AWS Global Accelerator
AWS Global Accelerator gives an application two static anycast IP addresses and routes traffic to them over the AWS global network. Clients enter the AWS backbone at the edge location nearest to them rather than crossing the public internet all the way to the Region.
It is for TCP and UDP traffic. That is the main difference from CloudFront, which caches HTTP responses. Global Accelerator caches nothing; it optimises the path and provides a fixed entry point.
Static IP addresses
Section titled “Static IP addresses”- An accelerator gets two static IPv4 addresses, one from each of two isolated network zones. If one address becomes unreachable — because a client network blocks it, or a network disruption isolates a zone — clients retry on the other.
- A dual-stack accelerator gets four addresses: two IPv4 and two IPv6.
- You can supply your own IPv4 range instead, using BYOIP.
- The addresses stay with the accelerator for as long as it exists, including while it is disabled. Deleting the accelerator releases them.
Each accelerator also gets a DNS name of the form a1234567890abcdef.awsglobalaccelerator.com, and a .dualstack. variant for dual-stack accelerators.
Why anycast helps
Section titled “Why anycast helps”DNS-based failover is limited by caching. Resolvers and clients hold on to an address for the record’s TTL, and sometimes longer; when a server fails, cached addresses keep pointing at it until the cache expires.
Anycast moves failover from DNS to the network. The same address is announced from many locations, and routing sends each client to the nearest healthy one. When an endpoint fails, Global Accelerator stops sending traffic to it and clients reach a healthy endpoint on the same address — no DNS change, no cache to wait for.
The same mechanism improves latency, because the address a client reaches is by definition the closest announcement of it.
Structure
Section titled “Structure”Accelerator. The top-level resource, holding the static IP addresses and one or more listeners. Two types:
- Standard — routes to the optimal AWS endpoint based on client location, endpoint health and the weights you configure. Endpoints can be Network Load Balancers, Application Load Balancers, EC2 instances or Elastic IP addresses.
- Custom routing — deterministically maps a client to a specific EC2 instance and port in a VPC subnet. Used where each user must land on a particular destination, such as a game session. Custom routing accelerators do not support dual-stack.
Listener. Processes inbound connections on a port or port range, for TCP, UDP or both.
Endpoint group. One per AWS Region. A traffic dial raises or lowers the share of traffic sent to a group, which is how blue/green and progressive Regional rollouts are done.
Endpoint. The resource traffic finally reaches. Each has a weight controlling its share within the group.
Where it fits
Section titled “Where it fits”Public applications with a global audience. Users enter the AWS network at the nearest edge instead of traversing the internet end to end.
Regional failover. Health checks remove an unhealthy endpoint group and clients continue on the same addresses. Failover is a network event measured in seconds, rather than a DNS event measured in TTLs.
Applications that need fixed IP addresses. Firewall allow-lists, DNS A records pointing at addresses, and legacy clients that cannot follow a hostname.
Origin masking and DDoS resilience. The accelerator’s addresses are the public entry point; the endpoints behind them are not directly addressed. AWS Shield Standard protects the accelerator.
Hybrid. An accelerator can front an endpoint reached through a transit gateway, which brings the AWS backbone into the path between users and a VPC-routed workload.
Global Accelerator complements Direct Connect rather than replacing it. It optimises the internet path from a client to the AWS edge; it provides no private circuit, no committed bandwidth and no encryption of its own. A requirement for private connectivity is a requirement for Direct Connect or VPN.
Global Accelerator or CloudFront
Section titled “Global Accelerator or CloudFront”| CloudFront | Global Accelerator | |
|---|---|---|
| Protocols | HTTP and HTTPS | TCP and UDP |
| Caching | Yes, at the edge | None |
| Entry point | A distribution domain name | Two static anycast IP addresses |
| Response served from | The edge, on a cache hit | Always the endpoint |
| Best for | Static and cacheable dynamic content, web and video delivery | Non-HTTP protocols, static IPs, fast Regional failover, gaming and VoIP |
They are frequently combined: CloudFront for the website, Global Accelerator for the API or the real-time protocol behind it.