AWS Networking Specialty key terms

A private one-to-one connection between two VPCs that lets resources route traffic using private IP addresses. It does not support transitive routing, so each pair of VPCs must be connected directly.

A regional hub that connects VPCs, VPNs, and Direct Connect gateways through a single attachment point. It supports transitive routing and route tables that control which attachments can reach each other.

A globally available object that links multiple virtual private gateways or Transit Gateway attachments to private virtual interfaces, allowing one Direct Connect connection to reach VPCs in several Regions.

A logical BGP session and VLAN pair on a Direct Connect connection. Private virtual interfaces reach VPCs, public ones reach AWS public services, and transit ones attach to a Transit Gateway.

The routing protocol used to exchange prefixes between customer routers and AWS over VPN or Direct Connect. It carries AS numbers, communities, and prefix attributes that influence path selection.

An Autonomous System Number identifying a routing domain in BGP. AWS assigns or accepts ASNs for VPN and Direct Connect peers, and the value affects which paths are preferred.

An encrypted IPsec tunnel between an on-premises gateway and an AWS virtual private gateway or Transit Gateway. Each connection has two tunnels for redundancy.

The VPN concentrator attached to a single VPC that terminates Site-to-Site VPN connections. It is the target for routes pointing on-premises traffic into the tunnel.

A set of rules that determine where subnet or gateway traffic is sent, based on destination CIDR. Each entry maps a prefix to a target such as an internet gateway or peering connection.

The rule that a router chooses the most specific route whose prefix contains the destination address. A /24 route wins over a /16 route to the same address range.

Automatic insertion of learned BGP routes from a VPN or Direct Connect attachment into a VPC route table. It reduces manual entries but can override static routes in unexpected ways.

A horizontally scaled, redundant VPC component that allows communication between a VPC and the internet. It performs network address translation for instances with public IP addresses.

A managed service that lets instances in private subnets initiate outbound internet traffic while blocking unsolicited inbound connections. It must reside in a public subnet with an elastic IP.

A static public IPv4 address that can be associated with an instance or network interface and remapped quickly. It is allocated to an account and remains until released.

A virtual network card with a primary private IP, optional secondary IPs, and security groups. It can be detached and reattached to another instance in the same Availability Zone.

A stateful virtual firewall controlling inbound and outbound traffic for associated resources. Rules allow traffic by protocol, port, and source or destination, and responses are automatically permitted.

A stateless subnet-level firewall that evaluates numbered allow and deny rules in order for both inbound and outbound traffic. Return traffic must be explicitly allowed.

A firewall behavior where return traffic for an allowed connection is automatically permitted without a matching rule. Security groups are stateful, while network ACLs are not.

A managed stateful firewall service for VPCs that supports domain filtering, intrusion prevention signatures, and Suricata-compatible rule groups. It is deployed into dedicated firewall subnets.

A private entry point to supported AWS services or endpoint services without traversing the internet. Gateway endpoints modify route tables, while interface endpoints use elastic network interfaces in subnets.

A technology that exposes services privately to consumers through interface endpoints backed by network load balancers. Traffic stays on the AWS network and does not require peering.

A layer 4 load balancer that distributes TCP, UDP, and TLS traffic with very high throughput and low latency. It preserves source IP addresses and supports static IP addresses per Availability Zone.

A layer 7 load balancer that routes HTTP and HTTPS requests using host, path, header, and query conditions. It supports redirects, fixed responses, and integration with web application firewalls.

A web application firewall that inspects HTTP and HTTPS requests against rules for IP sets, rate limits, and managed rule groups. It attaches to CloudFront, API Gateway, and load balancers.

A managed denial-of-service protection service. The Standard tier is automatic and free, while Advanced adds enhanced detection, response support, and cost protection for scaling charges.

A global content delivery network that caches content at edge locations and supports origin failover, signed URLs, and field-level encryption. It integrates with WAF and Shield for protection.

A service that provides static anycast IP addresses and routes user traffic to optimal endpoints over the AWS global network. It supports fast regional failover using health checks.

A managed DNS service supporting public and private hosted zones, health checks, and routing policies such as weighted, latency, failover, and geolocation. It can also register domains.

A Route 53 zone that resolves DNS names only within associated VPCs. It is commonly used for internal service discovery and split-horizon naming.

The DNS service that answers queries for VPC resources. Resolver endpoints enable inbound and outbound forwarding between VPCs and on-premises DNS servers.

Records of IP traffic going to and from network interfaces, subnets, or entire VPCs. Logs capture accepted and rejected flows with metadata and can be delivered to CloudWatch Logs or S3.

A feature that copies network traffic from elastic network interfaces and sends it to monitoring appliances for inspection. Filters control which packets are captured.

A configuration analysis tool that checks whether a path exists between a source and destination resource. It reports blocking components such as security groups, route tables, or NACLs.

A tool that identifies unintended network access to resources by evaluating defined access scenarios against your VPC configurations. It helps demonstrate that traffic paths match policy intent.

A service that records API activity across accounts, including changes to route tables, security groups, and VPC endpoints. Logs support auditing and compliance evidence.

A service that records resource configuration history and evaluates it against rules. Managed and custom rules can flag noncompliant networking settings such as open security groups.

A service for centrally managing multiple accounts, applying service control policies, and consolidating billing. It enables shared networking through centralized VPC and Transit Gateway designs.

An Organizations policy that sets the maximum permissions available to accounts in an organizational unit. It can block actions such as deleting VPC flow logs or modifying route tables.

A design where one account owns VPC subnets and shares them with other accounts in the same organization. Participants launch resources into shared subnets while the owner controls routing and networking.