The first time the deployment worked end-to-end, the logs were silent. No timeouts. No connection drops. Just clean data flowing through Microsoft Presidio in a VPC private subnet, behind a secure proxy.
Deploying Microsoft Presidio inside a VPC private subnet with a proxy is not a checkbox step — it is the difference between security theory and security in practice. By keeping Presidio's processing nodes isolated from the public internet, you eliminate unnecessary exposure while keeping full control over outbound and inbound flows.
A private subnet forces precision. You need NAT routing or a dedicated proxy to allow necessary communication without punching open gaps in your firewall. The proxy becomes the managed bridge: pulling updates, handling API calls, and feeding data through while maintaining zero direct ingress to the private resources. With Microsoft Presidio, this design is even more critical because the workloads handle sensitive text entities that must be safeguarded by design.
The deployment flow starts with provisioning your VPC. Carve out a private subnet segment that has no internet gateway. Attach a NAT gateway or configure a proxy host in a public subnet. All Presidio services must reside inside the private subnet, configured to route external service calls strictly through the proxy. Security groups and NACLs should explicitly deny everything else. The result is that Presidio processes data internally and only sends necessary anonymized data outside through an auditable path.