AWS Networking Specialty cheat sheet

VPC CIDR blocks must be /16 to /28; a subnet must be at least /28 and cannot exceed the VPC range.

Each subnet reserves 5 addresses: network address, VPC router, DNS, future use, and broadcast; a /28 subnet yields 11 usable IPs.

VPC peering is non-transitive: A-B and B-C peering does not connect A to C; use Transit Gateway for hub-and-spoke.

Transit Gateway supports up to 5,000 attachments per gateway and allows transitive routing across VPCs, VPNs, and Direct Connects.

Route table longest-prefix match wins; local routes cannot be overridden or deleted, and more specific prefixes beat propagated routes.

Direct Connect gateway lets one private virtual interface reach VPCs in multiple regions, but only VPCs in the same AWS partition.

Use PrivateLink (interface VPC endpoint) when consumers must reach a service without CIDR overlap or peering.

For hybrid designs, prefer DX for steady high-volume traffic and Site-to-Site VPN over the internet as backup or for fast setup.

A NAT gateway must live in a public subnet with an Internet Gateway route; it supports 55,000 simultaneous connections per destination.

Internet Gateway is horizontally scaled and redundant; attaching it to a VPC is required before any public IPv4 routing works.

Security groups are stateful and allow-only; NACLs are stateless and evaluated in numbered order, lowest first, with an implicit deny.

VPC endpoints: gateway endpoints (S3, DynamoDB) use route table prefix lists; interface endpoints use ENIs with private IPs.

Route 53 Resolver inbound endpoints let on-premises DNS query AWS names; outbound endpoints forward AWS queries to on-premises resolvers.

Transit Gateway Connect attaches SD-WAN appliances over GRE with BGP, avoiding separate VPN tunnels per attachment.

Direct Connect virtual interfaces: private VIF to VPC via VGW or DX gateway, public VIF to AWS public services, transit VIF to Transit Gateway.

BGP over Site-to-Site VPN supports dynamic routing; static VPNs require manual route updates and do not fail over automatically.

VPC Flow Logs capture ACCEPT/REJECT records at VPC, subnet, or ENI level; they do not capture packet payloads or DNS query names.

Flow log fields include srcaddr, dstaddr, srcport, dstport, protocol, packets, bytes, action, and log-status for delivered records.

Reachability Analyzer tests a path between source and destination without sending traffic; Network Access Analyzer checks resource-policy compliance.

CloudWatch Network Monitor measures packet loss and latency on paths to specified destinations from source subnets.

Transit Gateway Network Manager shows global network topology and events across TGW, DX gateways, and VPN attachments.

Route 53 health checks can monitor endpoint IPs or CloudWatch alarms; failover routing requires health checks on primary records.

Traffic Mirroring copies ENI traffic to a target for inspection; it does not block traffic and adds no inline latency.

AWS Network Firewall is a managed stateful firewall with Suricata-compatible rules; it is deployed per Availability Zone in a firewall subnet.

Security group rules are allow-only; deny requires NACLs, Network Firewall, or SG referencing another SG as source.

NACL rules are evaluated lowest number first; a rule number change is required to reorder, and both inbound and outbound rules are independent.

AWS Shield Standard is automatic and free; Shield Advanced adds DDoS cost protection, response team access, and WAF integration.

AWS WAF operates at layer 7 on CloudFront, ALB, API Gateway, and AppSync; rule groups are evaluated by priority number.

GuardDuty findings such as UnauthorizedAccess:EC2/SSHBruteForce use VPC Flow Logs and DNS logs, not packet capture.

AWS Config rules can detect public S3 buckets or unrestricted security groups; conformance packs bundle rules for compliance frameworks.

VPC Reachability Analyzer and IAM Access Analyzer support governance by documenting reachable paths and external access.

Direct Connect MACsec encrypts layer 2 links; for in-transit encryption over VPN use IPsec, and TLS for application traffic.

AWS-recommended multi-account pattern: a shared-services VPC hosts Transit Gateway and inspection, with spoke VPCs attached.

Transit Gateway route tables can segment traffic; use separate TGW route tables for production and non-production isolation.

DX gateway association with a Transit Gateway allows one private VIF to reach many VPCs; BGP is required for dynamic routing.

VPC sharing via AWS RAM lets multiple accounts launch resources into a shared subnet; the owner controls the subnet and routing.

For overlapping CIDRs, use PrivateLink or AWS Private NAT Gateway with a Transit Gateway to translate addresses.

Site-to-Site VPN supports up to 1.25 Gbps per tunnel; use ECMP across multiple tunnels for higher aggregate throughput.

Route 53 alias records point to AWS resources without charge and can be used at the zone apex; CNAMEs cannot.

Application Load Balancer operates at layer 7 with host/path routing; Network Load Balancer preserves source IP and handles millions of flows at layer 4.

NLB cross-zone load balancing is off by default; ALB cross-zone is on by default and free.

Route 53 Resolver rules can be shared across accounts with AWS RAM; rules determine which domains forward to on-premises.

Elastic IP addresses are regional and can be remapped; they are required for NAT instances and some NLB use cases.

AWS Global Accelerator uses anycast IPs and provides deterministic routing; CloudFront caches content at edge locations.

VPC Flow Logs can be delivered to CloudWatch Logs, S3, or Kinesis Data Firehose; S3 delivery is the most cost-effective for retention.

Flow log records show NODATA for no traffic in the aggregation interval and SKIPDATA when records are dropped.

CloudWatch metrics for NAT Gateway include ActiveConnectionCount, BytesOutToDestination, and ErrorPortAllocation.

Transit Gateway metrics include BytesIn, BytesOut, PacketDropCountBlackhole, and PacketDropCountNoRoute.

VPC Reachability Analyzer explains why a path fails, such as a missing route, security group rule, or NACL deny.

AWS Network Manager events aggregate CloudWatch alarms across TGW, DX, and VPN for centralized operations.

DNS query logging in Route 53 Resolver records queries from VPCs; it does not capture queries to public resolvers.

Site-to-Site VPN uses IPsec; configure pre-shared keys or certificates, and use BGP for dynamic routing and failover.

Direct Connect does not encrypt by default; use MACsec on supported links or a VPN over DX for encryption.

AWS PrivateLink traffic stays on the AWS network and does not traverse the internet; endpoint policies restrict which principals can use it.

VPC endpoint policies can allow or deny access based on principal, resource, and source VPC; they apply to interface and gateway endpoints.

Security group referencing allows traffic only from resources in the referenced SG, reducing CIDR-based rules.

AWS Network Firewall supports stateful rule groups, domain lists, and Suricata rules for egress filtering and IDS/IPS.

AWS Shield Advanced provides DDoS cost protection and 24/7 access to the AWS DDoS Response Team.

AWS Config conformance packs bundle managed and custom rules to evaluate resources against a compliance framework.

AWS Audit Manager collects evidence from CloudTrail, Config, and Security Hub for network-related controls.

Security Hub aggregates findings from GuardDuty, Inspector, and Firewall Manager into standardized controls.

AWS Firewall Manager centrally deploys WAF rules, Shield Advanced protections, and security groups across accounts in an organization.

VPC Flow Logs and CloudTrail are commonly required for audit trails; retain logs per your compliance retention policy.

Tag policies and SCPs govern which network resources can be created and where, enforcing organizational standards.

Plan CIDR blocks to avoid overlap with on-premises and other VPCs; overlap blocks peering and requires PrivateLink or NAT translation.

Use /16 VPCs with /24 subnets for room to grow; reserve contiguous ranges for future AZs and inspection VPCs.

IPv6 in VPCs is /56 per VPC and /64 per subnet; egress-only internet gateway provides outbound-only IPv6 access.

Route table entries can target IGW, NAT gateway, TGW, VGW, peering connection, or ENI; each target type has distinct scope.

Prefix lists group CIDRs for reuse in route tables and security groups; AWS-managed prefix lists cover S3 and DynamoDB.

For active-active hybrid, use BGP with equal-cost multipath across multiple DX or VPN attachments.

Site-to-Site VPN tunnels are provisioned in two AZs for redundancy; each tunnel has a public IP and pre-shared key.

Direct Connect hosted connections are provisioned by an AWS Partner; dedicated connections are ordered directly from AWS.

DX link aggregation groups (LAGs) bundle up to 4 connections for higher bandwidth and redundancy.

Transit Gateway supports up to 50 Gbps per attachment and scales automatically; VPC attachments are per-AZ.

AWS Client VPN provides remote access using OpenVPN; it requires a client CIDR, target subnet association, and authorization rules.

VPC peering requires routes in both VPCs and security group rules that allow the peer CIDR or referenced SG.

CloudFormation and Terraform can manage VPCs, route tables, and TGW attachments; drift detection identifies manual changes.

AWS Systems Manager Automation can remediate network findings, such as removing unrestricted security group rules.

CloudWatch alarms on NAT Gateway ErrorPortAllocation indicate port exhaustion; scale with additional NAT gateways.

VPC Flow Logs analysis with Athena requires a partitioned table and a crawler or manual DDL over the S3 bucket.

Transit Gateway route table propagation and association must be configured per attachment; default association is optional.

Use AWS Network Manager to visualize on-premises and AWS topology and to receive route and tunnel event notifications.

AWS Shield Standard protects all AWS customers against common layer 3/4 DDoS attacks at no extra cost.

Shield Advanced requires a subscription and provides enhanced detection, cost protection, and DRT engagement.

AWS WAF rate-based rules throttle requests from a single IP over a five-minute window.

CloudFront and Shield Advanced integrate to absorb volumetric attacks at edge locations before reaching origins.

AWS Network Firewall can filter egress traffic to allowed domains using stateful domain lists.

Security groups cannot deny traffic; use NACLs or Network Firewall for explicit deny requirements.

Service control policies can deny creation of internet gateways or public subnets in specific accounts.

AWS Config rules such as restricted-ssh and restricted-common-ports detect noncompliant security groups.

CloudTrail data events can log S3 and Lambda activity; management events log VPC and route table changes.

AWS Firewall Manager policies apply to all accounts in an organization and auto-remediate noncompliant resources.

VPC Flow Logs retention should align with compliance requirements; S3 lifecycle policies can transition logs to colder storage.

AWS Audit Manager and Security Hub provide evidence and control status for network security frameworks.