High-performing network architectures

Plan IP addresses so networks can grow and connect, place resources close to users, use the edge for global reach, pick the right load balancer, and choose the connection type that meets the bandwidth and latency target.

VPC design

• IP addressing: Pick CIDR ranges that don't overlap with other VPCs or on-premises networks you may connect, and leave room to grow. A VPC can add secondary CIDR blocks later.
• Subnet tiers: One public and one or more private subnets in each AZ you use. AWS reserves five addresses in every subnet.
• Dual-stack (IPv4 and IPv6) subnets avoid IPv4 exhaustion; Amazon VPC IP Address Manager (IPAM) plans and tracks addresses across accounts.

Edge networking

• Amazon CloudFront: A CDN that caches content at edge locations and speeds up dynamic content over the AWS network. Supports signed URLs and cookies, origin failover, and code at the edge.
• AWS Global Accelerator: Static anycast IPs that carry TCP and UDP traffic over the AWS network to the closest healthy endpoint. No caching. Good for gaming, VoIP, IoT, and apps that need fixed IPs.
• CloudFront: cacheable HTTP content. Global Accelerator: non-HTTP protocols, static IP addresses, or fast regional failover.

Load balancing strategy

• ALB for HTTP and HTTPS with content-based routing (microservices behind one load balancer by path or host).
• NLB for TCP or UDP, extreme throughput, low latency, static or Elastic IP addresses per AZ, or when clients must allowlist IPs.
• Gateway Load Balancer to insert inspection appliances transparently.
• Cross-zone load balancing spreads requests evenly across all registered targets in every AZ.

Connecting networks

• VPC peering: A private one-to-one link between two VPCs, in the same or different Regions. Not transitive, and CIDRs can't overlap.
• AWS Transit Gateway: A Regional hub that connects many VPCs and on-premises networks with transitive routing, and peers with other Regions. Replaces a mesh of peering links.
• AWS PrivateLink: Exposes one service to consumers in other VPCs or accounts through interface endpoints. One direction only, and overlapping CIDRs are fine.
• AWS Site-to-Site VPN: Encrypted tunnels over the internet. Fast to set up; good as a backup for Direct Connect.
• AWS Direct Connect: Dedicated private connections for consistent latency and high bandwidth. For resiliency, use connections at two Direct Connect locations; a Direct Connect gateway reaches VPCs in many Regions.

Placing resources

• Choose the Region closest to most users, subject to data residency and service availability.
• Local Zones put compute and storage in large metro areas; Wavelength puts it inside 5G networks; Outposts puts it in your data center.
• Keep chatty components in the same AZ (or a cluster placement group) when latency matters more than spreading for resilience.