AWS networking > AWS networking covers the virtual network inside a Region (Amazon VPC), the ways to connect networks to each other and to on-premises sites, edge delivery and DNS, load balancing, and network protection services. Most designs start with a VPC and then add the connectivity, distribution and protection layers that the workload needs. > The SAA-C03 exam guide tests network design in several places: secure VPC architectures (security groups, route tables, network ACLs, NAT gateways), network connection options (VPN, Direct Connect, PrivateLink), edge services (CloudFront, Global Accelerator), load balancing and cost-aware routing. + What is Amazon VPC? + Networking and content delivery on AWS + SAA-C03 exam page Amazon VPC @amazon-virtual-private-cloud :: Your isolated virtual network > Amazon VPC lets you launch AWS resources in a logically isolated virtual network that you define, which closely resembles a traditional network in your own data center. Subnets, route tables, gateways and traffic filters are the building blocks. > See the Amazon VPC map for addressing, quotas and monitoring in more depth. + What is Amazon VPC? + Amazon VPC quotas Subnets :: Public or private; each in one Availability Zone > A subnet is a range of IP addresses in your VPC that must reside entirely within one Availability Zone and cannot span zones. The subnet type depends on routing: a public subnet has a direct route to an internet gateway, a private subnet does not, and a VPN-only subnet routes to a Site-to-Site VPN connection. + Subnet CIDR blocks Route tables :: Decide where traffic from a subnet goes > A route table has routes, each with a destination and a target such as an internet gateway, NAT gateway, VPC peering connection or VPN connection. A subnet is associated with one route table at a time, and the most specific matching route wins. + Subnet route tables Internet gateway :: Two-way internet access for public subnets > An internet gateway is horizontally scaled, redundant and highly available, and supports IPv4 and IPv6. A resource also needs a public IPv4 address or an IPv6 address to use it. + Internet gateways NAT gateway :: Outbound-only internet access for private subnets > A NAT gateway lets instances in a private subnet connect to services outside the VPC while external services cannot initiate connections to them. A public NAT gateway lives in a public subnet and needs an Elastic IP address. + NAT gateways Security groups :: Stateful, allow rules only, at the network interface > A security group controls inbound and outbound traffic for the resources it is associated with. Security groups are stateful, so response traffic is allowed regardless of the rules, and you can specify allow rules but not deny rules. + Control traffic with security groups Network ACLs :: Stateless, allow and deny rules, at the subnet > A network ACL allows or denies inbound and outbound traffic at the subnet level. NACLs are stateless, so responses are not automatically allowed, and rule numbers let you insert rules later. + Control subnet traffic with network ACLs VPC endpoints @aws-privatelink :: Gateway endpoints (S3, DynamoDB) and interface endpoints (PrivateLink) > Gateway endpoints connect to Amazon S3 and DynamoDB without an internet gateway or NAT device and have no additional charge. Interface endpoints use AWS PrivateLink, create a network interface with a private IP address in your subnet, and are billed for hourly usage and data processing. + Gateway endpoints + Interface endpoints VPC Flow Logs :: Capture IP traffic metadata > Flow logs capture information about IP traffic going to and from network interfaces in your VPC. You can publish the data to Amazon CloudWatch Logs, Amazon S3 or Amazon Data Firehose. Connect networks > Connectivity services link VPCs to each other and to other networks. + Amazon VPC connectivity options VPC peering :: Private routing between two VPCs; not transitive > A peering connection is a one-to-one relationship that routes traffic between two VPCs using private IPv4 or IPv6 addresses. Transitive peering is not supported, so a VPC has no relationship with VPCs its peer is connected to. + What is VPC peering? AWS Transit Gateway @aws-transit-gateway :: Hub that connects many VPCs and on-premises networks > A transit gateway is a network transit hub that interconnects VPCs and on-premises networks, and inter-Region peering connects transit gateways together. + What is AWS Transit Gateway? AWS PrivateLink @aws-privatelink :: Expose a service privately to other VPCs > PrivateLink privately connects your VPC to services and resources as if they were in your VPC, without an internet gateway, NAT device, public IP address, Direct Connect or Site-to-Site VPN. A service provider creates an endpoint service backed by a load balancer, and consumers create endpoints to it. + What is AWS PrivateLink? Amazon VPC Lattice @amazon-vpc-lattice :: Application networking across VPCs and accounts > VPC Lattice is a fully managed application networking service to connect, secure and monitor services and resources, in one VPC or across VPCs and accounts. + What is Amazon VPC Lattice? AWS Cloud WAN @aws-cloud-wan :: Global network managed with policies > Cloud WAN is a managed wide-area networking service for a unified global network across cloud and on-premises environments, configured centrally with network policies. Cloud WAN Flow Logs give one consolidated view of traffic and can be turned on for a core network, an edge or single attachments, with delivery to CloudWatch Logs, Amazon S3 or Amazon Data Firehose. + What is AWS Cloud WAN? + Cloud WAN Flow Logs Hybrid connectivity > Hybrid connectivity links your on-premises network or remote users to AWS. The main choices are an IPsec VPN over the internet, a Client VPN for individual users, or a dedicated Direct Connect link that bypasses internet service providers. + AWS Direct Connect User Guide AWS Site-to-Site VPN @aws-site-to-site-vpn :: IPsec VPN between your VPC and your network > A Site-to-Site VPN connection links your VPC to your own on-premises network, and you configure routing to pass traffic through it. It supports IPsec VPNs. + What is AWS Site-to-Site VPN? AWS Client VPN @aws-client-vpn :: Remote user access > Client VPN is a managed client-based VPN that lets users reach AWS and on-premises resources from any location using an OpenVPN-based client over TLS. + What is AWS Client VPN? AWS Direct Connect @aws-direct-connect :: Dedicated private connection to AWS > Direct Connect links your network to a Direct Connect location over a standard Ethernet fiber-optic cable, and you create virtual interfaces to public AWS services or to a VPC, bypassing internet service providers. + What is AWS Direct Connect? Edge and DNS > CloudFront caches content at edge locations, Route 53 answers DNS queries and checks health, and Global Accelerator routes traffic over the AWS global network to your endpoints. The SAA-C03 exam guide lists CloudFront and Global Accelerator as edge networking services. Amazon CloudFront @amazon-cloudfront :: Content delivery network with edge caching > CloudFront delivers static and dynamic content through edge locations, routing each request to the edge location with the lowest latency. If the edge location does not have the content, it retrieves it from an origin such as an Amazon S3 bucket or an HTTP server. + What is Amazon CloudFront? Amazon Route 53 @amazon-route-53 :: DNS, domain registration and health checks > Route 53 is a highly available and scalable DNS web service that performs domain registration, DNS routing and health checking, in any combination. + What is Amazon Route 53? Routing policies :: Simple, weighted, latency, failover, geolocation, geoproximity, IP-based and multivalue answer > The policy decides how Route 53 responds to queries. Failover is for active-passive, latency picks the Region with the best latency, geolocation routes by user location, geoproximity routes by resource location and can shift traffic, and weighted splits traffic in proportions you set. > Multivalue answer returns up to eight healthy records selected at random, and IP-based routing uses the IP addresses that traffic originates from. + Choosing a routing policy AWS Global Accelerator @aws-global-accelerator :: Accelerators that route over the AWS global network > A standard accelerator directs traffic over the AWS global network to endpoints in the nearest Region to the client, improving availability for internet applications with a global audience. A custom routing accelerator maps users to a specific destination among many. + What is AWS Global Accelerator? Load balancing > Elastic Load Balancing distributes incoming traffic across targets such as EC2 instances, containers and IP addresses in one or more Availability Zones. It monitors target health and sends traffic only to healthy targets. + What is Elastic Load Balancing? Elastic Load Balancing @elastic-load-balancing > Elastic Load Balancing supports Application Load Balancers, Network Load Balancers, Gateway Load Balancers and Classic Load Balancers. The three below are the ones the SAA-C03 exam guide names. Application Load Balancer :: Layer 7, HTTP and HTTPS, path and host routing > An Application Load Balancer works at the application layer, the seventh OSI layer, and evaluates listener rules to route requests. It supports path conditions that forward requests based on the URL. Network Load Balancer :: Layer 4, TCP, UDP and TLS, static IPs, very high throughput > A Network Load Balancer works at the fourth OSI layer and can handle millions of requests per second. Each load balancer node gets a static IP address, and you can assign one Elastic IP address per enabled subnet. Gateway Load Balancer :: Layer 3, for third-party virtual appliances > A Gateway Load Balancer works at the third layer (network layer) and lets you deploy, scale and manage virtual appliances such as firewalls and intrusion detection and prevention systems. It exchanges traffic with the appliances using the GENEVE protocol on port 6081. Protection > Protection services filter web requests, absorb DDoS attacks, inspect VPC traffic and manage rules centrally. AWS WAF, AWS Shield Advanced and AWS Firewall Manager are designed to be used together for a comprehensive security solution. + What are AWS WAF, AWS Shield Advanced and AWS Firewall Manager? AWS WAF @aws-waf :: Filter web requests > AWS WAF is a web application firewall that monitors HTTP(S) requests forwarded to protected resources and controls access based on criteria you specify. It can protect resources such as CloudFront distributions, API Gateway REST APIs and Application Load Balancers. AWS Shield @aws-shield :: DDoS protection > Shield Advanced provides protection against distributed denial of service (DDoS) attacks for AWS resources. AWS Network Firewall @aws-network-firewall :: Stateful, managed network firewall and intrusion detection and prevention > Network Firewall filters traffic at the perimeter of your VPC, including traffic to and from an internet gateway, NAT gateway, transit gateway, VPN or Direct Connect. A newer next-generation firewall (NGFW) policy model layers deny-by-default firewall rules with IPS rules, gives each its own capacity and evaluates all rules as stateful. AWS Firewall Manager @aws-firewall-manager :: Central rules across accounts

AWS networking mindmap