Unit 2: Networking and Connectivity in AWS

I. Foundations of AWS Networking

AWS networking provides logically isolated, software-defined infrastructure for connecting cloud resources, managed services, on-premises networks, and the internet. Its governing principle is defense in depth: connectivity is explicitly designed through IP addressing, routing, gateways, and multiple security controls rather than being assumed.

Defining characteristics:

• Regional scope: An Amazon Virtual Private Cloud (VPC) belongs to one AWS Region but can contain subnets in multiple Availability Zones (AZs).
• IP-based organization: VPCs and subnets receive non-overlapping IPv4 CIDR blocks, such as 10.0.0.0/16; IPv6 can be added using AWS-assigned global unicast ranges.
• Availability Zone boundaries: Each subnet belongs to exactly one AZ, so resilient applications normally use equivalent subnets in at least two AZs.
• Route-controlled connectivity: Each subnet is associated with a route table whose longest-prefix match determines where traffic is sent.
• Layered security: Security groups protect elastic network interfaces, while network access control lists protect subnet boundaries.
• Explicit external access: Internet gateways, NAT gateways, virtual private gateways, transit gateways, endpoints, and Direct Connect gateways provide distinct connectivity paths.
• Shared responsibility: AWS secures the underlying network infrastructure; customers configure addressing, routes, access controls, monitoring, and workload-level security.

II. Amazon VPC and Subnet Design — Addressing, Routing, and Availability

A. Amazon VPC and subnet design

A VPC is a logically isolated virtual network whose subnet and routing design determines workload reachability, scalability, and fault tolerance.

• VPC CIDR planning: Select an address range large enough for growth and non-overlapping with networks that may later be connected.
  • 10.0.0.0/16 contains 65,536 IPv4 addresses and can be divided into 256 /24 networks.
  • Overlap prevents straightforward routing through VPC peering, Transit Gateway, VPN, or Direct Connect.
• Subnet capacity: AWS reserves the first four and last IPv4 addresses in every subnet; a /24 therefore has 251 usable addresses.
• AZ placement: A subnet cannot span AZs. A three-tier application across two AZs may use six subnets: public, private application, and isolated database subnets in each AZ.
• Public subnet: Its route table typically includes 0.0.0.0/0 to an internet gateway. An instance also requires a public IPv4 address or Elastic IP for direct IPv4 internet communication.
• Private subnet: It has no direct route to an internet gateway. Outbound IPv4 access commonly uses a NAT gateway located in a public subnet.
• Isolated subnet: It has no default route to the internet and is suitable for databases or internal systems reached only through approved internal paths.
• Routing rule: Every route table contains a local route for communication within the VPC; more-specific routes take precedence over less-specific routes.

VPC: 10.0.0.0/16
AZ-a public:  10.0.0.0/24
AZ-a private: 10.0.10.0/24
AZ-b public:  10.0.1.0/24
AZ-b private: 10.0.11.0/24

• Resilience consideration: Deploy one NAT gateway per active AZ and route each private subnet to its local NAT gateway, avoiding an AZ dependency and cross-AZ data transfer.

III. Network Resource Security — Stateful and Stateless Filtering

A. Securing network resources using security groups and NACLs

Security groups and network ACLs provide complementary traffic filtering at different boundaries.

1. Security groups

   • Attachment point: A security group is attached to elastic network interfaces, including those used by EC2 instances, load balancers, and RDS databases.
   • Stateful operation: Return traffic for an allowed connection is automatically permitted, regardless of outbound rules.
   • Allow rules only: Rules specify protocol, port range, and source or destination; explicit deny rules are unavailable.
   • Identity-based referencing: A database group can permit TCP port 5432 from an application security group, avoiding dependence on changing instance IP addresses.
   • Least privilege: An internet-facing load balancer may allow inbound 443 from 0.0.0.0/0, while application instances allow their service port only from the load balancer group.

2. Network ACLs

   • Attachment point: A NACL applies to all traffic entering or leaving associated subnets.
   • Stateless operation: Both request and response directions must be explicitly allowed, including relevant ephemeral ports.
   • Allow and deny rules: Rules are evaluated in ascending rule-number order; the first matching rule applies.
   • Subnet-level guardrail: A deny rule can block a known malicious CIDR across an entire subnet, including resources with permissive security groups.
   • Default behavior: The default NACL allows all inbound and outbound traffic, whereas a newly created custom NACL denies all traffic until rules are added.

• Combined model: Traffic must be accepted by both controls. Security groups should carry detailed workload policy; NACLs are best used for broad subnet-level restrictions rather than duplicating every security-group rule.

IV. Private Access to AWS Services — Endpoints and Private DNS

A. Connecting to managed AWS services within a VPC

VPC endpoints allow resources to reach supported AWS services without traversing an internet gateway, NAT gateway, VPN connection, or public internet.

• Gateway endpoints: These support Amazon S3 and DynamoDB and add service-prefix routes to selected route tables.
  • They do not use elastic network interfaces or security groups.
  • Endpoint policies can restrict accessible services, buckets, tables, principals, or actions.
  • They have no hourly endpoint charge.
• Interface endpoints: Powered by AWS PrivateLink, these create endpoint network interfaces with private IP addresses in selected subnets.
  • Security groups control traffic to the endpoint, usually over TCP 443.
  • They support many services, including Systems Manager, Secrets Manager, CloudWatch, and privately published endpoint services.
  • Charges normally include endpoint-hours and processed data.
• Private DNS: When enabled for an interface endpoint, the normal regional service hostname resolves to its private endpoint addresses inside the VPC.
• Gateway Load Balancer endpoints: These steer traffic transparently through virtual network appliances such as firewalls and intrusion-detection systems.
• Policy layering: Access may depend on endpoint policy, IAM identity policy, resource policy, security group rules, DNS settings, and routing.
• Design benefit: A private EC2 instance can retrieve an S3 object through an S3 gateway endpoint without a NAT gateway, reducing exposure and NAT processing cost.

V. Multi-VPC Connectivity — Peering and Centralized Transit

A. VPC peering and AWS Transit Gateway

VPC peering provides direct pairwise routing, whereas Transit Gateway acts as a regional hub for many VPC and external-network attachments.

1. VPC peering

   • Topology: Two VPCs exchange traffic through a one-to-one connection using private IPv4 or IPv6 addresses.
   • Routing: Routes to the peer CIDR must be added to the relevant route tables on both sides.
   • Non-transitive behavior: If VPC A peers with B and B peers with C, A cannot reach C through B.
   • Constraints: Peer CIDR ranges cannot overlap, and edge-to-edge routing through another VPC’s internet gateway, VPN, or NAT device is generally unsupported.
   • Best fit: Peering is economical for a small number of direct relationships with simple routing requirements.

2. AWS Transit Gateway

   • Hub-and-spoke model: A transit gateway can attach VPCs, Site-to-Site VPNs, Direct Connect gateways, and other transit gateways through peering.
   • Transitive routing: Attached networks can communicate through the hub when transit-gateway and VPC route tables permit it.
   • Segmentation: Multiple transit-gateway route tables can separate environments such as production, development, and shared services.
   • Scale: Centralized routing avoids the full-mesh growth of peering; ten fully interconnected VPCs would require 10 × 9 ÷ 2 = 45 peering connections.
   • Trade-off: Transit Gateway simplifies large networks but introduces attachment and data-processing charges and creates a central routing dependency.

VI. Hybrid Connectivity — Encrypted Tunnels and Dedicated Links

A. Remote connectivity with Site-to-Site VPN and AWS Direct Connect

Hybrid connectivity links on-premises networks to AWS through internet-based encrypted tunnels, dedicated private circuits, or both.

1. AWS Site-to-Site VPN

   • Components: A customer gateway represents the on-premises router; a virtual private gateway or Transit Gateway terminates the AWS side.
   • Redundancy: Each VPN connection provides two IPsec tunnels terminating on separate AWS infrastructure.
   • Routing: Border Gateway Protocol (BGP) dynamically exchanges routes, while static routing is available for supported configurations.
   • Performance: Traffic crosses the public internet, so latency and throughput can vary even though IPsec provides confidentiality and integrity.
   • Use cases: VPN suits rapid deployment, moderate traffic, branch connectivity, and backup connectivity.

2. AWS Direct Connect

   • Dedicated path: A physical connection links customer or partner infrastructure to an AWS Direct Connect location, bypassing the public internet.
   • Virtual interfaces: Private virtual interfaces access VPC resources; public virtual interfaces access supported public AWS endpoints; transit virtual interfaces connect to Transit Gateway through a Direct Connect gateway.
   • Predictability: Direct Connect can provide more consistent bandwidth and latency, but the link is not encrypted by default.
   • Resilience: Production designs use redundant connections at separate locations and may retain Site-to-Site VPN as failover.
   • Combined design: A VPN carried over Direct Connect can add IPsec encryption while preserving a private, dedicated network path.

VII. Network Operations — Observability and Architectural Quality

A. Monitoring networks and applying Well-Architected principles

Effective network operations combine telemetry, automated alerting, and architecture reviews against the AWS Well-Architected Framework.

• VPC Flow Logs: Capture metadata such as source address, destination address, ports, protocol, bytes, and ACCEPT or REJECT status for VPCs, subnets, or network interfaces.
• Traffic Mirroring: Copies selected packet traffic from supported elastic network interfaces to inspection or monitoring appliances for detailed analysis.
• Reachability Analyzer: Performs configuration analysis between a source and destination and identifies the component blocking a path without sending packets.
• CloudWatch monitoring: Metrics and alarms track resources such as NAT gateways, VPN tunnels, Direct Connect links, load balancers, and Transit Gateway attachments.
• CloudTrail auditing: Records API activity, such as changes to route tables, security groups, gateways, and NACLs, supporting investigation and governance.
• Operational Excellence: Manage network definitions through infrastructure as code, peer review changes, and test failover procedures.
• Security: Apply least privilege, private endpoints, encryption, segmentation, centralized logging, and automated detection of overly broad rules.
• Reliability: Use multiple AZs, redundant tunnels or circuits, independent failure paths, health monitoring, and tested recovery procedures.
• Performance Efficiency: Select appropriate connection types, minimize unnecessary network hops, and monitor throughput, packet loss, and latency.
• Cost Optimization: Evaluate NAT processing, cross-AZ transfer, Transit Gateway processing, endpoint hourly charges, and Direct Connect capacity.
• Sustainability: Reduce unnecessary transfers and duplicate inspection paths by choosing efficient routes and right-sized network resources.