Course PreviewAWS Networking
AWS networking provides the virtual network infrastructure for cloud workloads: VPCs, subnets, route tables, gateways, load balancers, and DNS. It controls how traffic flows between resources, the internet, and on-premises environments.
itCloud computing | OpenSkills.info
Intro
AWS Networking
AWS networking decides which systems can communicate, which path their packets take, and where traffic is allowed to cross a trust boundary. Amazon Virtual Private Cloud, or Amazon VPC, is the foundation. A VPC is a logically isolated virtual network in one AWS Region.
The useful mental model has four parts:
- Address the network with non-overlapping IPv4 or IPv6 ranges.
- Place resources in subnets tied to Availability Zones.
- Route traffic toward a gateway, endpoint, connection, or local destination.
- Filter traffic close to resources and, when needed, at subnet boundaries.
Most AWS networking failures come from one broken part of that chain. A route cannot override a security rule. A security rule cannot create a route. DNS can return a correct address while the packet path still fails.
VPCs, subnets, and addresses
A VPC owns one or more CIDR blocks. CIDR notation defines an address range and its prefix length. Plan ranges before connecting networks. VPC peering rejects overlapping CIDR blocks, and shared address space makes later connectivity harder.
A subnet is an address range inside a VPC. Each subnet exists in exactly one Availability Zone. Spread application tiers across subnets in multiple zones when the workload must tolerate a zone failure.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html
Supports
- VPC as a logically isolated virtual network
- VPC feature map covering subnets, addressing, routing, gateways, endpoints, peering, Transit Gateway, Flow Logs, and VPN
- VPC and selected component pricing boundaries
- https://docs.aws.amazon.com/vpc/latest/userguide/configure-subnets.html
Supports
- Subnet as an IP range confined to one Availability Zone
- Public, private, VPN-only, and isolated subnet definitions
- Subnet route-table association and multi-zone placement
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html
Supports
- Network interface as a logical VPC networking component
- Private and public IP address attributes
- Security groups associated with a network interface
- https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html
Supports
- Implicit VPC router and per-subnet route-table association
- Destination and target structure, local routes, and longest prefix match
- Separate IPv4 and IPv6 default routes
- https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html
Supports
- Internet gateway routing and public-subnet definition
- Public addressing requirements for internet communication
- One-to-one IPv4 address translation performed by the internet gateway
- https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html
Supports
- Public and private NAT gateway behavior
- Outbound initiation from private subnets and rejection of unsolicited inbound initiation
- Public NAT gateway placement, Elastic IP use, and route through an internet gateway
- https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html
Supports
- Resource-associated inbound and outbound allow rules
- Stateful response behavior
- Protocol, port, source, and destination rule fields
- https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
Supports
- Subnet-level allow and deny filtering
- Ordered first-match evaluation by rule number
- Stateless request and response handling
- https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
Supports
- Capture of IP traffic metadata for network interfaces
- VPC, subnet, and network-interface logging scope
- Delivery to CloudWatch Logs, Amazon S3, or Data Firehose
- Diagnosis of restrictive security rules and observed traffic direction
- https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-basics.html
Supports
- Accepted, rejected, or all-traffic capture choices
- Flow-log records and monitored network interfaces
- https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html
Supports
- One-to-one VPC peering relationship and manual routes
- Non-transitive routing
- Rejection of overlapping CIDR blocks
- https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html
Supports
- Transit Gateway as a Regional layer-three virtual router
- VPC, VPN, Direct Connect gateway, and peering attachments
- Attachment and transit route-table behavior
- https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html
Supports
- Private service and resource connectivity through VPC endpoints
- Access without internet gateways, NAT devices, public IP addresses, VPN, or Direct Connect
- Service-specific connectivity rather than general network reachability
- https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html
Supports
- IPsec connectivity between a VPC and remote network
- Two tunnels in each VPN connection
- Virtual private gateway and transit gateway endpoint roles
- https://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html
Supports
- Dedicated Ethernet connection through a Direct Connect location
- Bypass of internet service providers in the network path
- Public and private virtual interfaces
- https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html
Supports
- Private DNS answers for associated VPCs
- Resolution through associated VPCs and hybrid inbound endpoints
- https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/what-is-load-balancing.html
Supports
- Distribution across registered targets and Availability Zones
- Health checks and routing to healthy targets
- https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-application-load-balancer.html
Supports
- Internet-facing and internal load balancer schemes
- Private connectivity requirement for internal load balancers
- https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/introduction.html
Supports
- Comparison of VPC-to-VPC, hybrid, and remote-access connectivity patterns
- Decision context for peering, Transit Gateway, PrivateLink, VPN, Direct Connect, and Cloud WAN