Networking Notes: the path, the name, and the circuit

Module 1: Edge services

Amazon CloudFront caches at the edge and understands HTTP. Use it for static and dynamic web content, signed URLs or cookies, geographic restriction, origin failover, and an AWS WAF web ACL on the distribution. Restrict an S3 origin with origin access control. A public bucket is the opposite of that requirement. AWS Global Accelerator gives you two static anycast IP addresses and routes TCP or UDP to an Application Load Balancer, a Network Load Balancer, an EC2 instance, or an Elastic IP address. It does not cache. Put Global Accelerator in front when a partner must allowlist stable addresses or the protocol is not HTTP. Put CloudFront in front when the bytes can be stored or the request must be filtered at the edge.

Module 2: DNS design

A Route 53 public hosted zone answers the internet. A private hosted zone answers only inside VPCs you associate. The same name in both zones is split-horizon DNS: office clients and internet clients can receive different answers. An alias record can sit at the zone apex and can evaluate the health of an AWS target. A CNAME cannot sit at the apex. Latency routing sends the user to the lowest-latency region. Geolocation sends the user to the region you chose for that place. Geoproximity biases a region. Weighted routing splits traffic. Failover needs a health check. Multivalue answer returns several healthy records. It is not a load balancer.

Hybrid design has two directions. On-premises resolvers forward the private AWS names to a Route 53 Resolver inbound endpoint. The VPC forwards selected names to on-premises through an outbound endpoint and a forwarding rule. Share forwarding rules with AWS RAM. Do not create a forwarding rule and a private hosted zone for the same name and expect both to win. Amazon-provided DNS in a VPC is the network address at the VPC CIDR base plus two.

Module 3: Load balancing

An Application Load Balancer is layer 7. It routes by host and path, terminates TLS with an ACM certificate, supports sticky sessions with a cookie, and can authenticate users. A Network Load Balancer is layer 4. It handles TCP, UDP, and TLS, can use a static address per Availability Zone, and preserves the client address for instance targets. For IP targets, proxy protocol v2 carries the original client address. TLS passthrough is a TCP listener, so the target presents the certificate. A TLS listener terminates TLS on the load balancer. Cross-zone load balancing is on by default for an Application Load Balancer and off by default for a Network Load Balancer. Turning it on for a Network Load Balancer can add cross-AZ data charges.

A Gateway Load Balancer inserts a fleet of appliances. The appliance receives GENEVE, not the client's TCP session as a normal target. The AWS Load Balancer Controller creates load balancers for Kubernetes. Use the IP target type when a pod or Fargate task has its own address. Use the instance target type when the node receives the traffic. An internal load balancer has a private address. Making it internet-facing is a different scheme, not a security group change.

Module 4: What to log

Name the question the log must answer before you pick the log. VPC Flow Logs record accepted and rejected traffic metadata for a VPC, a subnet, or an elastic network interface. They do not contain the payload. pkt-srcaddr is the packet's original source, which is the field you want when a NAT gateway or load balancer rewrote the address that srcaddr shows. A REJECT action means a security group or network ACL denied the flow. VPC Traffic Mirroring copies packets to an elastic network interface or a Network Load Balancer so an inspection appliance can see them. Reachability Analyzer explains whether the configured routes, security groups, and network ACLs allow a path. It does not send packets. Transit Gateway Network Manager and its Route Analyzer show the transit topology.

Load balancer access logs and CloudFront access logs are request records, not flow records. Route 53 Resolver query logs show the names that were asked. CloudWatch metrics such as VPN tunnel state, Direct Connect connection state, and healthy host count are what you alarm on. A dashboard that nobody watches is not an alarm.

Module 5: Hybrid connectivity

AWS Direct Connect is a physical circuit. A dedicated connection is a port you request. The letter of authorization is what the colocation provider needs for the cross-connect. A hosted connection comes from a partner. A link aggregation group combines up to four connections of the same bandwidth on the same Direct Connect endpoint. It raises aggregate capacity. One flow can still hash to a single member.

The virtual interface decides where the BGP session lands. A private virtual interface reaches a virtual private gateway or a Direct Connect gateway associated with virtual private gateways. A transit virtual interface reaches a Direct Connect gateway associated with a transit gateway. A public virtual interface reaches public AWS service addresses. It does not land in a private VPC CIDR. A Direct Connect gateway is not a router between your on-premises sites, and it does not make two associated virtual private gateways transitive with each other.

AWS Site-to-Site VPN is IPsec, with two tunnels. Build both. Accelerated VPN uses Global Accelerator and attaches to a transit gateway, not to a virtual private gateway. Transit Gateway Connect is the GRE and BGP attachment for an SD-WAN appliance. Connect is not IPsec. When the requirement is encryption on Direct Connect, add MACsec on a supported dedicated connection or run a VPN over the circuit. A private virtual interface alone does not encrypt.

BGP communities on the prefixes you advertise tell AWS how to send traffic back to you. 7224:7300 is high preference, 7224:7200 is medium, and 7224:7100 is low. Use the same community for active/active. Use a higher community on the primary and a lower one on the backup for active/passive, and advertise the same prefix length. A longer prefix wins on longest match even when its community is worse. AS-path prepending makes a path less attractive when local preference is equal. Your own router's local preference chooses the path from on-premises toward AWS. The communities do not. On a public virtual interface, 7224:9100, 7224:9200, and 7224:9300 scope how far AWS advertises your prefixes: the local Region, the continent, or globally.

Module 6: Many VPCs and accounts

VPC peering connects two VPCs, in the same account or another account, in the same Region or another Region. It is not transitive. You cannot peer overlapping CIDR blocks. Edge-to-edge routing is not supported: a peer is not a path to the internet, to Direct Connect, to a VPN, or to a third VPC. A security group can reference a security group in a peered VPC in the same Region.

AWS Transit Gateway is the regional hub. Attach VPCs, VPNs, Direct Connect gateways, and peering connections to other Regions. Each attachment can use its own transit gateway route table, which is how you segment production from development. Share the transit gateway with AWS RAM, then accept the attachment in the other account. The spoke route table still needs a route to the transit gateway. Enable appliance mode on the attachment that holds a stateful firewall so the return flow stays in the same Availability Zone. A blackhole route drops traffic on purpose. Overlapping VPC CIDRs cannot attach to the same transit gateway.

AWS PrivateLink is the private service path. The provider exposes a Network Load Balancer, or a Gateway Load Balancer for an appliance, as an endpoint service and allows the consumer account. The consumer creates an interface endpoint and uses that address. The provider's CIDR never has to be routable, so overlapping ranges are fine. VPC sharing through AWS RAM lets another account launch resources in your subnet. You still own the route tables and network ACLs. The participant owns the instance and its security groups.

Module 7: DNS implementation

Create the inbound resolver endpoint in at least two Availability Zones. Point the on-premises conditional forwarder at those addresses, and allow the traffic in the endpoint security group. Create the outbound endpoint the same way, then add a forwarding rule for the on-premises domain and associate that rule with the VPC. Share the rule to other accounts with AWS RAM instead of rebuilding it. Associate a private hosted zone with every VPC that should resolve it, including VPCs in other accounts.

Turn on DNSSEC for a public hosted zone when the requirement is authenticated DNS, and publish the DS record at the registrar. DNSSEC does not encrypt the VPC and does not hide a private zone. Resolver query logging and Resolver DNS Firewall belong in the same design when you must see or block the names workloads ask for. An interface VPC endpoint with private DNS changes the AWS service name inside the VPC. On-premises still receives the public answer until you forward that name and route to the endpoint.

Module 8: Repeatable network configuration

Build the network with AWS CloudFormation, the AWS CDK, or the AWS CLI so the next account matches the first. Pass CIDR blocks as parameters. Map Availability Zone IDs, such as use1-az1, instead of names such as us-east-1a, because the name maps to a different physical zone in each account. A subnet ID copied from another account is the same class of mistake. EventBridge can match a VPN tunnel or Direct Connect state change and notify an SNS topic. The notification is not a failover. The BGP design is the failover. Test the passive path before you need it.

Module 9: Routes and quotas

Longest prefix match beats a prettier BGP community. Summarize on-premises routes before you advertise thousands of prefixes into a transit gateway or a virtual private gateway. Quotas on routes, attachments, and bandwidth are part of the design, not an afterthought. Propagate routes when the attachment should be learned automatically. Use a static route when you need an exception, including across an inter-region transit gateway peering attachment. A virtual private gateway propagates BGP routes into a VPC route table only when propagation is enabled.

Keep private access and public access apart. A gateway VPC endpoint for S3 or DynamoDB is a route in that VPC only. Peered VPCs and on-premises networks do not use it. An interface endpoint can be reached from those networks when DNS and routing both point at it. Client VPN is for a person or a laptop. Site-to-Site VPN is for a network. Split-tunnel Client VPN sends only the routed prefixes through the tunnel.

Module 10: Troubleshooting

Read the symptom before you replace the architecture. A flow that never appears may be the wrong elastic network interface or a log that was never enabled. A REJECT entry is a security group or network ACL. A path Reachability Analyzer marks unreachable is a route, a security group, or a network ACL until you prove a middlebox is involved. Traffic Mirroring is how you see the payload an appliance is dropping. Transit Gateway Route Analyzer is how you see which transit route table was used.

The MTU inside a VPC can be 9001. Direct Connect private and transit virtual interfaces can carry jumbo frames when you configure them. A VPN adds overhead and will not carry a 9001-byte packet. If a small ping works and a large transfer fails, lower the MTU or stop advertising jumbo frames on the path that cannot carry them. Asymmetric flows through a stateful firewall are an appliance-mode problem on the transit gateway attachment, not a reason to turn off the firewall.

Module 11: Performance, reliability, and cost

Two VPCs that only need each other are a peering connection. A peering connection avoids transit gateway attachment and data-processing charges. Many VPCs, segmentation, or a hybrid hub justify the transit gateway. CloudFront reduces the traffic that reaches the origin. A NAT gateway charges hourly and per gigabyte. A gateway endpoint keeps S3 and DynamoDB off that NAT path. One NAT gateway in one Availability Zone is cheaper and is also a single failure. One per Availability Zone is the available design. Centralized egress through an inspection VPC trades hops for fewer NAT gateways and one policy.

The Elastic Network Adapter is the normal high-throughput interface. Elastic Fabric Adapter is for tightly coupled HPC, such as MPI, inside a cluster placement group. It is the wrong choice for a web tier. ENA Express raises single-flow throughput between supported instances. Add a secondary CIDR and new subnets when the VPC runs out of addresses. You do not resize the primary CIDR in place. Fargate tasks and Lambda functions in a VPC consume subnet addresses, so plan the prefix before the scale-out does. Multicast belongs in a transit gateway multicast domain. VPC peering does not carry it. IPv6 egress without inbound access uses an egress-only internet gateway, not a NAT gateway.

Module 12: Perimeter controls

Match the control to the flow. AWS WAF filters HTTP on CloudFront, an Application Load Balancer, or API Gateway. AWS Shield is DDoS protection. Shield Advanced adds response support and protections you configure. AWS Network Firewall sits on the VPC path for stateless rules, Suricata-compatible rules, and domain lists. Route 53 Resolver DNS Firewall blocks names at the resolver. A security group is stateful and allow-only. A network ACL is stateless, so return traffic needs an explicit match, including ephemeral ports. A Gateway Load Balancer endpoint is how you steer a VPC route into a third-party appliance without putting that appliance's address on every instance.

A three-tier design uses security groups that reference each other: the load balancer allows the listener, the application allows only the load balancer, and the database allows only the application. An inspection or perimeter VPC is where untrusted traffic is examined before a transit gateway route delivers it to a spoke. A security group in the spoke does not see traffic that the route never sent there.

Module 13: Audit and evidence

CloudTrail records the API call that created a route, changed a security group, or deleted a virtual interface. Flow logs record the traffic. Do not delete the trail to "clean up" an incident. AWS Config records how the security group and the route table changed over time. AWS Firewall Manager pushes WAF, Shield, security group, and Network Firewall policy across the organization. AWS Trusted Advisor flags checks such as a security group open wider than you intended. An alarm on a CloudWatch metric is what pages someone. A log that only lands in a bucket is evidence for later, not a page.

Module 14: Confidentiality of the path

Under the shared responsibility model, a private circuit is not an encrypted circuit. MACsec encrypts a supported dedicated Direct Connect connection. A Site-to-Site VPN encrypts with IPsec, including a VPN that rides Direct Connect. TLS terminates on CloudFront, an Application Load Balancer, or a Network Load Balancer TLS listener, using a certificate from AWS Certificate Manager. The private key of a public ACM certificate is not yours to export. AWS Private CA issues certificates for internal names when you must install the certificate yourself. DNSSEC authenticates public DNS answers. It does not encrypt packets and it does not replace a private hosted zone.

Say which hop must be encrypted, then pick MACsec, IPsec, or TLS for that hop. Inter-Region transit gateway peering rides the AWS network, which encrypts that inter-Region path. That does not encrypt a Direct Connect circuit or an internet VPN you forgot to build. Extra The exam guide lists Amazon EMR, Amazon Redshift, Amazon OpenSearch Service, AWS X-Ray, and AWS Ground Station as out of scope. Leave them out of an answer unless the stem is only using them as a distractor.

Frequently asked questions