Networking
Designing subnets, routing and connections that scale with the workload and reach on premises networks. Part of Domain 3: Design High-Performing Architectures, 24% of the scored content.
VPC design
Amazon Virtual Private Cloud
A VPC is a private network in one Region, divided into subnets that each live in one AZ. Address planning and subnet tiers decide how far it can grow.
Key points
- CIDR: IPv4 blocks from /16 to /28. Add more blocks later (5 per VPC by default, adjustable up to 50). Avoid overlapping ranges with networks you will connect to.
- Reserved addresses: AWS keeps 5 IPs in every subnet (the first 4 and the last one).
- Subnet tiers: public (load balancers, NAT), private (application) and data (databases), each repeated in at least 2 AZs.
- Route tables: a subnet is public when its route table has a route to an internet gateway. Private subnets route outbound traffic through NAT.
- VPC Flow Logs: IP traffic metadata to CloudWatch Logs, S3 or Data Firehose for troubleshooting.
On the exam
"Running out of IPs in the VPC" -> add a secondary CIDR block, not a new VPC. A /28 subnet has only 11 usable addresses because 5 are reserved.
Internet gateways give public subnets two-way internet access. NAT and egress-only gateways let private resources reach out without being reachable.
Key points
- Internet gateway: horizontally scaled, redundant and highly available, no bandwidth constraint. No charge for the gateway itself, only data transfer.
- NAT gateway (zonal): IPv4 outbound for private subnets, 5 Gbps scaling to 100 Gbps. Create one per AZ so an AZ failure does not cut egress for the others.
- NAT gateway (regional mode): one NAT gateway ID that expands across the AZs where workloads run, without a public subnet.
- Egress-only internet gateway: IPv6 outbound only and stateful. IPv6 addresses are public, so this is the IPv6 equivalent of NAT.
- Elastic IP: static public IPv4, 5 per Region by default. AWS charges for every public IPv4 address, in use or idle.
On the exam
"Private instances need patches from the internet, highly available" -> NAT gateway in each AZ, not a NAT instance. "IPv6 outbound only" -> egress-only internet gateway.
Peering links two VPCs directly. AWS Transit Gateway is a Regional hub that scales to many VPCs and on premises connections.
Key points
- VPC peering: one-to-one, across accounts and Regions, no single point of failure or bandwidth bottleneck. Not transitive and no overlapping CIDRs. 50 active peerings per VPC by default, up to 125.
- Transit Gateway: hub and spoke router for VPCs, Site-to-Site VPN, Direct Connect gateways and Transit Gateway Connect. Up to 100 Gbps per VPC attachment per AZ.
- Route tables on the transit gateway segment traffic (for example, keep prod and dev apart).
- Peering attachments connect transit gateways across Regions. Share a transit gateway with other accounts through AWS RAM.
- ECMP over several VPN tunnels with BGP aggregates VPN bandwidth to the transit gateway.
On the exam
"Dozens of VPCs and on premises sites, full mesh is unmanageable" -> Transit Gateway. "Two VPCs, lowest cost, no transit" -> VPC peering. A peered VPC never forwards traffic for a third one.
PrivateLink and endpoints
AWS PrivateLink
Private access to AWS services and to services in other VPCs without internet gateways, NAT or peering. Traffic stays on the AWS network.
Key points
- Interface endpoint: network interfaces with private IPs in your subnets for an AWS service or an endpoint service, resolved through DNS.
- Endpoint service: expose your own application behind a Network Load Balancer to consumers in other VPCs or accounts. Works with overlapping CIDRs because only the endpoint is shared.
- Gateway endpoint: only for S3 and DynamoDB, no extra cost, a route in the route table, same Region only. It is not PrivateLink.
- Consumer initiated: the consumer opens the connection and the provider accepts or rejects the request.
On the exam
"Expose one service to hundreds of customer VPCs with overlapping CIDRs" -> PrivateLink endpoint service, not peering. "EC2 to S3 without NAT, no cost" -> gateway endpoint.
Encrypted IPsec tunnels over the internet. Site-to-Site VPN joins networks, Client VPN connects individual users.
Key points
- Site-to-Site VPN: 2 tunnels per connection, each in a different AZ. Ends on a virtual private gateway or a transit gateway, with a customer gateway on premises.
- Bandwidth: up to 1.25 Gbps per standard tunnel. Large Bandwidth Tunnels reach up to 5 Gbps on transit gateway or Cloud WAN attachments.
- Accelerated Site-to-Site VPN: enters the AWS global network at the nearest edge through Global Accelerator. Requires a transit gateway.
- AWS Client VPN: managed, OpenVPN-based remote access for users, authenticated with Active Directory, SAML federation or mutual certificates.
On the exam
"Connect the office this week, encrypted, low cost" -> Site-to-Site VPN. "Remote employees on laptops" -> Client VPN. More than 1.25 Gbps over VPN -> ECMP on a transit gateway or Large Bandwidth Tunnels.
Direct Connect
AWS Direct Connect
A private, dedicated link from your network to AWS that bypasses the internet, for consistent bandwidth and latency.
Key points
- Dedicated connection: 1, 10, 100 or 400 Gbps port. Hosted connection: 50 Mbps to 25 Gbps through a partner.
- Not encrypted by default: use MACsec on 10, 100 and 400 Gbps dedicated connections at supported locations, or run an IPsec VPN over Direct Connect.
- Virtual interfaces: private VIF to a VPC, public VIF to AWS public services, transit VIF to transit gateways.
- Direct Connect gateway: global resource that links one connection to VPCs in many Regions (except China). It does not route VPC to VPC.
- Resiliency: maximum resiliency (separate devices in more than 1 location, 99.99% SLA) or high resiliency (connections at multiple locations, 99.9%). A Site-to-Site VPN is the low-cost backup.
On the exam
"Consistent throughput, large daily transfers, no internet" -> Direct Connect. "Needed now" is a VPN, because a new connection takes time to provision. "Encrypted private link" -> DX + IPsec VPN or MACsec.
Hybrid connectivity
| Option | Fits when |
|---|---|
| Site-to-Site VPN | Fast setup, encrypted, over the internet, variable latency. |
| Client VPN | Individual users connecting from their devices. |
| Direct Connect | Private, consistent bandwidth and latency, high volume. |
| Direct Connect + VPN | Encryption over DX, or VPN as the backup path for DX. |
Load balancer choice
Elastic Load Balancing
Pick the load balancer by protocol layer and requirement. High availability and health checks are covered in the resilience notes.
Key points
- Application Load Balancer: layer 7, HTTP and HTTPS, routing by path, host and headers, containers and Lambda targets.
- Network Load Balancer: layer 4 (TCP, UDP, TLS, QUIC), millions of requests per second, a static IP per AZ and optional Elastic IPs.
- Gateway Load Balancer: layer 3, inserts third-party appliances (firewalls, IDS) using GENEVE on port 6081.
On the exam
"Path-based routing to microservices" -> ALB. "Static IP for allowlisting, UDP, extreme throughput" -> NLB. "Inline third-party firewall fleet" -> Gateway Load Balancer.