Unit 2.1: Core Architectural Components

Introduction

Think of building a data center from scratch. You would need to provision servers, set up networks, configure storage, secure everything with firewalls, and manage it all from a single control plane. Now imagine doing that entirely in software, where you can create, modify, and delete infrastructure in minutes instead of months. That is exactly what a Virtual Data Center (VDC) gives you on IONOS Cloud.

In this unit, you will learn about the foundational architectural components that make up IONOS Cloud. You will discover how VDCs serve as logical containers for all your cloud resources, how regions and availability zones provide geographic flexibility and high availability, and how networking fundamentals enable secure communication within and between your environments. Understanding these core components is essential before diving into specific services like compute, storage, and databases in upcoming units.

1. Virtual Data Centers (VDCs)

At the heart of IONOS Cloud architecture is the Virtual Data Center. A VDC is a logical container that groups all the cloud resources you need to build an enterprise-grade IT infrastructure. Think of it as your own private data center, but entirely virtualized and managed through software.

1.1 What is a Virtual Data Center?

According to IONOS documentation, a Virtual Data Center is defined as "a collection of cloud resources used for creating an enterprise-grade IT infrastructure. VDC resources include the processors, memory, disk space, and networks from which virtual machines are built."

A VDC bundles together:

• Compute resources (processors, memory)
• Storage resources (disk space)
• Networking resources (virtual networks, IP addresses)
• Security controls (firewalls, access policies)

All of these resources are managed as a single unit through the Data Center Designer (DCD), IONOS Cloud's graphical management interface. When you create a VDC, you are essentially provisioning a complete virtual data center that can host your applications, databases, and services.

1.2 How VDCs Organize Resources

Every VDC is created in a specific geographic region (such as Berlin or Frankfurt), and all resources within that VDC belong to that location. This regional binding is important for data sovereignty, latency considerations, and compliance requirements.

Within a VDC, resources are organized hierarchically:

1. Contract level: The top-most container owned by your organization
2. VDC level: Logical data centers within your contract
3. Resource level: Individual servers, storage volumes, networks, and other infrastructure components

This hierarchy enables clear organizational structure and cost tracking. Each VDC appears as a distinct line item on your monthly bill, making it easy to attribute costs to specific projects, teams, or environments.

1.3 VDC Management and Access Control

Access to VDCs is controlled through IONOS Identity and Access Management (IAM). Contract owners and administrators can create VDCs, and they can grant specific permissions to users and groups at the VDC level. Permissions include:

• Read: View VDC resources and configurations
• Edit: Modify VDC resources
• Share: Grant access to other users

These permissions are inherited by all resources within the VDC, providing centralized access control. You can also set more granular permissions at the individual resource level when needed, supporting the principle of least privilege.

2. Regions and Availability Zones

IONOS Cloud operates data centers across multiple geographic locations. Understanding how regions and availability zones work is crucial for designing resilient and compliant cloud architectures.

2.1 IONOS Cloud Regions

A region is a geographic location where IONOS operates one or more data centers. Each region is an independent deployment with its own infrastructure, networking, and services. IONOS Cloud regions include:

When you create a VDC, you select a region, and all resources in that VDC must reside in the chosen location. This regional architecture supports several important use cases:

• Data sovereignty: Keep data within specific geographic boundaries to meet legal and regulatory requirements
• Latency optimization: Deploy resources close to your users for better performance
• Disaster recovery: Distribute workloads across regions for business continuity

It is important to note that IONOS does not automatically replicate data across regions. If you need multi-region resilience, you must implement your own replication and backup strategies.

2.2 Availability Zones Within Regions

Within each region, IONOS Cloud infrastructure is divided into isolated physical zones called Availability Zones (AZs). Each AZ is housed in a separate physical location (different rooms or fire zones) within the data center, with independent racks, power feeds, and cooling systems. AZs are interconnected within each datacenter through a dedicated network. This isolation ensures that a hardware failure or maintenance event in one AZ does not affect resources in another AZ.

Typically, each region supports at least two availability zones (AZ 1 and AZ 2). When you provision resources like servers or storage volumes within a VDC, you can assign them to specific availability zones.

Distributing your resources across multiple AZs provides fault tolerance at the infrastructure level. For example, if you run a web application with servers in both AZ 1 and AZ 2, your application remains available even if one entire availability zone experiences an outage. This is the foundation of high-availability architecture on IONOS Cloud.

2.3 Choosing Regions and Availability Zones

When designing your cloud architecture, consider these factors:

For region selection:

• Where are your users located? (Choose regions close to your user base)
• What are your compliance requirements? (Certain regulations mandate data residency)
• Do you need disaster recovery across regions? (Plan for multi-region deployment)

For availability zone distribution:

• Spread critical workloads across at least two AZs
• Place database replicas in different AZs for high availability
• Configure load balancers to distribute traffic across AZs

While availability zones protect against data center-level failures, cross-region deployment protects against regional disasters. Most production workloads benefit from multi-AZ deployment within a single region, with cross-region deployment reserved for mission-critical applications requiring the highest level of resilience.

3. Networking Fundamentals

Networking is the foundation that connects all your VDC resources together. IONOS Cloud provides software-defined networking that behaves like physical networks but with the flexibility and isolation advantages of virtualization.

3.1 Virtual Networks and LANs

Within a VDC, you create Local Area Networks (LANs) to interconnect your virtual machines and other resources. These LANs are entirely software-defined and provide complete traffic isolation.

As documented by IONOS, "Virtual networks work just like normal physical networks. Transmitted data is completely isolated from other subnets and cannot be intercepted by other users." Each LAN acts as a private Ethernet segment where your resources can communicate securely.

You can create two types of LANs:

• Private LANs: Internal networks that are not accessible from the Internet. Resources on private LANs can only communicate with other resources within your VDC or connected VDCs.
• Public LANs: Networks that provide Internet connectivity. Resources on public LANs can reach external services and can be reached from the Internet if configured with appropriate firewall rules.

Both private and public LANs support dual-stack operation, meaning they can handle both IPv4 and IPv6 traffic simultaneously.

3.2 IP Addressing and DHCP

IP addresses are given to the network cards (NICs) in your virtual machines. By default, IONOS Cloud assigns these automatically using DHCP, so you usually don’t need to worry about it.

IPv4 addresses:

• Your private networks get a block of addresses to use internally.
• Public dynamic IPv4 addresses are assigned automatically when a machine connects to the internet.
• If you need a permanent public address for something, you can reserve a static one.

IPv6 addresses:

• Each cloud environment gets a large block of public IPv6 addresses.
• From this block, you can create smaller networks for your machines.
• Each NIC gets its own slice of addresses, including a single main address.
• IPv6 addresses are permanent and won’t change even if you restart your VM.

You can also choose to set addresses manually instead of using automatic assignment. This is useful for important services like DNS, load balancers, or VPNs that need a fixed address.

3.3 Network Interface Cards (NICs) and Connectivity

Virtual machines connect to LANs through Network Interface Cards (NICs). Each NIC can be attached to one LAN and provides:

• Up to 6 Gbps internal throughput (traffic within the VDC)
• Up to 6 Gbps external throughput (traffic to/from the Internet)

A single virtual machine can have multiple NICs, each connected to different LANs. This multi-homing capability enables advanced network topologies, such as separating management traffic from application traffic or creating demilitarized zones (DMZs) for public-facing services.

3.4 Firewall Configuration

Every NIC can have a firewall configured directly on the interface. When you activate a firewall, you choose the traffic direction:

• Ingress: Controls incoming traffic to the NIC
• Egress: Controls outgoing traffic from the NIC
• Bidirectional: Controls both directions

By default, activating a firewall blocks all incoming traffic. You then create firewall rules to allow specific protocols, ports, source addresses, and destination addresses. Supported protocols include TCP, UDP, ICMP (IPv4 ping), ICMPv6 (IPv6 ping), and several others.

However, IONOS recommends using Network Security Groups (NSGs) instead of NIC-based firewalls for most use cases. NSGs provide centralized, stateful firewall management that can be applied consistently across multiple VMs and NICs. We will cover NSGs in detail in Unit 2.6 on Security Services.

3.5 Cross Connect for VDC-to-VDC Communication

When you need to connect multiple VDCs together, you can use Cross Connect. This feature creates dedicated, private LAN-based links between VDCs in the same region and contract.

Cross Connect provides:

• High bandwidth, low-latency communication without traversing the public Internet
• Complete traffic isolation from other tenants
• Support for disaster recovery replication and workload balancing across VDCs

Each private LAN can belong to only one Cross Connect, ensuring clean network segmentation. All VDCs participating in a Cross Connect must use the same IP address range to avoid routing conflicts.

4. Resource Organization Best Practices

Properly organizing resources within and across VDCs is essential for operational efficiency, cost management, and security.

4.1 Separating Resources by Function and Environment

A common best practice is to create separate VDCs for different logical domains:

• Core VDC: Hosts shared services like firewalls, VPN gateways, monitoring, and centralized logging
• Production VDC: Hosts live applications and customer-facing services
• Development VDC: Hosts development and testing workloads
• Project-specific VDCs: Each major project gets its own VDC for clear cost attribution

This separation provides several benefits:

• Clear financial reporting (each VDC is billed separately)
• Simplified access control (grant developers access to dev VDC but not production)
• Reduced blast radius (a mistake in development cannot affect production)

4.2 Centralizing Shared Infrastructure

Rather than duplicating common services in every VDC, deploy them once in a core VDC and connect other VDCs via Cross Connect. This centralization:

• Reduces licensing and operational costs
• Ensures consistent security policies across all environments
• Simplifies management and monitoring

For example, you might deploy a centralized firewall appliance, VPN Gateway, and log aggregation service in your core VDC. All other VDCs connect to the core VDC through Cross Connect, routing their traffic through the shared security infrastructure.

4.3 Applying Access Controls with Groups

IONOS IAM supports user groups, which are collections of users with similar access needs. Best practices for using groups include:

• Create groups that mirror organizational roles (e.g., Network-Engineers, Database-Admins, Security-Team)
• Grant permissions to groups rather than individual users
• Apply the principle of least privilege (give only the minimum permissions needed)
• Use the "Access and manage Identity and Access Management resources" privilege carefully, as it allows users to manage IAM objects

When a user joins or leaves a team, you simply add or remove them from the appropriate group. Their permissions are inherited automatically from group membership, making access management scalable and auditable.

4.4 Distributing Workloads Across Availability Zones

For resilience, always distribute production workloads across at least two availability zones within a VDC. This protects against data center-level failures. Examples include:

• Running web servers in both AZ 1 and AZ 2 with a load balancer distributing traffic
• Deploying database replicas in different AZs for high availability
• Placing backup storage in a separate AZ from primary workloads

Availability zone placement is configured when you create resources like servers and storage volumes. IONOS does not automatically balance resources across AZs, so this must be planned as part of your architecture design.

Common Use Cases

Real-world scenarios where IONOS Cloud core architectural components are used:

1. Multi-Tier Web Application with High Availability: A SaaS company deploys its application across three VDCs (development, staging, production) in the Frankfurt region. The production VDC distributes web servers across AZ 1 and AZ 2 as described in Section 2.2, with an application load balancer routing traffic between zones. The core VDC hosts shared services like VPN, centralized logging, and security monitoring, connected to all environments via Cross Connect as explained in Section 3.5. This architecture provides resilience against availability zone failures while maintaining clear separation between environments.
2. Global Content Delivery with Regional Data Residency: An e-commerce platform serves customers in Europe and North America. The company creates separate VDCs in Frankfurt (de/fra) and Lenexa (us/mci) regions, as shown in Section 2.1. European customer data stays within EU data centers for GDPR compliance, while North American traffic is served from the US region for lower latency. Each regional VDC spans multiple availability zones following the distribution strategy in Section 2.2, providing localized high availability.
3. Centralized Security Architecture for Multiple Projects: An IT services company manages infrastructure for five different client projects. They create a core VDC containing shared firewall appliances and VPN gateways, plus five project-specific VDCs (one per client). Following the resource organization pattern in Section 4.1 and 4.2, all project VDCs route traffic through the core VDC's security infrastructure via Cross Connect. The company uses IAM groups as described in Section 4.3 to grant each client's team access only to their project VDC, ensuring complete isolation while centralizing security management.

Summary

In this unit, you explored the core architectural components that form the foundation of IONOS Cloud. You learned that Virtual Data Centers (VDCs) serve as logical containers for all your cloud resources, providing a software-defined equivalent of physical data centers. You discovered how IONOS Cloud regions and availability zones enable geographic distribution, data sovereignty, and fault tolerance. You examined networking fundamentals including virtual LANs, IP addressing, NICs, and firewall configuration that enable secure communication within your infrastructure. Finally, you reviewed best practices for organizing resources across VDCs, using IAM groups for access control, and distributing workloads across availability zones.

These core components work together to provide the flexibility, isolation, and resilience needed for enterprise cloud deployments. Understanding VDCs, regions, availability zones, and networking fundamentals prepares you to make informed decisions about compute, storage, and other services covered in subsequent units.

Key Points:

• Virtual Data Centers (VDCs) are logical containers that group compute, storage, and networking resources in a single geographic region
• IONOS Cloud regions provide geographic distribution across Europe and North America, while availability zones within each region enable fault-tolerant architecture
• Virtual LANs provide isolated networking within VDCs, with support for both IPv4 and IPv6 addressing
• Resources can be connected across VDCs using Cross Connect, enabling centralized shared services and workload distribution
• Best practices include separating environments into distinct VDCs, distributing workloads across availability zones, and using IAM groups for access control
• Regional boundaries are strict (no automatic cross-region replication), requiring explicit design for multi-region resilience

Important Terminology:

• Virtual Data Center (VDC): A logical container for cloud resources including compute, storage, and networking, bound to a specific region
• Region: A geographic location where IONOS operates data centers, such as Berlin (de/txl) or Frankfurt (de/fra)
• Availability Zone (AZ): An isolated physical zone within a region with independent power, cooling, and networking
• LAN (Local Area Network): A software-defined virtual network that connects resources within a VDC, supporting both private and public connectivity
• Network Interface Card (NIC): A virtual network adapter that connects a virtual machine to a LAN
• Cross Connect: A private, dedicated link between LANs in different VDCs within the same region and contract
• Data Center Designer (DCD): IONOS Cloud's graphical interface for creating and managing VDCs and their resources

Next Steps

Continue Learning: Unit 2.2: Compute Services

Related Topics:

• Unit 3.1: Data Center Designer and Account Management
• Unit 3.2: Identity and Access Management