Networking and content delivery
The VPC is the private network your resources live in; the other services connect it to your data center, to users and to the internet.
VPC
Virtual Private Cloud
A logically isolated virtual network under your control: IP ranges, subnets, routes and gateways.
Key points
- Public subnet: has a route to the internet gateway.
- Private subnet: no direct internet access; goes out through a NAT gateway.
- Each subnet lives in a single Availability Zone.
On the exam
Web server in a public subnet; database in a private subnet.
Two firewall layers in the VPC: one per instance, the other per subnet.
Key points
- Security groups allow what you open and deny the rest.
- NACLs evaluate numbered rules in order and accept deny rules.
- Use both together for defense in depth.
On the exam
Stateful, per instance: security group. Stateless, per subnet, with deny rules: NACL.
Comparison
| Layer | Characteristics |
|---|---|
| Security group |
|
| Network ACL |
|
VPN
AWS Site-to-Site VPN and Client VPN
Encrypted tunnels between your network, or your users, and AWS over the internet.
Key points
- Site-to-Site VPN: connects the data center or office to the VPC.
- Client VPN: remote access for individual users.
- Quick to set up, but depends on the public internet.
On the exam
An encrypted, quick-to-set-up connection over the internet: VPN.
Direct Connect
AWS Direct Connect
A dedicated, private network connection between your data center and AWS, bypassing the internet.
Key points
- More consistent bandwidth and latency.
- Can reduce data transfer costs.
- Takes longer to provision than a VPN.
On the exam
A private, dedicated, consistent connection without the internet: Direct Connect.
Transit Gateway
AWS Transit Gateway
A central hub that connects many VPCs and on-premises networks.
Key points
- Replaces a mesh of point-to-point connections.
- Simplifies routing across many networks.
- Works with VPN and Direct Connect.
On the exam
Connect many VPCs and on-premises networks through a central point: Transit Gateway.
Route 53
Amazon Route 53
A managed, highly available and scalable DNS service.
Key points
- Domain registration.
- Routing policies: simple, latency, geolocation, weighted and failover.
- Endpoint health checks.
On the exam
DNS, domain registration and failover between Regions: Route 53.
CloudFront
Amazon CloudFront
A content delivery network (CDN) that caches at edge locations, close to users.
Key points
- Static and dynamic content, video and APIs.
- Integrates with Shield and WAF.
- Origins: S3, ELB, EC2 or your own servers.
On the exam
Reduce global latency with caching: CloudFront.
Global Accelerator
AWS Global Accelerator
Improves availability and performance by carrying traffic over the AWS global network.
Key points
- Two static anycast IPs for the application.
- Fast failover between Regions.
- Works for TCP and UDP; it does not cache.
On the exam
Static IPs and routing over the AWS network, without caching: Global Accelerator. With caching: CloudFront.
API Gateway
Amazon API Gateway
Creates, publishes, secures and monitors APIs at any scale; it is the "front door" to the backend.
Key points
- REST, HTTP and WebSocket APIs.
- Integrates with Lambda for serverless backends.
- Access control, throttling and caching.
On the exam
Expose Lambda functions as an HTTP API: API Gateway.
PrivateLink
AWS PrivateLink
Private connectivity between VPCs and AWS or third-party services, without exposing traffic to the internet.
Key points
- Uses interface endpoints inside the VPC.
- Traffic stays on the AWS network.
- Lets you offer your own service to other VPCs.
On the exam
Reach a service without the internet and without an internet gateway: PrivateLink (VPC endpoint).