SERVICE DOMAIN
Networking
Build isolated and secure cloud networks.PUBLIC NOTES
Knowledge Notes
Bastion Host
A controlled administrative entry point in a public subnet used to reach private EC2 instances.
→IPv6 & Egress-only Internet Gateway
An EIGW gives publicly routable IPv6 workloads outbound-only internet access, permits related return traffic, and performs no NAT.
→NAT Instance
A customer-managed EC2 instance that forwards and translates outbound IPv4 traffic for private workloads.
→VPC Flow Logs
Records ENI traffic metadata such as peers, ports, byte counts, and ACCEPT or REJECT decisions.
→VPC Peering
A direct, non-transitive private connection between two VPCs with non-overlapping CIDRs.
→VPC Traffic Mirroring
Copies packets from supported ENIs to monitoring appliances while production traffic continues on its normal path.
→Amazon CloudFront
A content delivery network that caches content at edge locations and protects private origins.
→Amazon Route 53
AWS DNS service for domain registration, name resolution, health checks, and policy-based traffic routing.
→AWS Global Accelerator
Provides static anycast IP addresses and routes TCP/UDP traffic over the AWS global network to healthy regional endpoints.
→Elastic Load Balancing
Distributes traffic across healthy targets to improve availability and scale application entry points.
→AWS Networking Interview Guide
Troubleshoot AWS networking layer by layer across DNS, routes, subnet controls, load balancing, and host services.
→AWS Direct Connect
A dedicated private network connection between on-premises environments and AWS for consistent bandwidth and latency.
→AWS Client VPN
A managed remote-access VPN that connects individual users securely to AWS and connected networks.
→AWS PrivateLink and VPC Endpoints
Private access to AWS or endpoint services from a VPC without traversing the public internet.
→AWS Site-to-Site VPN
Encrypted IPsec connectivity between an on-premises network and a VPC or Transit Gateway over the internet.
→AWS Transit Gateway
A regional hub that connects many VPCs and on-premises networks through centralized routing.
→Internet Gateway
A highly available internet entry and exit point attached to a VPC; it does not automatically make every resource publicly reachable.
→Security Group
A stateful, allow-only virtual firewall attached to an ENI or supported resource, central to resource-level least privilege in AWS.
→Subnet & Route Table
A subnet divides the VPC address space and belongs to one Availability Zone; a route table selects the next hop based on the destination.
→VPN Components: VGW and Customer Gateway
A Site-to-Site VPN connects the AWS-side gateway with a customer-side device definition through redundant tunnels.
→Amazon VPC
A logically isolated network in an AWS Region where you define address ranges, subnets, routes, and security controls.
→NAT Gateway
Gives private IPv4 resources outbound access to the internet or public services without accepting internet-initiated connections.
→Network ACL
A stateless subnet-boundary access control list that supports both allow and deny rules.
→TOPIC INDEX