Networks

Networks provide private connectivity for your infrastructure. A network creates a VPC in your cloud account with public and private subnets, security groups, and optional NAT and load balancer support.

Why networks matter

Databases and caches run in private subnets and are not accessible from the public internet. Your serverless compute (Lambda or Cloud Run) connects to these resources through VPC attachment. Creating a network is a prerequisite for provisioning databases and caches.

Creating a network

ske network:create \
  --name my-network \
  --provider aws \
  --region us-east-1 \
  --cidr 10.0.0.0/16

✓ Network creation started (job #14)
⠋ Provisioning VPC...

Configuration options

Option	Description	Default
--name	Network identifier	Required
--provider	Cloud provider (aws or gcp)	Required
--region	Cloud region	Provider default
--cidr	VPC CIDR block	10.0.0.0/16
--enable-nat	Create a NAT gateway for outbound internet from private subnets	false
--enable-lb	Create a load balancer (required for GCP custom domains)	false

What gets provisioned

AWS

• VPC with the specified CIDR block
• Public subnets across availability zones
• Private subnets across availability zones
• Internet gateway (for public subnets)
• NAT gateway (if --enable-nat)
• Route tables for public and private subnets
• Security groups for Lambda, databases, and caches

GCP

• VPC network
• Subnets in the specified region
• Firewall rules
• Cloud NAT (if --enable-nat)
• Global HTTPS Load Balancer (if --enable-lb, required for custom domains)
• Serverless VPC Access connector for Cloud Run

NAT gateway

By default, resources in private subnets cannot reach the internet. If your application needs to call external APIs from within the VPC, enable NAT:

ske network:create \
  --name my-network \
  --provider aws \
  --region us-east-1 \
  --enable-nat

NAT gateways incur additional cost from your cloud provider. Enable them only when needed.

Load balancer (GCP)

On GCP, custom domains require a Global HTTPS Load Balancer. If you plan to use custom domains on GCP, create the network with --enable-lb:

ske network:create \
  --name my-network \
  --provider gcp \
  --region us-central1 \
  --enable-lb

See Domains for more on custom domains.

Managing networks

# List networks
ske network:list

# Show network details
ske network:show my-network

# Delete a network
ske network:delete my-network

A network can only be deleted after all databases and caches attached to it are removed.