clamp MSS pour encapsulations (WireGuard/OpenVPN/IPsec GRE).
• Deux tunnels/liaisons **multi-AZ**; tests de bascule réguliers.

# AWS — ALB (extraits)
aws elbv2 create-load-balancer --name alb-web --subnets subnet-a subnet-b --security-groups sg-web
aws elbv2 create-target-group --name tg-web --protocol HTTP --port 80 --vpc-id vpc-xxx
aws elbv2 register-targets --target-group-arn arn:... --targets Id=i-xxx Id=i-yyy

# Azure — Application Gateway (extrait)
az network application-gateway create -g rg -n appgw --vnet-name vnet --subnet snet-appgw --capacity 2 --sku Standard_v2

# GCP — HTTP(S) Global LB (extrait)
gcloud compute backend-services create be-web --global --health-checks hc-http
gcloud compute url-maps create web-map --default-service be-web
gcloud compute target-http-proxies create web-proxy --url-map web-map

• Checks courts mais prudents; **cross-zone** activé; session stickiness si nécessaire.
• Prévoir limites **SNAT ports** sur NLB/ILB lors de gros volumes egress.

# AWS — Interface Endpoint (ex: SSM)
aws ec2 create-vpc-endpoint --vpc-id vpc-xxx --vpc-endpoint-type Interface \
  --service-name com.amazonaws.eu-west-1.ssm --subnet-ids subnet-a subnet-b --security-group-ids sg-ep

# GCP Private Service Connect — endpoint consommateur (extrait)
gcloud compute forwarding-rules create psc-endpoint --network vpc --subnet snet \
  --address x.x.x.x --target-service-attachment projects/svcproj/regions/xx/serviceAttachments/sa-name --region xx

# Azure Private Endpoint (extrait)
az network private-endpoint create -g rg -n pe-storage --vnet-name vnet --subnet snet \
  --private-connection-resource-id /subscriptions/.../storageAccounts/mystorage --group-ids blob

• Bloquer egress Internet par défaut; autoriser endpoints/PL/PSC; proxy NAT géré.
• DNS privé pointant vers endpoints; éviter sorties via NATGW coûteuses.

# Route53 — resolver inbound/outbound (extraits)
aws route53resolver create-resolver-endpoint --name inbound --direction INBOUND --ip-addresses SubnetId=subnet-a,Ip=10.10.1.10
aws route53resolver create-resolver-rule --rule-type FORWARD --domain-name corp.local --target-ips Ip=10.0.0.10

# Azure — Private DNS + link
az network private-dns zone create -g rg -n corp.local
az network private-dns link vnet create -g rg -n link1 -z corp.local -v vnet-prod -e true

# GCP — DNS policy & forwarding
gcloud dns policies create corp-fwd --networks=vpc-prod --target-name-servers=10.0.0.10 --alternative-name-server-config-enable-logs

# AWS Reachability Analyzer
aws ec2 create-network-insights-path --source i-xxx --destination alb-arn --protocol tcp --destination-port 443

# Packet mirroring (GCP)
gcloud compute packet-mirrorings create pm1 --network vpc-prod --collector-ilb COLLECTOR \
  --mirrored-subnets prod-eu1 --region europe-west1

• Exporter logs vers SIEM (parquet/object storage) + règles d’alerting (p.ex. ports scannés, drops anormaux).
• Surveiller **data transfer** inter-AZ/région; tagger pour showback/chargeback.

• Activer **cross-zone**; répartir subnets multi-AZ; choisir **instance families** avec meilleures NIC.
• Éviter hairpin inutile; privilégier endpoints privés.

• Data transfer inter-AZ/région; NATGW facturé par heure + Go; LB par NHE/LCU.
• Optimiser DNS/PrivateLink/PSC pour limiter egress Internet.

# AWS Organizations — SCP (exemple JSON)
{
 "Version":"2012-10-17",
 "Statement":[{"Effect":"Deny","Action":"ec2:CreateInternetGateway","Resource":"*","Condition":{"StringNotEquals":{"aws:PrincipalOrgID":"o-XXXX"}}}]
}
# Azure Policy — deny public IP à la création (extrait)
{
 "policyRule":{"if":{"field":"Microsoft.Network/publicIPAddresses/publicIPAllocationMethod","exists": "true"},
 "then":{"effect":"Deny"}}
}

• Tags: env, app, owner, cost-center; vues **FinOps** par tag.
• Budget/alerts; showback par projet/équipe; dashboards coûts réseau.