One private subnet in each Availability Zone
One NAT Gateway in each Availability Zone. Each private subnet routes internet-bound traffic to the NAT Gateway in the same Available Zone.
Direct Connect connectivity to private and public campus networks, and to private Cornell VNets in Azure
Connectivity to all Cornell Standard VPCs in AWS, without leaving the us-east-1 AWS Region.
Gateway endpoints for S3 and Dynamo DB reside in the VPC making VPC communication with those services quick and private.
- If you have need for other AWS service endpoints deployed to the Shared VPC, please contact Cloud Support.
A slightly modified version of the Baseline AWS Network ACL is applied to all private subnets. The single change is that the inbound rule allowing traffic to port 22 from the internet is removed. (Inbound traffic on port 22 is still allowed from Cornell private and public networks.)

Info
These features are being considered for future capability offerings.

Indirect access to shared public subnets, allowing only deployment of Application or Network Load Balancers routing to targets in private subnets.
Direct access to shared public subnets for deploying arbitrary resources that can be made public.

Benefits of Using the Shared VPC

...

Use Security Groups applied to resources deployed in the Shared VPC to restrict ingress to those resources, even by traffic from the local VPC and subnets. You don't want to be affected by something dumb another team does when they are using the Shared VPC.
When deploying replicas of a specific resource, be sure to spread them out across multiple subnets (and thus multiple AZs).
Be especially careful about configuring resources that automatically scale up (e.g., EC2 Auto Scaling Groups).
If you are managing Elastic Network Interfaces directly, be sure to delete them once they are no longer needed.

Roadmap

Info
These features are being considered for future capability offerings.

Indirect access to shared public subnets, allowing only deployment of Application or Network Load Balancers routing to targets in private subnets.
Direct access to shared public subnets for deploying arbitrary resources that can be made public.