​
Overview

The Network Designer draws your VPC as a diagram and lets you build in it. It’s not a read-only picture — you can create resources, apply a firewall policy by dragging a connection, and edit or delete components from a side panel.
Navigation: Networking → VPC → open a VPC → Network Designer.

​
What it draws

Nodes are laid out in rows by role: gateways at the top, policies beneath, then networks and addresses, then routing.

​
What you can do

Node positions are not saved. They persist while you’re on the canvas and across a data refresh, but they’re lost when you leave the section — nothing is stored server-side. A layout you arrange carefully will be back to the automatic arrangement next visit.

​
Drawing a connection

Only one connection is meaningful: network → firewall policy, which applies that policy to that network. Anything else is refused with “Connection not supported” / “Only applying a Firewall Policy to a network is supported.”
This is the designer’s best feature. Reassigning a policy across several tiers is a couple of drags here, where doing it through the Networks section means opening a dialog per network.
Applying a policy replaces the network’s current one, and firewall policies are shared — the same policy applied to three networks governs all three, and editing its rules changes all three. See Firewall Policies.

​
The node panel

Clicking a node opens a panel with its fields and its actions.
System default policies are protected in two places: attempting an action reports “System default policies are read-only”, and attempting a deletion reports “System default policies cannot be deleted”.
Deleting a network that still has machines warns with the count: “This network has VM(s) attached. Deleting it may disrupt them. Continue?” Take that seriously — it’s the only warning, and the machines lose connectivity.

​
Designer versus the sections

Both build the same resources; they suit different jobs.
The designer is the fastest way to review an unfamiliar VPC. Missing links are visually obvious in a way a list of tiers never is — a network with no policy attached, or a public IP connected to nothing, jumps out.

​
Worked example: reviewing a VPC you inherited

1

Open the designer first, before the lists

It gives you the shape of the thing in one screen — how many tiers, what’s public, what gateways exist.
2

Look for networks with no policy attached

A network with no connection to a firewall policy is running on a system default. Check whether that’s deliberate.
3

Check which tiers share a policy

Two networks connected to the same policy node have identical rules. That’s often unintentional — a database tier sharing the web tier’s policy is a real exposure.
4

Look at the public IPs

Each one is an inbound path. Click through to see whether it’s Source NAT (outbound, expected) or Static NAT to a machine (inbound, worth verifying).
5

Note the gateways

A private gateway or VPN gateway means traffic reaches this VPC from somewhere else. Follow up in VPN Connections.
6

Record what you found in Comments

The VPC’s Comments section is the right place for it — the next person gets your review instead of repeating it.

​
Empty and error states

There’s no export from the designer — no PNG, no saved layout. If you need the topology in a document, screenshot it. An export control exists in an older, unreachable version of this screen, so you may see it referenced elsewhere; it isn’t available.

Networks

The same tiers, in list form.

Firewall Policies

The rules behind a policy node.

VPC

Creating a VPC and its networks.

Static Routes

What the route table node contains.