AWS Advanced Networking

Users should meet your network close to where they are. You compare CloudFront and Global Accelerator, place protection at the edge, and decide which traffic should ever travel to the origin.

• CloudFront distributions, origins and cache behavior
• Global Accelerator and anycast entry points
• Choosing between CDN and accelerator
• Edge protection with WAF and Shield
• Origin protection and private origins
• Custom domains, certificates and TLS at the edge

You build An edge design for a global application with origin lockdown and a cache plan.

DNS decides where users and systems go. You design public and private zones, pick routing policies for latency and failover, and organize naming across many accounts and VPCs.

• Public and private hosted zones
• Routing policies: latency, weighted, geolocation and failover
• Health checks and failover behavior
• Sharing private zones across accounts and VPCs
• Alias records and record design
• Signing zones with DNSSEC

You build A DNS architecture with failover routing and shared private zones.

Load balancers are where performance and availability meet. You choose between the balancer types, configure targets, health checks and TLS, and plan how each handles zone loss and traffic spikes.

• Application, Network and Gateway Load Balancers compared
• Target types, health checks and deregistration
• TLS termination and end-to-end encryption
• Cross-zone behavior and client IP preservation
• Path, host and header routing
• Inserting inspection appliances with Gateway Load Balancer

You build A load balancing design for a mixed web and TCP workload with measured failover.

Routing mistakes create outages that are hard to see. You learn how AWS chooses between routes, how BGP advertisements interact with static and propagated routes, and how to keep segments separate while still connected.

• Route selection and longest prefix match
• BGP essentials: attributes, prepending and communities
• Transit Gateway route tables and segmentation
• Peering, Transit Gateway and Cloud WAN compared
• Asymmetric routing and how to avoid it
• Designing for overlapping address space

You build A routing design with segmented environments and a route table per segment.

Dedicated links and tunnels are how data centers join the cloud. You build resilient Direct Connect and Site-to-Site VPN connections, advertise routes correctly and plan the failover between them.

• Direct Connect locations, virtual interfaces and link aggregation
• Resilience models for Direct Connect
• Site-to-Site VPN tunnels and BGP
• VPN over Direct Connect and accelerated VPN
• Direct Connect gateways and transit interfaces
• Encrypting links with MACsec and IPsec

You build A hybrid link design with Direct Connect primary, VPN backup and tested failover.

As the number of VPCs grows, point-to-point links stop scaling. You implement Transit Gateway, peering, PrivateLink and shared services patterns, and choose the right one for each connection.

• VPC peering limits and when it still fits
• Transit Gateway attachments and cross-Region peering
• PrivateLink for service exposure
• Application-level connectivity with VPC Lattice
• Shared services and inspection VPCs
• Cross-account sharing with Resource Access Manager

You build A multi-VPC network connected through Transit Gateway with a shared services VPC.

Names must resolve both ways between cloud and data center. You build Resolver endpoints and forwarding rules, share them across accounts, and fix the loops and gaps that appear when two DNS systems meet.

• Inbound and outbound Resolver endpoints
• Forwarding rules and rule sharing
• Resolution order and conflicts between zones
• On-premises DNS integration
• Query logging and troubleshooting
• Scaling and capacity of Resolver endpoints

You build A hybrid DNS setup that resolves names in both directions across accounts.

Manual network changes are slow and risky. You define networks as code, manage IP space programmatically, and roll changes through pipelines with checks that catch routing mistakes before they apply.

• Networks in CloudFormation and CDK
• IP address management automation
• Change review and drift detection for network resources
• Pipelines with pre-deployment connectivity tests
• Central visibility with Network Manager
• Reusable network modules

You build A network defined as code and deployed through a pipeline with connectivity checks.

Network faults hide in routes, rules and resolvers. You use flow logs, traffic mirroring and path analysis to find where packets stop, and build a method for narrowing down any connectivity problem.

• VPC Flow Logs formats and queries
• Traffic Mirroring and packet capture
• Reachability Analyzer and path analysis
• Network Access Analyzer for unintended paths
• A layered method for connectivity faults
• Reading load balancer and Resolver logs

You build A troubleshooting guide with flow log queries for six common connectivity failures.

A network that works can still be slow or expensive. You tune throughput, MTU and instance networking, remove single points of failure, and cut data transfer charges that come from design choices.

• Bandwidth limits, MTU and jumbo frames
• Enhanced networking and placement groups
• Latency measurement across Regions and links
• Eliminating single points of failure
• Data transfer pricing across paths
• NAT, endpoints and egress cost reduction

You build A network review with measured throughput, failure points and a cost reduction list.

Network security is layered controls plus proof they work. You apply stateful and stateless filtering, inspect traffic, encrypt data in transit and use monitoring and logs to show that the rules do what you intended.

• Security groups and network ACLs together
• AWS Network Firewall rule design
• Central policy with Firewall Manager
• Encrypting traffic between sites and services
• Auditing rules and flow data
• Meeting compliance requirements for network segmentation

You build A network security design with inspection, encryption and an audit procedure.

Design and build one complete network. You plan addressing, connect a data center and many accounts, add DNS, edge and security, then test failure and trace problems the way an operations team would.

• Gathering network requirements and constraints
• Designing topology, routing and DNS
• Building and automating the network
• Breaking links on purpose and tracing the effects
• Documenting the design and its runbooks

You build A tested hybrid network design with routing tables, DNS plan and failure results.