Need decisions about how to "house" CIROH members within the VPC.

[ZacharyWills]

So let's say that a VPC has a 100.x.x.x address space,

Ideally each CIROH member could get a LOT of address space within their own block of that 100.x net.

Something like CIROH member #1 gets 100.1.x.x and #2 gets 100.2.x.x

I can add a basic table and ENV to the Terraform that allows the user to pick from a list of Institutions and thus fills those blocks in for them for creation of modeling and experimental space.

@jameshalgren @arpita0911patel Does this sound reasonable?

Users would still have access to others' subnets (which dont stop communications themselves but would mean that if I ran my institution out of address space, I wouldn't run someone else out of address space as well), for limiting access we would need to add Security Groups.

[jameshalgren]

It feels like the ability to know where things are is a benefit here. E.g., BYU is planning to set up an app store. If they know that data coming out of RTI's evaluation systems live in a particular space, that's useful for their app store to connect to.

(In addition to knowing that no-one will stomp on your space.)

Thinking this way, we are talking about 65k IPs per institution. @ZacharyWills, are we capped at 256 institutions or can we go to 101.1.x.x, etc.?

[arpita0911patel]

We can divide the IP ranges based on application type such as web applications (public) or backend services. (private)
 
So e.g. create a VPC with a /16 CIDR block and four subnets: two public subnets with CIDR blocks of 10.0.1.0/24 and 10.0.2.0/24, and two private subnets with CIDR blocks of 10.0.3.0/24 and 10.0.4.0/24.
 
This subnetting scheme provides a good balance between security and accessibility, with the public subnets allowing access to resources from the internet and the private subnets providing an additional layer of security for resources that should not be publicly accessible.

[ZacharyWills]

Thinking this way, we are talking about 65k IPs per institution. @ZacharyWills, are we capped at 256 institutions or can we go to 101.1.x.x, etc.?

We can go further when we need to, there's other space and things we can do to consolidate address space.

Arita has a good overview.

[ZacharyWills]

Next step is to make a "client" TF that allows someone to select their institution and then dole out the subnets etc. based on the response.

[benlee0423]

Separating public and private VPC is good idea.

A couple of questions:

1. Each CIROH member needs to communicate with private cloud network?
2. Each CIROH member shares any common data storage, like S3 or network disk?
3. Each CIROH member will be assigned one VPC, and it can have multiple subnets within the VPC?

There is concept of VPC peering in AWS that connect a VPC with another VPC. From the subject of this issue, not clear to me how VPC is being used?