Networks
Networks provide private connectivity for your infrastructure. A network creates a VPC in your cloud account with public and private subnets, security groups, and optional NAT and load balancer support.
Why networks matter
Section titled “Why networks matter”Databases and caches run in private subnets and are not accessible from the public internet. Your serverless compute (Lambda or Cloud Run) connects to these resources through VPC attachment. Creating a network is a prerequisite for provisioning databases and caches.
Creating a network
Section titled “Creating a network”Networks are created in the dashboard: go to Infrastructure, Networks and select Create network. The ske CLI has no network commands.
| Field | Description | Default |
|---|---|---|
| Name | Lowercase letters, numbers and hyphens, up to 30 characters | Required |
| Cloud provider | One of the workspace’s connected providers | Required |
| Region | Cloud region for the VPC | Required |
| CIDR block | VPC CIDR block | 10.0.0.0/16 |
| Enable NAT Gateway | Lets private subnets reach the internet for outbound traffic | Off |
| Customize subnets | Your own CIDR blocks for the 2 public and 4 private subnets | /24 blocks of the CIDR block. Public: 10.0.1.0/24 and 10.0.2.0/24. Private: 10.0.11.0/24 to 10.0.14.0/24 on AWS, 10.0.10.0/24 to 10.0.13.0/24 on GCP |
Provisioning runs as a tracked job and takes a few minutes. Follow it on the network’s page or with ske job list.
To use the network, link it to an environment under the environment’s Settings, Resources, then deploy.
Bringing in an existing VPC (AWS)
Section titled “Bringing in an existing VPC (AWS)”Infrastructure, Sync from AWS brings a VPC that already exists in your AWS account into SKE, with the private subnets your functions go in. SKE only records it: the network shows as External, and changes to it are made in AWS.
What gets provisioned
Section titled “What gets provisioned”- VPC with the specified CIDR block
- Public subnets across availability zones
- Private subnets across availability zones
- Internet gateway (for public subnets)
- NAT gateway (if enabled)
- Route tables for public and private subnets
- Security groups for Lambda, databases, and caches
- VPC network
- Subnets in the specified region
- Firewall rules
- Cloud NAT (if enabled)
- Global HTTPS Load Balancer (if enabled, required for custom domains)
- Serverless VPC Access connector for Cloud Run
NAT gateway
Section titled “NAT gateway”By default, resources in private subnets cannot reach the internet. If your application needs to call external APIs from within the VPC, select Enable NAT Gateway when creating the network.
NAT gateways incur additional cost from your cloud provider. Enable them only when needed.
Load balancer (GCP)
Section titled “Load balancer (GCP)”On GCP, custom domains require a Global HTTPS Load Balancer. Open the network’s page and select Enable load balancer under Load balancer. It provisions a static IP, a certificate map and URL routing for your environments, and shows the static IP once active. Disable load balancer removes it.
See Domains for more on custom domains.
Deleting a network
Section titled “Deleting a network”Delete a network from the Networks list. A network can only be deleted once no environment is assigned to it and its databases and caches are removed. You can delete the VPC in your cloud account too, or remove the network from SKE only and keep the VPC. An external network is only removed from SKE; the VPC stays in your AWS account.