Networking and Content Delivery
What you must know
VPC design (subnets, route tables, internet/NAT gateways, VPC peering, Transit Gateway, PrivateLink/endpoints); security groups and NACLs; Elastic Load Balancing (ALB vs NLB vs GWLB); Route 53 routing policies; CloudFront distributions, origins, and cache behaviors; Global Accelerator; Direct Connect and Site-to-Site VPN; VPC Flow Logs; Reachability Analyzer.
Traps that show up in questions
- ALB is Layer 7 (HTTP/HTTPS, host/path routing, WebSocket); NLB is Layer 4 (TCP/UDP, ultra-low latency, static IP, preserves source IP). A question about static IPs or non-HTTP protocols wants NLB.
- NAT gateway allows outbound internet for private subnets; it does not allow inbound. It lives in a public subnet and needs an Elastic IP.
- Gateway endpoints (S3, DynamoDB) are free and route-table based; interface endpoints (PrivateLink) cover most other services and cost per hour/GB.
- VPC peering is non-transitive - A↔B and B↔C does not give A↔C. Use Transit Gateway for hub-and-spoke.
- CloudFront caching: default TTL 24 hours; invalidations cost money beyond the free tier. Versioned object names avoid invalidations.
- Route 53 weighted vs latency vs geolocation: weighted splits by proportion, latency routes to the lowest-latency Region, geolocation by user location.
- Flow Logs capture metadata, not packet payloads.
Worked rule of thumb
To reach an AWS service privately from a private subnet without internet: use a gateway endpoint for S3/DynamoDB, otherwise an interface endpoint in the subnet's AZ with a security group allowing 443 from the VPC CIDR. If a question mentions "without traversing the internet," endpoint or PrivateLink is the answer.