3.4 AWS Networking and Content Delivery
Key Takeaways
- Amazon VPC lets you create an isolated virtual network in the cloud with complete control over IP addressing, subnets, routing, and security.
- Amazon CloudFront is a global CDN that caches content at edge locations worldwide for low-latency delivery to end users.
- Amazon Route 53 is a highly available DNS service that routes users to applications with domain registration, DNS routing, and health checking.
- Elastic Load Balancing distributes incoming traffic across multiple targets (EC2, containers, Lambda) in one or more AZs.
- AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the public internet.
Quick Answer: AWS networking lets you build an isolated virtual network (Amazon VPC), deliver content fast worldwide (CloudFront), route DNS intelligently (Route 53), spread traffic across servers (Elastic Load Balancing), and connect on-premises privately (Direct Connect) or encrypted over the internet (AWS VPN). The CLF-C02 tests purpose, not configuration.
Amazon VPC (Virtual Private Cloud)
Amazon VPC lets you launch AWS resources in a logically isolated virtual network you define, with full control over IP ranges, subnets, route tables, and gateways.
VPC Components
| Component | Purpose |
|---|---|
| Subnets | Divide the VPC into public/private segments within AZs |
| Route Tables | Direct where network traffic flows |
| Internet Gateway (IGW) | Enables internet access for public subnets |
| NAT Gateway | Lets private-subnet resources reach the internet outbound only |
| VPC Endpoints | Private access to AWS services without traversing the internet |
| VPC Peering | Privately connect two VPCs |
| Transit Gateway | Central hub connecting many VPCs and on-premises networks |
| Security Groups / NACLs | Instance-level (stateful) and subnet-level (stateless) firewalls |
Security Groups vs. Network ACLs
This pair is heavily tested. Security Groups operate at the instance/ENI level, are stateful (return traffic is automatically allowed), and support allow rules only. Network ACLs (NACLs) operate at the subnet level, are stateless (you must allow both directions), and support both allow and deny rules.
VPC Endpoint Types
| Type | Description | Example |
|---|---|---|
| Gateway Endpoint | Free; for S3 and DynamoDB | Private subnet reaches S3 without internet |
| Interface Endpoint (PrivateLink) | Uses an elastic network interface with a private IP | Private access to CloudWatch, SNS, SQS, and many services |
Amazon CloudFront (CDN)
Amazon CloudFront is a content delivery network that caches content at 600+ edge locations worldwide for low-latency delivery.
| Feature | Detail |
|---|---|
| Edge Locations | 600+ globally |
| Origins | S3 buckets, EC2, ALB, custom HTTP servers |
| Content Types | Static assets, dynamic content/APIs, video streaming |
| Security | Integrates with AWS WAF, AWS Shield, and ACM for HTTPS |
| DDoS Protection | AWS Shield Standard is automatic and free |
On the Exam: CloudFront = CDN = low-latency global delivery via edge caching. Any scenario about "reduce latency for global users" or "cache static content closer to users" points to CloudFront.
Amazon Route 53 (DNS)
Amazon Route 53 is a highly available DNS web service offering domain registration, DNS routing, and health checking.
Routing Policies
| Policy | Description | Use Case |
|---|---|---|
| Simple | One resource | Single-server site |
| Weighted | Split by assigned weights | A/B testing, gradual rollout |
| Latency-based | Lowest-latency Region | Global apps |
| Failover | Primary, then backup if unhealthy | Disaster recovery |
| Geolocation | Based on user location | Localization, compliance |
| Geoproximity | Resource location with bias | Fine-tuned geographic routing |
| Multivalue answer | Multiple healthy records | Simple DNS-level balancing |
Elastic Load Balancing (ELB)
Elastic Load Balancing distributes incoming traffic across multiple targets (EC2, containers, IPs, Lambda) in one or more AZs, improving availability and scalability.
| Type | OSI Layer | Best For |
|---|---|---|
| Application Load Balancer (ALB) | Layer 7 (HTTP/HTTPS) | Web apps, microservices, path/host routing |
| Network Load Balancer (NLB) | Layer 4 (TCP/UDP) | Extreme performance, static IP, low latency |
| Gateway Load Balancer (GWLB) | Layer 3 (IP) | Third-party virtual appliances (firewalls, IDS/IPS) |
On the Exam: ALB = HTTP/HTTPS web apps with smart routing. NLB = ultra-high-performance TCP/UDP and static IP. GWLB = inline virtual security appliances.
Connectivity Services
AWS Direct Connect
A dedicated private physical connection from on-premises to AWS that bypasses the public internet, offering consistent low latency and 1–100 Gbps bandwidth. It is not encrypted by default — pair it with a VPN if encryption is required.
AWS VPN
An encrypted connection over the public internet. Site-to-Site VPN links a network to a VPC over IPSec; Client VPN connects individual users. VPN is quick to set up and cheaper than Direct Connect, but performance depends on the internet.
AWS Transit Gateway
A central hub that connects many VPCs, VPNs, and on-premises networks, replacing a tangle of peering connections with hub-and-spoke routing.
AWS Global Accelerator
Routes user traffic over the AWS global backbone (not the public internet) to the optimal endpoint, and provides static anycast IP addresses as a fixed entry point — ideal for non-HTTP, latency-sensitive global apps.
| Service | Best For |
|---|---|
| Direct Connect | Dedicated private bandwidth, hybrid, compliance |
| VPN | Quick, encrypted connection over the internet |
| Transit Gateway | Connecting many VPCs and networks centrally |
| Global Accelerator | Performance via the AWS backbone + static IPs |
| CloudFront | Caching content at edge for low-latency delivery |
On the Exam: Distinguish CloudFront (caches content at edge) from Global Accelerator (routes live traffic over the AWS backbone to your origins). Both improve global performance but solve different problems.
Default Networking Behavior
Every AWS account starts with a default VPC in each Region, complete with a default subnet in each Availability Zone, an internet gateway, and a route table — so you can launch an instance immediately. For production, organizations typically build a custom VPC with carefully designed public and private subnets across multiple AZs.
A common secure pattern places internet-facing resources (a load balancer) in public subnets and application/database tiers in private subnets, with a NAT Gateway giving the private tier outbound-only internet access for updates. This layered design supports the Security pillar's "defense in depth" and the Reliability pillar's multi-AZ guidance. Knowing that public subnets route to an internet gateway while private subnets do not is a frequently tested distinction.
Which AWS service is a global content delivery network (CDN) that caches content at edge locations?
A company needs a dedicated, private network connection from their on-premises data center to AWS that does NOT use the public internet. Which service should they use?
Which type of Elastic Load Balancer operates at Layer 7 (HTTP/HTTPS) and supports path-based routing?
What is the purpose of a VPC Endpoint?