2 VPC Networks (Web + DB) 2 Subnets with non-overlapping CIDRs VPC Peering (bidirectional) Cloud NAT for DB VPC outbound traffic 7 Firewall Rules (SSH via IAP, HTTP, MySQL internal, etc.) ...