Module:3
AWS Networking and Content
Delivery
AWS Networking and Content
Delivery
It’s a collection of services offered by Amazon Web
Services (AWS) that are crucial for businesses to build,
manage, and enhance their network infrastructures
and efficiently distribute content globally.
These services are fundamental for developing secure,
scalable, and high-performance cloud-based
applications.
AWS offers tools to create and control network
environments, ensuring that applications run smoothly,
securely, and can reach users anywhere in the world
with minimal latency and high reliability.
AWS Networking and Content
Delivery
Amazon API Gateway AWS Direct Connect
Amazon CloudFront AWS Global
Amazon Route 53 Accelerator
AWS Verified Access AWS PrivateLink
Amazon VPC AWS Private 5G
Amazon VPC Lattice AWS VPN
AWS App Mesh Elastic Load Balancing
AWS Cloud Map Integrated Private
Wireless on AWS
AWS Transit Gateway
Amazon API Gateway
Amazon API Gateway is a fully managed service that makes it easy for developers to create,
publish, maintain, monitor, and secure APIs at any scale.
Amazon API Gateway handles all the tasks involved in accepting and processing up to hundreds of
thousands of concurrent API calls, including traffic management, authorization and access control,
monitoring, and API version management.
API (Application Programming Interface):
An API is a set of rules and protocols that allow different software applications to communicate with each
other. It defines the methods and data formats that applications use to request and exchange
information.
API Call:
An API call is a request sent by a client (like a web browser, mobile app, or
another server) to an API endpoint (a specific URL associated with the
API) to retrieve or send data.
The client uses HTTP methods like GET, POST, PUT, or DELETE to interact
with the server. The server then processes the request and returns a
response, usually in the form of data in formats like JSON or XML.
Amazon CloudFront
Amazon CloudFront is a fast content delivery network
(CDN) service that securely delivers data, videos,
applications, and APIs to customers globally with low
latency, high transfer speeds, all within a developer-
friendly environment.
CloudFront is integrated with AWS – both physical
locations that are directly connected to the AWS global
infrastructure, as well as other AWS services.
CloudFront
CloudFront works seamlessly with services including
AWS Shield for DDoS mitigation, Amazon S3, Elastic
Load Balancing or Amazon EC2 as origins for your
applications, and Lambda@Edge to run custom
code closer to customers’ users and to customize
the user experience.
Amazon Route 53
Amazon Route 53 is a highly available and scalable cloud Domain Name
System (DNS) web service.
The name (Route 53) comes from the fact that DNS servers respond to
queries on port 53 and provide answers that route end users to your
applications on the Internet.
It is designed to give developers and businesses an extremely reliable and
cost-effective way to route users to internet applications by translating
human-readable names, such as [Link], into the numeric IP
addresses, such as [Link], that computers use to connect to each other.
Amazon Route 53 is fully compliant with IPv6 as well.
Amazon Route 53 effectively connects user requests to infrastructure
running in AWS—such as EC2 instances, elastic load balancers, or Amazon
S3 buckets—and can also be used to route users to infrastructure outside of
AWS.
You can use Amazon Route 53 to configure DNS health checks to route
traffic to healthy endpoints or to independently monitor the health of your
Amazon Route 53
Using Amazon Route 53 traffic
flow’s simple visual editor, you
can easily manage how your
end users are routed to your
application’s endpoints—
whether in a single AWS Region
or distributed around the globe.
Amazon Route 53 also offers
Domain Name Registration—
you can purchase and manage
domain names such as
[Link] and Amazon
Route 53 will automatically
configure DNS settings for your
domains.
AWS Verified Access
With AWS Verified Access, you can provide secure access to your applications
without requiring the use of a virtual private network (VPN).
Verified Access evaluates each application request and helps ensure that users can
access each application only when they meet the specified security requirements.
Benefits of Verified Access
Improved security posture – A traditional security model evaluates access once and grants the user
access to all applications. Verified Access evaluates each application access request in real time. This
makes it difficult for bad actors to move from one application to another.
Integration with security services – Verified Access integrates with identity and device management
services, including both AWS and third-party services. Using data from these services, Verified Access
verifies the trustworthiness of users and devices against a set of security requirements and determines
whether the user should have access to an application.
Improved user experience – Verified Access removes the need for users to use a VPN to access your
applications. This helps reduce the number of support cases arising from VPN-related issues.
Simplified troubleshooting and audits – Verified Access logs all access attempts, providing centralized
visibility into application access, to help you quickly respond to security incidents and audit requests.
Amazon VPC (Virtual Private Cloud)
With Amazon Virtual Private Cloud (Amazon VPC), you can launch AWS
resources in a logically isolated virtual network that you've defined.
This virtual network closely resembles a traditional network that you'd
operate in your own data center, with the benefits of using the scalable
infrastructure of AWS.
The following diagram shows an example VPC. The VPC has one subnet
in each of the Availability Zones in the Region, EC2 instances in each
subnet, and an internet gateway to allow communication between the
resources in your VPC and the internet.
Features of VPC
Feature cont,
Feature cont,
VPC vs VPN
Amazon VPC Lattice
Amazon VPC Lattice is an application networking service that consistently connects,
monitors, and secures communications between your services, helping to improve
productivity so that your developers can focus on building features that matter to
your business.
You can define policies for network traffic management, access, and monitoring to
connect compute services in a simplified and consistent way across instances,
containers, and serverless applications.
Lattice works in single or multiple AWS accounts, and primarily aims to minimise
the amount of network configuration.
In doing so, it intends to solve the common friction that arises when the
responsibility for application networking is split between development and
networking teams.
Approaches like routing tables, VPC Peering, PrivateLink and Transit Gateway are
the existing alternatives to Lattice.
Amazon VPC Lattice
AWS App Mesh
AWS App Mesh provides application-level networking so your services
can communicate across multiple types of compute infrastructure.
A service mesh is a logical boundary for network traffic between
services that are represented by resources within the mesh. After you
create your service mesh, you can create virtual services, virtual
nodes, virtual routers, and routes to distribute traffic between the
applications in your mesh.
AWS Cloud Map
AWS Cloud Map is a cloud resource discovery service. With Cloud Map, you
can define custom names for your application resources, and it maintains
the updated location of these dynamically changing resources.
This increases your application availability because your web service
always discovers the most up-to-date locations of its resources.
Cloud Map allows you to register any application resources, such as
databases, queues, microservices, and other cloud resources, with custom
names.
Cloud Map then constantly checks the health of resources to make sure the
location is up-to-date. The application can then query the registry for the
location of the resources needed based on the application version and
deployment environment.
With and without Cloudmap
AWS Transit Gateway
AWS Transit Gateway is a highly available and scalable service to
consolidate the AWS VPC routing configuration for a region with a hub-
and-spoke architecture.
Each spoke VPC only needs to connect to the Transit Gateway to gain
access to other connected VPCs.
Both IPv4 and IPv6 traffic is supported in AWS Transit Gateway.
You can take advantage of several Transit Gateway route tables,
associations, and propagations to segment your traffic within the same
Transit Gateway.
You will be able to manage different routing domains (for example,
production and non-production traffic) from a single point of
management, ensuring that these routing domains won’t be able to
communicate between each other.
AWS Transit Gateway
AWS Direct Connect
AWS Direct Connect makes it easy to establish a dedicated connection from an on-premises
network to one or more VPCs.
AWS Direct Connect can reduce network costs, increase bandwidth throughput, and provide
a more consistent network experience than internet-based connections.
It uses industry-standard 802.1Q VLANs to connect to Amazon VPC using private IP
addresses. The VLANs are configured using virtual interfaces (VIFs), and you can configure
three different types of VIFs:
Public virtual interface - Establish connectivity between AWS public endpoints and your
data center, office, or colocation environment.
Transit virtual interface - Establish private connectivity between AWS Transit Gateway
and your data center, office, or colocation environment. This connectivity option is covered
in the section AWS Direct Connect + AWS Transit Gateway.
Private virtual interface - Establish private connectivity between Amazon VPC resources
and your data center, office, or colocation environment.
AWS Direct Connect
AWS Global Accelerator
AWS Global Accelerator is a networking service that helps you improve the availability,
performance, and security of your public applications.
Global Accelerator provides two global static public IPs that act as a fixed entry point to your
application endpoints, such as Application Load Balancers, Network Load Balancers, Amazon
Elastic Compute Cloud (EC2) instances, and elastic IPs.
AWS Global accelerator
The Global Accelerator provides two static Anycast IPv4 (2 Anycast IPs are created
for your application) addresses. The Anycast IP sends traffic on to Edge Locations.
Then, the AWS edge locations will send the traffic to your application All you would
like to try to do is to define endpoints in one or multiple regions.
It works with the following endpoints.
Application Load Balancer (ALB)
Network Load Balancer (NLB)
Elastic IP
EC2 Instance (with or without Public IP)
The Global Accelerator optimizes the route for every client, which suggests it
minimizes the number of hops until a TPC or UDP package enters Amazon’s
network and thus reduces latencies.
Also, the Global Accelerator route requests healthy endpoints only.
What is AWS PrivateLink?
AWS PrivateLink is a highly available, scalable technology that you can
use to privately connect your VPC to services as if they were in your VPC.
You do not need to use an internet gateway, NAT device, public IP address,
AWS Direct Connect connection, or AWS Site-to-Site VPN connection to
allow communication with the service from your private subnets.
Therefore, you control the specific API endpoints, sites, and services that
are reachable from your VPC.
Use case:
You can create VPC endpoints to connect resources in your VPC to
services that integrate with AWS PrivateLink.
You can create your own VPC endpoint service and make it available to
other AWS customers.
What is AWS PrivateLink?
AWS Private 5G
AWS Private 5G is a managed service that helps you to deploy, operate, and scale your own
private mobile network at your on-premises location.
Private 5G provides the pre-integrated hardware and software for mobile networks, helps
automate setup, and scales capacity on demand to support additional devices as needed.
You pay only for the network coverage and capacity that you need.
The following are the key concepts for Private 5G.
Private 5G network – A private mobile network at your on-premises facility.
Private 5G site – The physical building or location where you set up your private mobile network. A site must meet the
facility, networking, and power requirements for a mobile network.
Private 5G equipment – The physical hardware that provides access to your Private 5G network, including cables, radio
units, SIM cards, and any other networking appliances owned and managed by AWS.
Radio units – The physical hardware, supplied by AWS, that emits RF signals for end-user equipment to connect to the
Private 5G network.
SIM cards – The cards supplied by AWS that you insert into end-user equipment to access the Private 5G network. Also
known as subscriber identity modules or subscriber identification modules.
VPN connectivity option
AWS Site-to-Site VPN:
You can create an IPsec VPN connection between your VPC and your remote network. On the AWS side of the
Site-to-Site VPN connection, a virtual private gateway or transit gateway provides two VPN endpoints
(tunnels) for automatic failover. You configure your customer gateway device on the remote side of the Site-
to-Site VPN connection.
AWS Client VPN:
AWS Client VPN is a managed client-based VPN service that enables you to securely access your
AWS resources or your on-premises network. With AWS Client VPN, you configure an endpoint to
which your users can connect to establish a secure TLS VPN session. This enables clients to
access resources in AWS or on-premises from any location using an OpenVPN-based VPN client.
AWS VPN CloudHub:
If you have more than one remote network (for example, multiple branch offices), you can create
multiple AWS Site-to-Site VPN connections via your virtual private gateway to enable
communication between these networks.
Third party software VPN appliance:
You can create a VPN connection to your remote network by using an Amazon EC2 instance in
your VPC that's running a third party software VPN appliance. AWS does not provide or maintain
third party software VPN appliances; however, you can choose from a range of products provided
by partners and open source communities.
Elastic Load Balancing (ELB)
Elastic Load Balancing (ELB)
Elastic Load Balancing (ELB) is a service provided by Amazon Web Services (AWS) that automatically
distributes incoming application traffic across multiple targets, such as EC2 instances, containers, and IP
addresses, in one or more Availability Zones. ELB helps to ensure that your application is highly available,
scalable, and fault-tolerant.
Purpose of Elastic Load Balancing
1. High Availability: ELB ensures that your application remains accessible by distributing traffic across multiple
instances and Availability Zones. If one instance or zone fails, the load balancer routes traffic to healthy
instances, minimizing downtime.
2. Scalability: As traffic to your application increases, ELB can distribute the load across additional instances,
allowing your application to scale seamlessly to handle the increased demand without manual intervention.
3. Fault Tolerance: ELB monitors the health of registered targets (e.g., EC2 instances) and automatically
reroutes traffic to healthy instances if a failure is detected. This helps to maintain the application's availability
and reliability.
4. Load Distribution: By distributing traffic evenly across multiple targets, ELB prevents any single instance
from becoming overloaded, which can improve the overall performance and responsiveness of your
application.
5. Security: ELB can be configured to work with Amazon's security features, such as SSL/TLS termination,
ensuring that traffic between clients and your load balancer is encrypted. It also integrates with AWS Identity
and Access Management (IAM) and other security services.
6. Traffic Management: ELB supports different types of load balancing (e.g., application, network, and
gateway) and allows you to manage traffic based on various criteria, such as IP address, request path, and
Summary
Elastic Load Balancing is a critical component of cloud
architecture that enhances the availability, scalability, and fault
tolerance of your applications by distributing incoming traffic
across multiple targets and ensuring that your application can
handle varying levels of traffic effectively.
Integrated Private Wireless on AWS
The Integrated Private Wireless on AWS program is designed to provide enterprises
with managed and validated private wireless offerings from leading Communications
Service Providers (CSPs).
The offerings integrate CSPs’ private 5G and 4G LTE wireless networks with AWS
services across AWS Regions, AWS Local Zones, AWS Outposts, and AWS Snow Family.
AWS Telco Solution Architects technically validate the offerings for their sound
architecture and adherence to AWS best practices. Telecom companies deliver,
operate, and support the offerings.
Integrated Private Wireless on AWS removes the long planning cycles and complex
integrations to set up and scale a private wireless network. You can now deploy a
secure, reliable, and low-latency private wireless network to power artificial
intelligence and machine learning (AI/ML) and Internet of Things (IoT) workloads at
the edge and at scale.
AWS VPC
Introduction
An amazon VPC is an isolated portion of AWS cloud
Amazon VPC is used to create virtual network topology for
EC2 instances
Selection of IP address range, subnet creation,
configuration of route tables, network gateways are done
by the developer
Public facing subnet could be created for the web servers
that has access to the internet
Private facing subnet to restrict internet access for web
servers
CONT,
VPC and subnets
A subnet defines range of IP address in your VPC
AWS resources could be launched into a launched subnet
Eachsubnet must reside in single availability zones and
cannot span between the zones
Security in VPC
Use cases
High performance computing
Identity management
Small, single applications managed individuals or
team
AWS infrastructure pattern
VPC Subnets
Each subnet must reside entirely within one Availability Zone and cannot
span zones.
By launching AWS resources in separate Availability Zones, you can protect
your applications from the failure of a single Availability Zone.
Subnet IP address range
When you create a subnet, you specify its IP addresses, depending on the
configuration of the VPC:
• IPv4 only – The subnet has an IPv4 CIDR block but does not have an IPv6
CIDR block. Resources in an IPv4-only subnet must communicate over IPv4.
• Dual stack – The subnet has both an IPv4 CIDR block and an IPv6 CIDR
block. The VPC must have both an IPv4 CIDR block and an IPv6 CIDR block.
Resources in a dual-stack subnet can communicate over IPv4 and IPv6.
• IPv6 only – The subnet has an IPv6 CIDR block but does not have an IPv4
CIDR block. The VPC must have an IPv6 CIDR block. Resources in an IPv6-
only subnet must communicate over IPv6.
SUBNET
Each VPC has public and private subnets and an internet
gateway. You can optionally add subnets in a Local Zone, as
shown in the diagram.
A Local Zone is an AWS infrastructure deployment that places
compute, storage, and database services closer to your end
users. When you use a Local Zone, your end users can run
applications that require single-digit millisecond latencies.
AWS Route Table
Association: Each subnet must be associated with a route table, and a subnet can only be associated with
one route table at a time.
Limits: AWS limits the number of route tables you can create per VPC, so it’s essential to plan your
architecture correctly.
Priorities: If there are multiple possible routes, AWS prioritizes routes with the most specific CIDR range.
Pricing: AWS charges for data transfer through some route table features such as VPC peering connections,
NAT gateways, and VPC endpoints.
Route Propagation: Route propagation enables the automatic propagation of routes from a gateway (like a
transit gateway) to a route table.
Terraform: If you’re using Infrastructure as Code (IaC), you can use Terraform to automate your AWS route
table configurations. This enables efficient versioning and quick rollbacks.
Interoperability: While this guide is primarily focused on AWS, it’s worth noting that other cloud providers like
Azure also use similar concepts for network traffic routing, albeit with different terminologies.
What is a route table in AWS?
In AWS, a route table is a set of rules that determines where network traffic is
directed. Each subnet in your AWS VPC is associated with a route table which
controls the traffic flow between subnets. Whether it’s a gateway route table for
your IGW, a subnet route table for your private subnet, or a route table for your
Amazon VPC, it serves the same fundamental purpose.
What does a route table do?
The role of an AWS route table is to direct network traffic based on the destination
IP address. Each route in the table specifies a destination and a target (like an
internet gateway or NAT gateway). The target could be a range of resources
including an EC2 instance, RDS database, or even an AWS router for your VPC.
How does pricing for route tables work in AWS?
AWS charges for data transfer based on the features used in your route table, like
VPC peering connections, NAT gateways, and VPC endpoints. For a detailed
understanding of pricing, you can refer to the AWS user guide and official AWS
pricing documentation.
Security Groups
A security group acts as a virtual firewall for your EC2 instances to control incoming
and outgoing traffic.
Inbound rules control the incoming traffic to your instance, and outbound rules
control the outgoing traffic from your instance. When you launch an instance, you
can specify one or more security groups.
If you don't specify a security group, Amazon EC2 uses the default security group
for the VPC. After you launch an instance, you can change its security groups.
Security is a shared responsibility between AWS and you.
AWS provides security groups as one of the tools for securing your instances, and
you need to configure them to meet your security needs.
If you have requirements that aren't fully met by security groups, you can maintain
your own firewall on any of your instances in addition to using security groups.
Pricing
There is no additional charge for using security groups.
A security group can be used only in the VPC for which it is created. You can
associate each instance with multiple security groups, and you can associate each
security group with multiple instances. You add rules to each security group that
allow traffic to or from its associated instances. You can modify the rules for a
security group at any time.
New and modified rules are automatically applied to all instances that are associated
with the security group. When Amazon EC2 decides whether to allow traffic to reach
an instance, it evaluates all rules from all security groups that are associated with
the instance.
Security groups are stateful
Security groups are stateful—if you send a request from
your instance, the response traffic for that request is
allowed to flow in regardless of inbound security group
rules.
Also, responses to allowed inbound traffic are allowed
to flow out, regardless of outbound rules.
VPC peering
A virtual private cloud (VPC) is a virtual network dedicated to your
AWS account. It is logically isolated from other virtual networks in the
AWS Cloud. You can launch AWS resources, such as Amazon EC2
instances, into your VPC.
A VPC peering connection is a networking connection between two
VPCs that enables you to route traffic between them using private
IPv4 addresses or IPv6 addresses. Instances in either VPC can
communicate with each other as if they are within the same network.
You can create a VPC peering connection between your own VPCs, or
with a VPC in another AWS account. The VPCs can be in different
Regions (also known as an inter-Region VPC peering connection).
AWS Direct Connect
AWS Direct Connect makes it easy to establish a dedicated connection from an on-
premises network to one or more VPCs. AWS Direct Connect can reduce network
costs, increase bandwidth throughput, and provide a more consistent network
experience than internet-based connections.
It uses industry-standard 802.1Q VLANs to connect to Amazon VPC using private IP
addresses. The VLANs are configured using virtual interfaces (VIFs), and you can
configure three different types of VIFs:
Public virtual interface - Establish connectivity between AWS public endpoints and
your data center, office, or colocation environment.
Transit virtual interface - Establish private connectivity between AWS Transit Gateway
and your data center, office, or colocation environment. This connectivity option is
covered in the section AWS Direct Connect + AWS Transit Gateway.
Private virtual interface - Establish private connectivity between Amazon VPC
resources and your data center, office, or colocation environment. The use of private
VIFs is shown in the following figure.
AWS Direct Connect
AWS Direct Connect
With AWS Direct Connect, you have two types of connection:
• Dedicated connections, where a physical ethernet connection is
associated with a single customer. You can order port speeds of 1,
10, or 100 Gbps. You might need to work with a partner in the AWS
Direct Connect Partner Program to help you establish network
circuits between an AWS Direct Connect connection and your data
center, office, or colocation environment.
• Hosted connections, where a physical ethernet connection is
provisioned by an AWS Direct Connect Partner and shared with you.
You can order port speeds between 50 Mbps and 10 Gbps. Your work
with the Partner in both the AWS Direct Connect connection they
established and the network circuits between an AWS Direct Connect
connection and your data center, office, or colocation environment.
AWS CloudFront
AWS CloudFront is a globally-distributed network offered by Amazon Web
Services, which securely transfers content such as software, SDKs, videos,
etc., to the clients, with high transfer speed.
Benefits of AWS CloudFront
• It will cache your content in edge locations and decrease the workload, thus
resulting in high availability of applications.
• It is simple to use and ensures productivity enhancement.
• It provides high security with the ‘Content Privacy’ feature.
• It facilitates GEO targeting service for content delivery to specific end-users.
• It uses HTTP or HTTPS protocols for quick delivery of content.
• It is less expensive, as it only charges for the data transfer.
how AWS CloudFront Work?
Step 6:
As soon CloudFront receives the file, it shares it with the
client and adds the file to the edge location.
Receives file - CloudFront