Deploying NC2 on AWS using Flow Virtual Networking (FVN) requires a specific landing zone architecture to isolate management and user traffic. The minimum configuration requires three distinct subnets. First, one Private Management Subnet is needed for the bare-metal hosts and Controller VMs (CVMs). Second, one Public Subnet is required to host the NAT Gateway, providing the private management nodes with outbound internet access for Nutanix portal communication and updates. Third, one Flow Virtual Networking Subnet (often referred to as the Transit VPC subnet) is required to handle the encapsulation and routing of User VM traffic. This baseline setup ensures that the management plane is secure, the internet-bound traffic is correctly routed, and the FVN overlay has the necessary transit path for workload communication.