<mxfile host="Electron" version="29.6.1">
  <diagram name="Page-1" id="diagram-nat-endpoints">
    <mxGraphModel dx="1200" dy="800" grid="0" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="0" pageScale="1" pageWidth="1400" pageHeight="780" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="title-text" parent="1" style="text;html=1;align=left;verticalAlign=top;fontSize=30;fontStyle=1;fontFamily=Helvetica;fontColor=light-dark(#232F3E,#FFFFFF);" value="Healthcare VPC: NAT Tax vs Endpoints" vertex="1">
          <mxGeometry x="40" y="30" width="900" height="40" as="geometry" />
        </mxCell>
        <mxCell id="subtitle-text" parent="1" style="text;html=1;align=left;verticalAlign=top;fontSize=16;fontFamily=Helvetica;fontColor=light-dark(#232F3E,#D4D4D4);" value="NAT per AZ · free S3/DynamoDB gateway endpoints · Secrets Manager interface endpoint · keep PHI off public path" vertex="1">
          <mxGeometry x="40" y="70" width="1100" height="30" as="geometry" />
        </mxCell>
        <mxCell id="title-separator" parent="1" style="line;strokeWidth=2;html=1;strokeColor=#FF9900;fontFamily=Helvetica;" value="" vertex="1">
          <mxGeometry x="40" y="105" width="1100" height="10" as="geometry" />
        </mxCell>

        <mxCell id="aws-cloud" parent="1" style="points=[[0,0],[0.25,0],[0.5,0],[0.75,0],[1,0],[1,0.25],[1,0.5],[1,0.75],[1,1],[0.75,1],[0.5,1],[0.25,1],[0,1],[0,0.75],[0,0.5],[0,0.25]];outlineConnect=0;gradientColor=none;html=1;whiteSpace=wrap;fontSize=12;fontStyle=0;shape=mxgraph.aws4.group;grIcon=mxgraph.aws4.group_aws_cloud;strokeColor=light-dark(#232F3E,#E4F0FF);fillColor=light-dark(#232F3E0D,#232F3E0D);fillStyle=auto;verticalAlign=top;align=left;spacingLeft=30;fontColor=#232F3E;dashed=0;container=1;pointerEvents=0;collapsible=0;recursiveResize=0;fontFamily=Helvetica;" value="AWS Cloud / VPC" vertex="1">
          <mxGeometry x="40" y="140" width="1120" height="520" as="geometry" />
        </mxCell>

        <mxCell id="grp-ecs" parent="1" style="fillColor=#FFF2E8;strokeColor=#ED7100;rounded=1;whiteSpace=wrap;html=1;verticalAlign=top;fontStyle=1;fontSize=12;fontColor=#ED7100;fontFamily=Helvetica;container=1;collapsible=0;" value="Compute" vertex="1">
          <mxGeometry x="100" y="220" width="120" height="120" as="geometry" />
        </mxCell>
        <mxCell id="svc-ecs" parent="grp-ecs" style="sketch=0;outlineConnect=0;fontColor=#232F3E;fillColor=#ED7100;strokeColor=#ffffff;dashed=0;verticalLabelPosition=bottom;verticalAlign=top;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.ecs;fontFamily=Helvetica;" value="ECS / Lambda&lt;div&gt;&lt;i&gt;private subnets&lt;/i&gt;&lt;/div&gt;" vertex="1">
          <mxGeometry x="36" y="30" width="48" height="48" as="geometry" />
        </mxCell>

        <mxCell id="grp-nat" parent="1" style="fillColor=#EDE7F6;strokeColor=#8C4FFF;rounded=1;whiteSpace=wrap;html=1;verticalAlign=top;fontStyle=1;fontSize=12;fontColor=#8C4FFF;fontFamily=Helvetica;container=1;collapsible=0;" value="Networking" vertex="1">
          <mxGeometry x="320" y="220" width="120" height="120" as="geometry" />
        </mxCell>
        <mxCell id="svc-nat" parent="grp-nat" style="sketch=0;outlineConnect=0;fontColor=#232F3E;fillColor=#8C4FFF;strokeColor=#ffffff;dashed=0;verticalLabelPosition=bottom;verticalAlign=top;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.nat_gateway;fontFamily=Helvetica;" value="NAT Gateway&lt;div&gt;&lt;i&gt;one per AZ&lt;/i&gt;&lt;/div&gt;" vertex="1">
          <mxGeometry x="36" y="30" width="48" height="48" as="geometry" />
        </mxCell>

        <mxCell id="grp-s3ep" parent="1" style="fillColor=#E8F5E9;strokeColor=#3F8624;rounded=1;whiteSpace=wrap;html=1;verticalAlign=top;fontStyle=1;fontSize=12;fontColor=#3F8624;fontFamily=Helvetica;container=1;collapsible=0;" value="Networking" vertex="1">
          <mxGeometry x="540" y="220" width="120" height="120" as="geometry" />
        </mxCell>
        <mxCell id="svc-s3ep" parent="grp-s3ep" style="sketch=0;outlineConnect=0;fontColor=#232F3E;fillColor=#3F8624;strokeColor=#ffffff;dashed=0;verticalLabelPosition=bottom;verticalAlign=top;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.endpoint;fontFamily=Helvetica;" value="Gateway EP&lt;div&gt;&lt;i&gt;S3 (free)&lt;/i&gt;&lt;/div&gt;" vertex="1">
          <mxGeometry x="36" y="30" width="48" height="48" as="geometry" />
        </mxCell>

        <mxCell id="grp-s3" parent="1" style="fillColor=#E8F5E9;strokeColor=#3F8624;rounded=1;whiteSpace=wrap;html=1;verticalAlign=top;fontStyle=1;fontSize=12;fontColor=#3F8624;fontFamily=Helvetica;container=1;collapsible=0;" value="Storage" vertex="1">
          <mxGeometry x="760" y="220" width="120" height="120" as="geometry" />
        </mxCell>
        <mxCell id="svc-s3" parent="grp-s3" style="sketch=0;outlineConnect=0;fontColor=#232F3E;fillColor=#3F8624;strokeColor=#ffffff;dashed=0;verticalLabelPosition=bottom;verticalAlign=top;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.s3;fontFamily=Helvetica;" value="Amazon S3&lt;div&gt;&lt;i&gt;clinical objects&lt;/i&gt;&lt;/div&gt;" vertex="1">
          <mxGeometry x="36" y="30" width="48" height="48" as="geometry" />
        </mxCell>

        <mxCell id="grp-smep" parent="1" style="fillColor=#FFEBEE;strokeColor=#DD344C;rounded=1;whiteSpace=wrap;html=1;verticalAlign=top;fontStyle=1;fontSize=12;fontColor=#DD344C;fontFamily=Helvetica;container=1;collapsible=0;" value="Security" vertex="1">
          <mxGeometry x="540" y="400" width="120" height="120" as="geometry" />
        </mxCell>
        <mxCell id="svc-smep" parent="grp-smep" style="sketch=0;outlineConnect=0;fontColor=#232F3E;fillColor=#DD344C;strokeColor=#ffffff;dashed=0;verticalLabelPosition=bottom;verticalAlign=top;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.endpoint;fontFamily=Helvetica;" value="Interface EP&lt;div&gt;&lt;i&gt;Secrets Mgr&lt;/i&gt;&lt;/div&gt;" vertex="1">
          <mxGeometry x="36" y="30" width="48" height="48" as="geometry" />
        </mxCell>

        <mxCell id="grp-sm" parent="1" style="fillColor=#FFEBEE;strokeColor=#DD344C;rounded=1;whiteSpace=wrap;html=1;verticalAlign=top;fontStyle=1;fontSize=12;fontColor=#DD344C;fontFamily=Helvetica;container=1;collapsible=0;" value="Security" vertex="1">
          <mxGeometry x="760" y="400" width="120" height="120" as="geometry" />
        </mxCell>
        <mxCell id="svc-sm" parent="grp-sm" style="sketch=0;outlineConnect=0;fontColor=#232F3E;fillColor=#DD344C;strokeColor=#ffffff;dashed=0;verticalLabelPosition=bottom;verticalAlign=top;align=center;html=1;fontSize=10;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.secrets_manager;fontFamily=Helvetica;" value="Secrets Manager&lt;div&gt;&lt;i&gt;cached in Lambda&lt;/i&gt;&lt;/div&gt;" vertex="1">
          <mxGeometry x="36" y="30" width="48" height="48" as="geometry" />
        </mxCell>

        <mxCell id="edge-ecs-s3ep" edge="1" parent="1" source="svc-ecs" target="svc-s3ep" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontFamily=Helvetica;fontSize=11;strokeColor=#3F8624;">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="edge-s3ep-s3" edge="1" parent="1" source="svc-s3ep" target="svc-s3" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontFamily=Helvetica;fontSize=11;strokeColor=#3F8624;">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="edge-ecs-smep" edge="1" parent="1" source="svc-ecs" target="svc-smep" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontFamily=Helvetica;fontSize=11;strokeColor=#DD344C;">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="edge-smep-sm" edge="1" parent="1" source="svc-smep" target="svc-sm" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontFamily=Helvetica;fontSize=11;strokeColor=#DD344C;">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="edge-ecs-nat" edge="1" parent="1" source="svc-ecs" target="svc-nat" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;fontFamily=Helvetica;fontSize=11;strokeColor=#232F3E;dashed=1;">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>

        <mxCell id="legend" parent="1" style="rounded=1;whiteSpace=wrap;html=1;fillColor=light-dark(#EDF3FF,#305363);fillStyle=auto;strokeColor=#007CBD;verticalAlign=top;align=left;spacingLeft=16;spacingTop=12;fontFamily=Helvetica;fontSize=12;" value="&lt;b&gt;Cost path&lt;/b&gt;&lt;br&gt;&lt;span style=&quot;color: light-dark(rgb(0,0,0), rgb(255,255,255))&quot;&gt;Green: S3 via free gateway endpoint (no NAT GB)&lt;/span&gt;&lt;br&gt;&lt;span style=&quot;color: light-dark(rgb(0,0,0), rgb(255,255,255))&quot;&gt;Red: Secrets Manager via interface endpoint + Lambda cache&lt;/span&gt;&lt;br&gt;&lt;span style=&quot;color: light-dark(rgb(0,0,0), rgb(255,255,255))&quot;&gt;Dashed: NAT only for true internet / non-endpoint APIs; one NAT per AZ&lt;/span&gt;" vertex="1">
          <mxGeometry x="100" y="540" width="700" height="90" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>
</mxfile>
