How is the cloud compute cluster of an engineering firm secured as an extended perimeter, and which components are needed?

Question

Accepted Answer

Build the cloud cluster as a private network (private LAN with private IPs on Layer 3, a virtual switch on Layer 2), connect it to the on-premises network through a VPN router, and use firewalls to block unwanted traffic. Everything is configured restrictively; in particular the internet stays unreachable for the cluster and the AI.
The system analysis puts the engineers, CAD tool and experience database on-premises; the AI algorithm and model software on a virtual cluster in the cloud; and the production plant (OT) on-premises receiving the results. The interactions are: parameters and a start command go up, results (CAD data) come back down to storage and then on to production.
Components for the cloud side:

private LAN, private IP for the cluster (Layer 3);
virtual switch (Layer 2);
VPN router;
firewall to prevent unwanted traffic.

The design brief was to solve it provider-neutrally first, so the components are named by function. Any of the large cloud providers offers virtual equivalents.