Skip to main content
Welcome to the overview of Domain 5. In this lesson, we dive into the critical topics of networking and content delivery—fundamental components for hosting and managing modern applications. This guide explores Virtual Private Clouds (VPCs), DNS resolution, global content delivery, and network security, complemented by technical diagrams.

​
Virtual Private Clouds (VPCs) and Subnets

At the heart of your network infrastructure is the Virtual Private Cloud (VPC). A VPC creates an isolated region in which you can define and manage your subnets, typically separated into private and public segments across multiple availability zones. The key elements include:
  • Internet Gateway (IGW): Attach an IGW to your VPC to secure internet connectivity.
  • Route Tables: Associate route tables with subnets to dictate traffic flow.
  • NAT Gateways and Egress-Only Gateways: These gateways enable secure traffic routing from private subnets to the internet.
Additionally, core networking concepts such as default routes, subnet associations, and session management via Session Manager were thoroughly reviewed. Session Manager provides secure connections to systems residing in both public and private subnets, utilizing AWS Key Management Service (KMS) for encryption, comprehensive logging, session timeout management, and profile configurations.
The image illustrates the setup of an Internet Gateway within a VPC, showing steps like creating an IGW, attaching it to a VPC, and configuring route tables. It includes a diagram of a region with a public subnet and associated route table.

​
Traffic Management and Network Interfaces

Effective management of network traffic is paramount. This section highlights strategies to ensure that data does not unnecessarily traverse the public internet:
  • VPC Gateway and Interface Endpoints: Utilize these endpoints to secure and streamline traffic.
  • Elastic Network Interfaces (ENIs) and Elastic Fabric Adapters (EFAs): In addition to standard ENIs, high-speed networking options such as ENAs and EFAs are available for enhanced performance.

​
VPC Connectivity Methods

Connecting multiple VPCs can be achieved via two primary methods:
  1. VPC Peering
    VPC peering involves sending and accepting peering requests along with configuring necessary routes. This method is effective for global connectivity but may not be as scalable for larger environments.
The image illustrates a VPC peering connection between two Virtual Private Clouds (VPCs) with IP ranges 10.10.0.0/16 and 10.10.1.0/16, showing the process of sending and accepting a peering request to establish the connection.
  1. Transit Gateway
    The transit gateway is designed for complex networking scenarios, supporting connections across multiple VPCs, customer gateways, VPNs, and corporate SD-WANs.
The image is a diagram illustrating an AWS Transit Gateway setup, showing connections between Amazon VPCs, customer gateways, VPN connections, and corporate SD-WANs. It includes various network components and connection types like GRE tunnels and BGP peering.
Other connectivity options include site-to-site VPN for linking AWS networks with on-premise data centers and AWS Direct Connect for establishing dedicated physical connections, thereby bypassing the public internet.
The image illustrates a Site-to-Site VPN architecture, showing a connection between a Virtual Private Cloud (VPC) in a cloud region and an on-premise network via a VPN connection.
The image illustrates an AWS Direct Connect setup, showing the connection between an AWS region with VPCs and a customer network through Direct Connect and virtual interfaces. It includes components like AWS EC2 instances, Direct Connect routers, and customer gateways.
Client VPN was also briefly addressed as an extension of networking capabilities, further enhancing secure access across diverse network setups.

​
Domain Name System (DNS)

A robust Domain Name System (DNS) setup is essential for directing traffic efficiently. Key topics in this area include:
  • Public vs. Private Hosted Zones: Differentiating between zones to manage where and how website requests are served.
  • Routing Policies: Explore various routing policies such as latency-based, geolocation, and weighted routing, among others, to optimize traffic direction.
  • Route 53 Resolver: This service handles both inbound and outbound DNS queries, facilitating smooth resolution within your VPC.
The image illustrates the traffic routing process for a domain using Amazon Route 53, showing the flow from an end user to various DNS servers and finally to the web server. It includes steps involving the DNS resolver, DNS root name server, TLD name server, and Amazon Route 53 name server.
The image lists different types of routing policies, including Simple, Failover, Geolocation, Geoproximity, Latency, IP-Based, Multivalue Answer, and Weighted Routing Policies. Each policy is represented with an icon and a label.
The image illustrates the direction of DNS queries with three diagrams: "Inbound and Outbound," "Inbound Only," and "Outbound Only," showing different flow directions between servers and the cloud.

​
Global Content Delivery and Caching

Optimizing content delivery on a global scale can significantly improve user experience. Important services in this area include:
  • CloudFront: Caches content closer to the end user, reducing latency and accelerating performance.
  • Global Accelerator: Enhances traffic routing by optimizing the network paths, albeit mentioned briefly.
  • Field-Level Encryption: CloudFront supports encryption of specific data fields to secure sensitive information.
  • Hosting Static Sites on S3: A popular and cost-effective method for serving static websites.
The discussion also covered cache behavior, origin server management (e.g., S3 buckets and EC2 instances), and strategies for refreshing caches as needed.
The image illustrates how cache behavior in CloudFront directs requests to different origins, such as an S3 bucket for images and an EC2 instance for applications. It shows users making requests that are routed based on the cache behavior configuration.

​
Security and Data Capture

Security is a critical pillar in network design. Topics in this section include:
  • Potential risks from misconfigured firewalls and route tables.
  • Network security best practices through AWS Direct Connect—while noting that additional MACsec encryption is recommended for enhanced security.
Monitoring and diagnosing network issues rely on various logging tools such as:
  • VPC Flow Logs
  • Transit Flow Logs
  • Load Balancer Logs
  • S3 Access Logs
The image lists data captured by VPC Flow Logs, including source and destination IPs, ports and protocols, volume of data, and traffic status.
Always ensure that firewalls, route tables, and encryption standards are correctly configured to protect your networks from vulnerabilities.

​
Conclusion

This comprehensive review of Domain 5 has walked you through building secure and scalable network architectures—from setting up VPCs and configuring DNS to optimizing performance with global content delivery and ensuring robust security. Mastering these concepts is essential for anyone involved in designing and managing cloud network infrastructures. We now move on to Domain 6. Thank you for following along, and see you in the next lesson!

Watch Video