AWS Networking
Reference notes on networking in AWS: how a VPC is put together, how to connect it to other VPCs and to networks outside AWS, and the services that sit in front of an application.
Five sub-areas.
Concepts — the general networking that AWS assumes you already have. The OSI layers and where AWS’s responsibility ends, TCP and UDP, CIDR and address planning, VPC routing and BGP, and the three EC2 network interface types.
VPC — building the network itself: subnets and Availability Zones, internet and NAT gateways, route tables, the two firewalls (security groups and network ACLs), and the built-in DNS resolver. Start here for anything about a single network.
Connectivity — joining networks. VPC peering and transit gateways for VPC-to-VPC, Direct Connect and Site-to-Site VPN for on-premises, PrivateLink and VPC endpoints for reaching one service without joining two networks, and cross-account sharing patterns.
DNS — Route 53: hosted zones, record types, the eight routing policies, cross-account delegation, and cross-Region failover.
Load balancing — the four Elastic Load Balancing types and what each is for, including the Gateway Load Balancer for inserting inspection appliances.
Content delivery — CloudFront for cacheable HTTP, Global Accelerator for TCP and UDP with static IP addresses, and edge compute with Lambda@Edge and CloudFront Functions.
Three places to start
Section titled “Three places to start”- Designing a new VPC: VPC fundamentals, then private IPv4 address planning.
- Connecting to an existing network: connecting an on-premises network to a VPC.
- Deciding how to expose something: Elastic Load Balancing, or AWS PrivateLink if the audience is other AWS accounts rather than the internet.