The components of the BPE solution are separated into the following component layers. The Public layer will have a direct connection to the internet via the AWS Internet Gateway and will house highly available NAT Gateways for egress internet traffic and the management Bastion host. The Private-1 layer will house the Interactive Client, Application Server and Runtime Resources instances, which do not require indirect internet access via the NAT Gateways for tasks such as downloading updates, patches and software. The Private-2 layer will house the database server. Only connections originating from the Private-1 subnet and the corporate network are allowed to access the database layer.

The BPE platform will be implemented into an AWS environment as a separate VPC. The AWS VPC environment is designed with BPE as the exclusive application. The BPE VPC design incorporates Private Subnets which will not have direct access to the internet, Public Subnets with internet access via an AWS Internet Gateway attached to the VPC or via a 3rd party marketplace solution, VPC Endpoint to enable a private connection to some AWS regional services such as S3, and Network Address Translation to enable instances in the private subnet to initiate outbound traffic to the Internet or other AWS services, but prevent the instances from receiving inbound traffic initiated by someone on the Internet.

To secure the BPE distributed application components and isolate the data from the public facing zone, AWS isolation is achieved via the implementation of AWS security best practices, including but not limited to Security Groups and Network access control lists.

Each subnet in the VPC is associated with a route table, which controls the routing for the subnet is implicitly associated with the main route table. A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same subnet route table.