https://www.dggcloud.com/en/Recent content on Cloud ArchitectureHugoen-USWed, 30 Sep 2026 00:00:00 +0000https://www.dggcloud.com/en/posts/hub-and-spoke-multicloud/Wed, 30 Sep 2026 00:00:00 +0000https://www.dggcloud.com/en/posts/hub-and-spoke-multicloud/<p>Hub-and-spoke is the backbone of almost every landing zone: a central transit point that connects workload networks, on-premises connectivity and traffic inspection. All three providers offer a managed service for it, but their routing models differ.</p> <h2 id="the-common-pattern">The common pattern <a class="anchor" href="#the-common-pattern" aria-hidden="true" tabindex="-1">#</a></h2> <pre class="mermaid">flowchart LR OnPrem[On-premises] --- Hub Hub[Transit hub] --- A[Production spoke] Hub --- B[Non-production spoke] Hub --- C[Shared services spoke] Hub --- FW[Inspection / NVA]</pre> <h2 id="quick-comparison">Quick comparison <a class="anchor" href="#quick-comparison" aria-hidden="true" tabindex="-1">#</a></h2> <table> <thead> <tr> <th>Aspect</th> <th>AWS</th> <th>Azure</th> <th>GCP</th> </tr> </thead> <tbody> <tr> <td>Service</td> <td>Transit Gateway</td> <td>Virtual WAN (hub)</td> <td>Network Connectivity Center</td> </tr> <tr> <td>Scope</td> <td>Regional (inter-region peering)</td> <td>Regional hub, managed mesh between hubs</td> <td>Global hub</td> </tr> <tr> <td>Segmentation</td> <td>TGW route tables</td> <td>Virtual hub route tables</td> <td>Spoke groups and export filters</td> </tr> <tr> <td>Hybrid connectivity</td> <td>Direct Connect, VPN</td> <td>ExpressRoute, VPN</td> <td>Interconnect, HA VPN</td> </tr> </tbody> </table> <h2 id="creating-it-from-the-cli">Creating it from the CLI <a class="anchor" href="#creating-it-from-the-cli" aria-hidden="true" tabindex="-1">#</a></h2> <h3 id="aws">AWS <a class="anchor" href="#aws" aria-hidden="true" tabindex="-1">#</a></h3> <p>Disabling default association and propagation forces you to design route tables explicitly, which is what you want when segmenting environments.</p>https://www.dggcloud.com/en/posts/private-access-managed-services/Wed, 23 Sep 2026 00:00:00 +0000https://www.dggcloud.com/en/posts/private-access-managed-services/<p>Reaching a managed service (a secrets manager, a key vault or the provider&rsquo;s own APIs) without traversing the Internet is a common requirement in regulated environments. All three providers solve it with a private IP inside your network that fronts the service.</p>https://www.dggcloud.com/en/about/Mon, 01 Jan 0001 00:00:00 +0000https://www.dggcloud.com/en/about/<p>I&rsquo;m a platform engineer working daily with infrastructure on AWS, Azure and Google Cloud: hybrid networking, landing zones, identity and migrations.</p> <p>This blog covers the architecture decisions behind each deployment: what I chose, what I ruled out, and why. Most examples use each provider&rsquo;s CLI and link to the official documentation.</p>