Project · Interactive
NerdWallet AWS Networking Platform
Designed and built the Transit Gateway and IPAM foundation every NerdWallet team uses to ship.
- 3 regions (us-east-1, us-east-2, us-west-2)
- Days → hours for account onboarding
- Owned 99% of iac-networking
Scroll to explore ↓
The problem
VPC peering doesn't scale.
Every account needs to reach every other account. With VPC peering, that means a manual connection for each pair. Add a new account and the number of connections grows quadratically, not linearly.
Formula: N × (N − 1) / 2. 12 VPCs already means 66 manual connections.
The solution
One hub. Clean spokes.
Replace the peering mesh with a Transit Gateway acting as a central router. Every VPC attaches to the hub. Routing is controlled in one place. Adding a new account means one connection, not N.
Formula: N. Each VPC: one attachment. Adding the 50th account is no harder than the 2nd.
The foundation
IPAM-driven IP management.
AWS IPAM allocates CIDR blocks automatically. A pool hierarchy organized by environment, region, and purpose means every new VPC draws from the right pool. No more manual planning. No more overlaps.
Click a pool to expand.
The experience
Self-service, not tickets.
Any engineering team can provision its own account and VPC. Two pull requests, a Terraform plan, and the infrastructure is live. Hours of work, not a week of back-and-forth with the networking team.
- 1
PR 1 — Account created
A new AWS account materializes. IAM roles, an OIDC identity for GitHub Actions, DynamoDB lock table, and S3 state bucket are all provisioned automatically.
- 2
PR 2 — VPC provisioned
A standardized 3-AZ VPC comes online, draws its CIDR from the right IPAM pool, attaches to the Transit Gateway, and wires up Route 53 Resolver for cross-account DNS.
- 3
SSO — Team has access
Engineers access the account through SSO. No networking tickets. No waiting on the infrastructure team. The account is ready to use.
Hours later, not days. A team can be shipping infrastructure on its own before the end of the week.
What I actually built.
Replaced a VPC peering mesh with a Transit Gateway hub across three regions. Set up AWS IPAM with a pool hierarchy by environment and region, plus separate pools for Kubernetes pod networks so clusters wouldn't exhaust VPC IP space.
Built the self-service workflow that lets any engineering team provision its own account, attach to the Transit Gateway automatically, and manage its infrastructure with Terraform and GitHub Actions. Integrated cross-account DNS so services across hundreds of AWS accounts reach each other by hostname without manual Route 53 configuration.
Authored the canonical internal guide that every engineer uses to create a VPC today. Owned 99% of the iac-networking Terraform repo that powers all of it.