Network services

An Amazon VPC is your private network in AWS. Know its components, the two layers of network security, DNS with Route 53, and how to connect on-premises networks.

VPC components

• Amazon VPC: A logically isolated virtual network you define in a Region.
• Subnets: Ranges of IP addresses in one AZ. Public subnets route to an internet gateway; private subnets don't.
• Internet gateway: Allows communication between a VPC and the internet.
• NAT gateway: Lets instances in private subnets reach out to the internet without accepting inbound connections.
• Route tables: Rules that decide where network traffic from a subnet is directed.
• AWS Transit Gateway: A hub that connects many VPCs and on-premises networks.
• AWS PrivateLink: Private connectivity from a VPC to AWS services or other VPCs' services without using the public internet.

Security in a VPC

• Security groups: Virtual firewalls at the instance (network interface) level. Stateful: return traffic is allowed automatically. Allow rules only.
• Network ACLs: Firewalls at the subnet level. Stateless: you must allow both inbound and outbound traffic. Support allow and deny rules.
• Amazon Inspector: Also checks network reachability, flagging instances unintentionally exposed to the internet.

DNS and edge networking

• Amazon Route 53: Highly available DNS service: domain registration, DNS routing (for example latency-based, geolocation, failover), and health checks.
• Amazon CloudFront: Content delivery network that caches content at edge locations.
• AWS Global Accelerator: Routes user traffic over the AWS global network using static anycast IP addresses to improve availability and performance.
• Amazon API Gateway: Create, publish, and secure APIs at any scale.

Connecting to AWS

• AWS Site-to-Site VPN: Encrypted IPsec tunnel between your network and a VPC over the public internet. Quick to set up.
• AWS Client VPN: Managed VPN for individual users' devices to reach AWS or on-premises networks.
• AWS Direct Connect: A dedicated private network connection from your premises to AWS. More consistent performance and doesn't traverse the public internet; takes longer to provision.