Networking and content delivery

VPC building blocks

• A VPC has an IPv4 CIDR (/16 to /28) and optional extra CIDRs and an IPv6 block. A subnet lives in one AZ and is public when its route table sends 0.0.0.0/0 to an internet gateway. AWS reserves 5 IPs per subnet (first four and the last), so a /28 has 11 usable addresses. Pick CIDRs that don’t overlap anything you’ll connect to.
• Route tables: every subnet has exactly one (the main one by default); the most specific route wins; the local route can’t be removed. Edge associations let a gateway route table steer inbound traffic through an inspection appliance.
• Internet gateway (IGW): horizontally scaled, no bandwidth limit, gives public IPv4 instances two-way internet access. An instance needs a public IPv4 or Elastic IP, an IGW route, and security group/NACL permission. Public IPv4 addresses are billed hourly.
• NAT gateway: lets private-subnet instances initiate outbound IPv4 connections; lives in a public subnet, needs an Elastic IP (public NAT), is AZ-scoped (deploy one per AZ and route each private subnet to its own for resilience), scales to 100 Gbps, charged per hour and per GB processed. A private NAT gateway (no EIP) translates for private networks and routes through a transit gateway or virtual private gateway. NAT instances are legacy and need source/destination check disabled.
• Egress-only internet gateway: outbound-only IPv6. IPv6 addresses are public and there is no NAT for IPv6, so a private IPv6 subnet routes ::/0 to an egress-only IGW.
• Security groups: attached to ENIs, stateful, allow rules only, all rules evaluated, can reference other security groups, default outbound allow all, default inbound deny. Network ACLs: per subnet, stateless, allow and deny, rules numbered and evaluated in order, ephemeral ports (1024–65535) must be open on the return path. The default NACL allows everything; a custom NACL denies everything until you add rules.
• ENIs, Elastic IPs, DHCP option sets (DNS servers, domain name), VPC DNS attributes (enableDnsSupport for the resolver at the VPC base+2 address, enableDnsHostnames for public DNS names; both needed for private hosted zones and interface endpoint private DNS).
• Subnet sizing is a real failure mode: EKS pods, Lambda in a VPC, interface endpoints and ALBs use IPs. An ALB needs at least eight free IPs per subnet. Add a secondary CIDR or new subnets.

Private connectivity

• Gateway endpoints (S3 and DynamoDB only): a route table entry using a prefix list; free; not reachable from on premises or other VPCs (not transitive); endpoint policies restrict access.
• Interface endpoints (AWS PrivateLink): ENIs with private IPs in your subnets for most AWS services and for third-party or your own services; charged per hour and per GB; private DNS makes the normal service name resolve to the endpoint, which needs the VPC DNS attributes on. A security group on the endpoint must allow 443 from clients. Deploy in each AZ you use for resilience.
• Endpoint services: expose your service behind an NLB (or GWLB) to consumers’ VPCs through PrivateLink; it works across overlapping CIDRs and one-directional, with consumer-initiated connections only.
• Use an S3 interface endpoint when on-premises or cross-Region access to S3 over private connectivity is needed; the gateway endpoint can’t do that. Resource endpoints and service network endpoints (VPC Lattice) are newer variants.
• VPC peering: connects two VPCs (same or different accounts and Regions) with private routing. Not transitive, no overlapping CIDRs, requires routes on both sides and security group/NACL permission. DNS resolution across a peering needs the option enabled on both ends. No edge-to-edge routing through the peer’s IGW, NAT or VPN.
• Transit Gateway (TGW): a regional hub connecting many VPCs, VPNs and Direct Connect gateways with route tables and attachments (associations decide which route table an attachment uses; propagation fills it). Supports transitive routing, inter-Region peering, multicast, and appliance mode for stateful inspection through a VPC. Charged per attachment and per GB. Choose peering for few VPCs, TGW at scale. Share it with RAM.
• VPC Lattice provides service-to-service networking and auth across VPCs; Cloud WAN manages a global network. VPC sharing (RAM) lets accounts share subnets.
• Reach AWS services from a private subnet either through a NAT gateway (internet path, more cost) or endpoints (private, often cheaper at volume).

Network protection services (audit view)

The guide asks you to audit these in one account: know what each one does and where to see its settings and logs.

• Audit means checking: which resources have a web ACL associated, rule order and defaults (default action allow vs block), web ACL logging enabled (to CloudWatch Logs, S3 or Firehose) and sampled requests, whether Shield Advanced is protecting the right resources, Network Firewall rule groups and logging (alert and flow logs), DNS Firewall rule groups associated with VPCs and their fail-open/fail-closed setting, and Firewall Manager compliance.
• Troubleshooting blocked traffic: WAF count mode first, check the terminating rule in logs; remember WAF on CloudFront is global (created in us-east-1), regional elsewhere.
• Rate limiting: a rate-based rule in WAF, not a security group.

Network cost optimization

• Data transfer is a cost: transfer in from the internet is free; out to the internet is charged; between AZs is charged both directions (about $0.01 per GB each way); within an AZ using private IPs is free; between Regions is charged.
• Reduce it: keep chatty tiers in the same AZ where HA allows (and enable cross-zone load balancing consciously), use gateway endpoints for S3 and DynamoDB (free) instead of NAT, CloudFront (cheaper egress than direct from origin, and free from S3/ALB origin to CloudFront), compress and cache, VPC endpoints instead of NAT processing charges, one NAT gateway per AZ to avoid cross-AZ NAT traffic (but delete idle NATs in dev), and use Direct Connect for steady high-volume hybrid traffic.
• Cut idle costs: unattached Elastic IPs and public IPv4 addresses (all public IPv4 are billed), unused NAT gateways, load balancers with no targets, unused endpoints and TGW attachments. Use Cost Explorer, Cost and Usage Report, Trusted Advisor and flow logs to find the top talkers. S3 Transfer Acceleration, CloudFront price classes and Savings Plans are further levers.
• Prefer Gateway Load Balancer or Network Firewall in a central inspection VPC only when needed: they add per-GB charges.

DNS and Route 53

• Hosted zones: public (internet) and private (associated with VPCs; needs the VPC DNS attributes). Records: A, AAAA, CNAME, MX, TXT, NS, SRV, CAA, and Alias.
• Alias vs CNAME: an alias record maps to AWS resources (CloudFront, ELB, API Gateway, S3 website, Global Accelerator, another record), works at the zone apex (example.com), is free to query and can evaluate target health. A CNAME can’t be used at the apex and charges apply.
• Routing policies:

• TTL controls caching. Lower it before a planned change; a high TTL slows failover. Alias records to AWS resources have no TTL setting.
• Traffic Flow builds complex policies visually. DNSSEC signing for public zones uses a KMS asymmetric key in us-east-1. Domain registration and transfer are built in.
• Query logging: public hosted zone query logs go to CloudWatch Logs (log group must be in us-east-1, with a resource policy allowing Route 53). Resolver query logging for VPCs goes to CloudWatch Logs, S3 or Firehose and records queries from VPC resources, including those answered by private zones and forwarded ones.
• Route 53 Resolver: the VPC DNS server at the VPC base address +2 (or 169.254.169.253). It answers private hosted zones and public names. For hybrid DNS:
  • Inbound endpoint: on-premises resolvers forward queries to the VPC (ENIs with IPs in your subnets).
  • Outbound endpoint + forwarding rules: VPC queries for a domain (corp.example.com) are sent out to on-premises DNS servers. Rules can be shared with RAM and associated with many VPCs.
  • Endpoints need at least two IPs in different AZs for resilience and security groups for port 53 (TCP and UDP).
• Private hosted zone with multiple VPCs: associate each VPC (cross-account association needs authorization). Overlapping private and public names: the private zone answers for VPCs it’s associated with (split-horizon DNS).

Content delivery

CloudFront

• A distribution has origins (S3, ALB, EC2, API Gateway, MediaStore, any HTTP server) and behaviours (path pattern → origin, viewer protocol policy, allowed methods, cache policy, origin request policy, response headers policy, functions). Edge locations cache; regional edge caches sit between.
• Cache key and TTLs: the cache key (path plus the headers, cookies and query strings you include) decides what’s the “same” object. Minimum, default and maximum TTL apply with origin Cache-Control or Expires headers. More forwarded values means a lower cache hit ratio. Use managed policies (CachingOptimized, CachingDisabled).
• Invalidations remove cached objects early (first 1,000 paths a month free; wildcard allowed). Better: versioned file names. Invalidation is per distribution, takes minutes, and doesn’t fix the browser’s own cache.
• Origin Access Control (OAC) restricts an S3 origin to CloudFront (bucket policy allows the CloudFront service principal for the distribution ARN; replaces OAI; supports SSE-KMS). Custom headers or a managed prefix list restrict ALB origins to CloudFront. Signed URLs and signed cookies restrict viewers to authorized users (key groups). Field-level encryption, geo restriction, WAF, Shield Standard and TLS settings add protection.
• Origin failover (origin groups) retries a secondary origin on given error codes. Lambda@Edge and CloudFront Functions run code at the edge (functions: viewer request/response, sub-millisecond, JavaScript; Lambda@Edge: all four events, longer). Custom error pages with error caching minimum TTL (default 10 seconds for 4xx/5xx).
• Certificate for custom domain: ACM in us-east-1; alternate domain names (CNAMEs) must be on the distribution; use SNI (free) or a dedicated IP.
• Troubleshooting caching issues:
  • Stale content: TTL too long; invalidate or version the object; check Cache-Control from the origin.
  • Low hit ratio: forwarding cookies, all headers or query strings; fix with a restricted cache policy; check X-Cache: Hit/Miss from cloudfront and Age headers.
  • Different content for different users cached incorrectly: cache key lacks a needed header (such as Accept-Language) or personalization is cached.
  • 403: bucket policy/OAC wrong, missing object, signed URL expired, geo restriction, WAF block. 502/504: origin unreachable, TLS mismatch (origin cert name or protocol policy), origin timeout (default response timeout 30 seconds). Mixed content from HTTP vs HTTPS settings.
  • Standard logs to S3 and real-time logs to Kinesis, plus CloudWatch metrics (error rate, cache hit rate with additional metrics enabled).

Global Accelerator

• Gives two static anycast IPs that route over the AWS global network to the nearest healthy endpoint (ALB, NLB, EC2, Elastic IP) in one or more Regions. It does not cache.
• Listeners (ports and protocols TCP/UDP), endpoint groups per Region with traffic dials, endpoint weights, and health-checked fast failover (seconds, no DNS TTL). Client IP preservation is available.
• Pick Global Accelerator for non-HTTP traffic (TCP/UDP such as gaming or VoIP), static IPs for allow-listing, and deterministic fast regional failover; pick CloudFront for cacheable web content, and both can be combined.

Other

• S3 Transfer Acceleration, API Gateway edge-optimized endpoints (use CloudFront), ELB and Route 53 latency routing are other distribution options.

Hybrid connectivity

• Direct Connect gateway connects a DX to VPCs in several Regions and accounts. Link aggregation groups bundle connections. For high resilience, use two DX locations with two devices each.
• Route propagation into VPC route tables must be enabled for a virtual private gateway; routes learned by BGP. Overlapping CIDRs between VPC and on-premises break routing.

Troubleshooting connectivity

The checklist

1. Source security group outbound, then source subnet NACL outbound.
2. Route table of the source subnet: is there a route to the destination (IGW, NAT, peering, TGW, endpoint)?
3. The gateway itself: IGW attached, NAT gateway in a public subnet with an EIP and a route to IGW, peering accepted and active, TGW attachment and route table association/propagation.
4. Destination subnet route table has a return route; NACL inbound and outbound (ephemeral ports); destination security group inbound allows the source (and the right port and protocol).
5. OS firewall, the application listening on the right port and interface (0.0.0.0 not 127.0.0.1), DNS resolution (nslookup/dig), and MTU.

• Reachability Analyzer statically analyses the path between two resources in your configuration and names the blocking component (no packets sent). Network Access Analyzer finds unintended access paths. Traffic Mirroring copies packets from ENIs to an appliance. VPC Flow Logs record accepted and rejected connections. Route 53 Resolver query logs, traceroute, ping (ICMP allowed?) and telnet/nc check the live path.

Logs to read

• Reading flow logs: REJECT on inbound from a source means a security group or NACL denied it. An ACCEPT inbound with a REJECT on the reverse (outbound reply) points at a NACL (stateless). Both directions accepted but the app still fails: look at the application. Flow logs don’t include traffic to the VPC DNS server, DHCP, the instance metadata address, or Windows license activation.
• Analyse logs with Athena (partitioned S3 data) or CloudWatch Logs Insights (stats count(*) by srcAddr, dstPort | filter action="REJECT"). Use Contributor Insights for top talkers.

CloudWatch network monitoring

• Internet Monitor measures internet performance and availability between your users and your AWS-hosted application, per client location and ISP, and suggests alternatives. Network Synthetic Monitor measures round-trip time and packet loss over hybrid links between AWS and on-premises (agentless; ICMP or TCP probes). Network Flow Monitor shows performance of workload flows within and between AWS resources with TCP-level metrics (retransmissions, timeouts), via lightweight agents. CloudWatch Synthetics (canaries) scripts checks of endpoints and APIs.
• Useful metrics: NAT gateway ErrorPortAllocation, PacketsDropCount, BytesOutToDestination; ELB HTTPCode_ELB_5XX_Count, TargetResponseTime, UnHealthyHostCount; TGW BytesIn/Out and drops; VPN TunnelState; Direct Connect ConnectionState and ConnectionBpsEgress; EC2 NetworkPacketsDropped and allowance-exceeded metrics (ENA bandwidth, PPS and connection tracking limits).
• NAT gateway port exhaustion (ErrorPortAllocation) happens with very many connections to a single destination: add NAT gateways, spread across subnets, or reuse connections.