Cloud Technology and Services · Topic 6 of 11
AWS Network Services
Understand Amazon VPC, subnets, gateways, VPN, Direct Connect, Route 53, CloudFront and Transit Gateway, and which service fits which task on the exam.
- 5 min
- Includes a diagram
- A VPC is your private network in AWS. A subnet is in one Availability Zone.
- Public subnets route to an internet gateway. Private subnets do not.
- A NAT gateway lets private resources reach out to the internet without being reachable from it.
What it is
AWS network services let you build private networks in AWS, connect them to the outside world, and deliver content quickly to users.
The central service is Amazon Virtual Private Cloud (VPC), your own isolated network inside AWS. Around it sit services for internet access, private connections to your office, domain names and content delivery.
The exam tests which service connects what, and the difference between a virtual private network (VPN) and Direct Connect.
How it works
Amazon VPC and subnets
A VPC is a logically separate network in a Region. You choose its private address range, and you divide it into subnets, each of which lives in one Availability Zone.
A public subnet has a route to the internet. A private subnet has no direct route from the internet, and it is the usual place for databases and application servers.
| Component | Job |
|---|---|
| Internet gateway | Lets resources in a VPC reach the internet and be reached |
| NAT (Network Address Translation) gateway | Lets resources in a private subnet start outbound connections, without allowing inbound connections from the internet |
| Route table | Rules that decide where network traffic goes |
| Security group | Instance level firewall, covered in the Security chapter |
| Network access control list (ACL) | Subnet level firewall, covered in the Security chapter |
Connecting VPCs and services
| Option | Use it to |
|---|---|
| VPC peering | Connect two VPCs privately so they can talk to each other |
| AWS Transit Gateway | Connect many VPCs and on premises networks through one central hub |
| VPC endpoint / AWS PrivateLink | Reach AWS services or other services privately without using the internet |
Peering links two VPCs directly and does not pass traffic through a third one. When many networks must be joined, a Transit Gateway is simpler than a mesh of peering connections.
Connecting to your own network
| Option | What it is | Key point |
|---|---|---|
| AWS Site-to-Site VPN | Encrypted tunnel over the public internet | Quick to set up and low cost, but depends on the internet |
| AWS Client VPN | Lets individual users connect securely to AWS | Remote workers |
| AWS Direct Connect | A dedicated private network link from your site to AWS | More consistent performance, but takes longer to arrange |
Choose a VPN for a fast, low cost start. Choose Direct Connect when you need steady bandwidth and delay, such as for large data transfers.
Direct Connect does not encrypt traffic by default. Some customers run a VPN over it when they also need encryption.
Domain names and content delivery
Amazon Route 53 is a highly available Domain Name System (DNS) service. It translates names like example.com into IP addresses, can register domains, and can check the health of endpoints.
Route 53 offers routing policies, such as simple, weighted, latency based, failover and geolocation. For example, latency based routing sends users to the Region that responds fastest.
Amazon CloudFront is a content delivery network (CDN). It caches copies of content at edge locations so users get it from a nearby place.
AWS Global Accelerator gives your application fixed entry IP addresses and sends traffic over the AWS global network to the best healthy endpoint. Use it for non cacheable traffic or when you need static addresses, and use CloudFront for cacheable web content.
Interfaces and load balancing
Amazon API Gateway creates, publishes and manages application programming interfaces (APIs). Elastic Load Balancing spreads traffic across targets, as covered on the compute page.
What to remember for the exam
- A VPC is your private network in AWS. A subnet is in one Availability Zone.
- Public subnets route to an internet gateway. Private subnets do not.
- A NAT gateway lets private resources reach out to the internet without being reachable from it.
- VPC peering connects two VPCs. Transit Gateway connects many networks.
- Site-to-Site VPN is encrypted over the internet. Direct Connect is a dedicated private link.
- Route 53 is DNS with several routing policies and health checks.
- CloudFront caches content at edge locations. Global Accelerator provides static IP addresses and uses the AWS network.
- PrivateLink and VPC endpoints give private access to services.
"Dedicated connection" or "consistent bandwidth" means Direct Connect. "Quick and low cost" or "encrypted over the internet" means Site-to-Site VPN.
Common mistakes
Putting a database in a public subnet. Databases should sit in private subnets and be reached through the application tier.
Treating VPC peering as transitive. Traffic does not flow through one peered VPC to reach another.
Confusing CloudFront with Route 53. CloudFront delivers content. Route 53 answers name lookups.
Assuming Direct Connect is encrypted. It is private, but not encrypted by default.
A subnet is not the same as an Availability Zone. A subnet lives inside exactly one AZ, but an AZ can hold many subnets.
Check yourself
Which service creates a dedicated private link between your site and AWS?
AWS Direct Connect.
What lets instances in a private subnet reach the internet without being reachable from it?
A NAT gateway.
Which service caches content at edge locations to speed up delivery?
Amazon CloudFront.
Topic 6 of 11 in Cloud Technology and Services
Test yourself on Cloud Technology and Services
The full AWS CLF-C02 question bank has 832 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.