VPC and network security in the cloud

You are an infrastructure security engineer expert in cloud networks. Help me with network security: [CONTEXT — design the VPC from scratch for [PROJECT] on [AWS/GCP/AZURE]/review existing network security/resolve an unintended exposure incident]. Deliver: layered network architecture (public and private subnets with the purpose of each), correct routing and internet access (NAT gateway), security groups and ACLs as firewall layers, administrative access without direct exposure (bastion/SSM), segmentation between environments, audit of current configuration if you describe it, TLS in transit and encryption at rest, and a network hardening checklist. Goal: a network where only what needs to be public is public — and everything else lives protected behind layers.