Networking and Content Delivery
VPC building blocks
Plan CIDR ranges without overlap; each subnet lives in one AZ. Route tables choose the most specific matching route. An internet gateway serves public subnets; a NAT Gateway (per AZ, with an Elastic IP, placed in a public subnet) gives private subnets outbound access. Security groups are stateful and allow-only; NACLs are stateless, support allow and deny, and are evaluated from the lowest rule number with a final deny - put explicit denies first.
Connectivity
VPC peering is one-to-one and non-transitive; Transit Gateway is the hub for many VPCs and on-premises. Gateway endpoints (S3 and DynamoDB only) add a route-table entry and keep traffic on the AWS network; interface endpoints (PrivateLink) create an ENI with a security group and work for most services, including from on-premises. Site-to-Site VPN is fast to set up over the internet; Direct Connect is private and consistent but slow to provision.
Delivery and DNS
ALB is layer 7 with host and path routing, WAF, and WebSockets; NLB is layer 4 with static IPs, extreme performance, and PrivateLink; CLB is legacy. CloudFront caches at edges with configurable TTLs; for a private S3 origin use origin access control with the REST endpoint, not the website endpoint. Route 53 alias records work at the zone apex; routing policies are simple, weighted, latency, failover (needs a health check), geolocation, and multivalue. Flow Logs capture accepted and rejected flows to CloudWatch Logs or S3.
Traps
Security groups cannot deny. A gateway endpoint does not serve peered or on-premises networks. NAT Gateways are AZ-scoped, so build one per AZ for availability.
Rule of thumb
Private instances that must reach S3 without internet: create a gateway endpoint for S3 and add its prefix-list route to every private route table - no NAT, no internet gateway, no data processing charge.