Skip to content

Core networking theory is in the Networking notes (Subnetting, DNS, Ipv4 and Ipv6). This is how AWS applies it.

Services at a glance

Service Purpose
Amazon VPC Your isolated virtual network
Subnets, Route tables Segment and route traffic
Internet Gateway (IGW) VPC ↔ internet
NAT Gateway Private subnets reach out to the internet
Security Groups / NACLs Instance-level and subnet-level firewalls
VPC Endpoints (Gateway / Interface, PrivateLink) Private access to AWS services
VPC Peering / Transit Gateway Connect VPCs
Site-to-Site VPN / Client VPN Encrypted tunnels
AWS Direct Connect Dedicated private line to AWS
Amazon Route 53 DNS and health-check routing (AWS Route 53 Deep Dive)
Amazon CloudFront CDN
AWS Global Accelerator Static anycast IPs on the AWS backbone
Elastic Load Balancing See 3. AWS Compute and AWS Elastic Load Balancing Deep Dive
API Gateway Managed APIs
VPC Flow Logs / Reachability Analyzer Visibility and debugging

VPC

A logically isolated network in one region spanning all its AZs. You pick a CIDR (e.g. 10.0.0.0/16, from /16 to /28).

  • Subnet: a CIDR slice that lives in one AZ. AWS reserves 5 IPs per subnet
  • Public subnet: route table has 0.0.0.0/0 → Internet Gateway
  • Private subnet: no direct route to the IGW; egress via NAT Gateway in a public subnet
  • A default VPC exists in each region with public subnets, for quick starts
VPC 10.0.0.0/16
 ├── AZ-a: public 10.0.1.0/24  (ALB, NAT GW)    ── IGW
 │         private 10.0.11.0/24 (app servers)    ── NAT
 └── AZ-b: public 10.0.2.0/24
           private 10.0.12.0/24
           data   10.0.21.0/24 (RDS, no internet)

$ aws ec2 create-vpc --cidr-block 10.0.0.0/16
$ aws ec2 create-subnet --vpc-id vpc-0123 --cidr-block 10.0.1.0/24 --availability-zone us-east-1a
$ aws ec2 create-internet-gateway
$ aws ec2 attach-internet-gateway --internet-gateway-id igw-0123 --vpc-id vpc-0123
$ aws ec2 create-route --route-table-id rtb-0123 --destination-cidr-block 0.0.0.0/0 --gateway-id igw-0123

Firewalls: Security Group vs NACL

Security Group Network ACL
Level Instance / ENI Subnet
State Stateful (return traffic auto allowed) Stateless (allow both directions)
Rules Allow only Allow and deny
Evaluation All rules together Numbered order, first match wins
Default All inbound denied, outbound allowed Default NACL allows all

Security groups can reference other security groups as sources (e.g. app tier allows only the ALB's group).

NAT

  • NAT Gateway: managed, AZ-scoped, scales to 45 Gbps; put one per AZ for resilience
  • NAT instance: older DIY approach
  • Egress-only Internet Gateway: outbound-only for IPv6

Elastic IP

Static public IPv4 you own until released; charged when not attached.

Connecting Networks

Option When
VPC Peering Two VPCs, 1:1, not transitive, no overlapping CIDRs
Transit Gateway Hub connecting many VPCs and on-prem, transitive
PrivateLink Expose a service privately to other VPCs / accounts without peering
Site-to-Site VPN IPsec over internet, quick, encrypted
Direct Connect Dedicated, consistent bandwidth, not encrypted by default (add VPN / MACsec)
Client VPN Remote users to VPC

VPC Endpoints

Reach AWS services without crossing the internet. - Gateway endpoints: S3 and DynamoDB only, free, route-table entry - Interface endpoints (PrivateLink): ENI with a private IP for most other services, hourly + data cost

DNS and Content Delivery

Route 53

Highly available DNS plus domain registration and health checks.

Record types: A, AAAA, CNAME, MX, TXT, NS and Route 53 Alias (maps apex domain to AWS resources, free queries, works at zone apex unlike CNAME).

Routing policy Behaviour
Simple One answer
Weighted Split traffic by percentage (A/B, canary)
Latency Lowest latency region
Failover Primary / secondary using health checks
Geolocation By user location
Geoproximity By distance, with bias
Multi-value Up to 8 healthy records

CloudFront

Deep dive: AWS CloudFront Deep Dive (origins, behaviors, cache keys and TTLs, header policies, invalidations, domains). Edge delivery on Azure and GCP: Azure and GCP Edge Delivery and Load Balancing.

CDN across edge locations. Origins: S3, ALB, EC2, any HTTP server. Features: TTL caching, OAC to keep S3 private, signed URLs/cookies, Lambda@Edge / CloudFront Functions, WAF and Shield integration, HTTPS with ACM certificates (in us-east-1).

Global Accelerator

Two static anycast IPs that route traffic over the AWS backbone to the closest healthy endpoint. For non-HTTP (TCP/UDP) or fast regional failover; CloudFront is for caching content.

API Gateway

Deep dive: AWS API Gateway Deep Dive

Create, publish and secure APIs in front of Lambda or any backend.

  • REST API, HTTP API (cheaper, simpler), WebSocket API
  • Authorizers: IAM, Cognito, Lambda authorizer
  • Throttling, usage plans and API keys, caching, stages, request validation

Observability

  • VPC Flow Logs: accept/reject metadata for network interfaces, to CloudWatch or S3
  • Reachability Analyzer: explains why A cannot reach B
  • Traffic Mirroring for packet inspection