One thing I've noticed having worked with many clients, is that legacy architectures that get moved to AWS start by creating subnets, NACLs, etc. while for almo

One thing I've noticed having worked with many clients, is that legacy architectures that get moved to AWS start by creating subnets, NACLs, etc. while for almost all AWS-first developed applications the Security Group is the smallest unit you tend to address. So a legacy architecture will for instance specify the "frontend servers subnet" (and a unique SG, hopefully!), while a cloud-native architecture will only specify a SG. I think, asking which subnet some machine is in, is kind of like asking which core some process is running on at the moment: any one of the subnets for any one of the availability zones in that region, and the next one will automatically and on purpose be assigned to a different one by the ALB/ASG combination.