How should Amazon VPC be designed for production in AWS?

Separate public and private subnets across availability zones, minimize public exposure, use security groups as primary workload firewalls, add VPC endpoints for private AWS service access, and document routing and DNS.