Walk me through how you would design a VPC for a production workload.

Pick a CIDR block big enough to grow that does not overlap anything you might peer with later, then split it across at least three availability zones. Use public subnets only for load balancers and NAT, private subnets for compute, and isolated subnets with no outbound route for databases. Control traffic with security groups referencing each other rather than IP ranges, and turn on flow logs from day one.

I start with addressing, because that is the decision you cannot undo cheaply. I pick a block with plenty of headroom and I check it against every other network we might one day peer with or connect back to the office, since overlapping ranges are what turn a simple connection into a months long renumbering project. Then three availability zones, and a subnet per tier per zone. Public subnets hold only the load balancer and NAT gateways. Private subnets hold the application, which reaches the internet outbound through NAT. Databases sit in isolated subnets with no route out at all. For control, I lean on security groups referencing other security groups rather than CIDR ranges, so the rule reads as the app tier may reach the database on the database port, and it stays correct when instances change. Network ACLs I keep coarse, mainly as a blunt block. Flow logs go on immediately, because the day you need to prove what talked to what you cannot retroactively enable them. I also add gateway endpoints for object storage, which keeps that traffic off NAT.