AWS Networking Deep Dive
A complete, standalone deep dive into AWS networking, from Associate-level VPC fundamentals through Professional and Advanced Networking Specialty depth, with enterprise-grade real-world scenarios throughout.
Slides
AWS Networking, end to end
Opening slide framing this deck as a complete, standalone journey through AWS networking, Associate through Specialty depth.
The certification landscape: Associate to Professional to Specialty
Where AWS networking content lives across the certification track, and the Advanced Networking Specialty (ANS-C01) exam's own domain weighting.
The VPC is the network; everything else attaches to it
A VPC is an isolated, region-scoped virtual network with a CIDR block you choose; every other networking concept in this deck lives inside one.
A subnet lives in exactly one AZ, and that's the whole point
A subnet is a CIDR sub-range pinned to one Availability Zone; 'public' and 'private' are route table facts, not subnet properties.
The route table decides, the resource doesn't
Every subnet uses exactly one route table at a time, evaluated by longest-prefix match, and that table is the single source of truth for where traffic goes.
An Internet Gateway makes a subnet public, nothing else does
An IGW is a horizontally scaled, redundant VPC component providing two-way internet access; attaching one and routing to it is the entire mechanism behind 'public subnet.'
NAT Gateway vs. NAT Instance: managed reliability vs. control
A NAT Gateway is AWS-managed, highly available within its AZ, and billed per hour plus per GB; a NAT Instance is a self-managed EC2 box with more control and more operational burden.
Security Groups are stateful, and that's the whole trick
A Security Group is a virtual firewall at the ENI level; allowing inbound traffic automatically allows the matching outbound response, no explicit return rule needed.
Two firewalls, two layers, evaluated in a fixed order
A packet entering a subnet is checked by the NACL first, then by the Security Group at the ENI, and the NACL is the only one of the two that's stateless.
Elastic IPs and ENIs: identity that outlives the instance
An Elastic IP is a static public IPv4 address you own until you release it; an ENI is a virtual network card you can detach from one instance and attach to another.
VPC Peering is direct, private, and never transitive
Peering connects exactly two VPCs with private RFC 1918 connectivity, no data transfer charge within an AZ, and explicitly no transitive routing through a third VPC.
Gateway endpoints are free; interface endpoints are PrivateLink
A Gateway endpoint is a route table entry for S3/DynamoDB at no extra cost; an Interface endpoint is an ENI in your subnet, priced per hour and per GB, and is the actual PrivateLink mechanism.
ALB, NLB, and Gateway Load Balancer solve different problems
ALB inspects HTTP content for Layer 7 routing; NLB forwards raw TCP/UDP at Layer 4 with static IPs and PrivateLink support; GWLB transparently inserts a fleet of inspection appliances inline.
Six routing policies, one DNS service
Route 53 is authoritative DNS with six distinct routing policies, each answering a different 'which record do I return' question.
CloudFront optimizes what's delivered, not how it travels
CloudFront is a CDN caching HTTP(S) content at edge locations close to users, reducing both latency and origin load; Global Accelerator (later in this deck) optimizes the network path instead.
Shield, WAF, and the edge defense stack
Shield Standard is automatic DDoS protection for every AWS customer; Shield Advanced adds paid, larger-scale mitigation; WAF filters Layer 7 HTTP threats by rule, all three layered together at the edge.
VPC Flow Logs: the record of what actually happened
Flow Logs capture IP traffic metadata (not payload) at the ENI, subnet, or VPC level, and are the primary forensic tool for answering 'was this connection actually allowed, and by what.'
Transit Gateway: from N-squared peering to one hub
Transit Gateway is a Regional virtual router that every VPC attaches to once, replacing pairwise peering's combinatorial explosion with linear, centrally managed connections.
Direct Connect: a physical circuit, not a tunnel
Direct Connect is a dedicated physical network connection from your premises into an AWS Direct Connect location, carrying private, public, or transit virtual interfaces on top.
Direct Connect resiliency is a model you choose, not a default
AWS defines named resiliency models (High Resiliency at 99.9% SLA, Maximum Resiliency at 99.99%), each specifying exactly how many connections across how many locations you need.
Direct Connect Gateway: one circuit, many regions
A Direct Connect Gateway lets one Direct Connect connection reach up to 20 VPCs (via Virtual Private Gateways) or up to 6 Transit Gateways, across almost any AWS Region.
Site-to-Site VPN and Client VPN solve different connectivity problems
Site-to-Site VPN connects a whole on-premises network to a VPC over IPsec tunnels; Client VPN connects individual remote users to AWS resources, a fundamentally different traffic shape.
Choosing hybrid connectivity: bandwidth vs. lead time vs. cost
Site-to-Site VPN sets up in minutes at modest bandwidth; Direct Connect delivers far higher, more consistent bandwidth but takes weeks of physical provisioning; most enterprise architectures run both together.
Cloud WAN: the network becomes a policy document
AWS Cloud WAN replaces manually created Transit Gateways, peering connections, and per-region route tables with one JSON policy describing the intended global network, which AWS then deploys and manages.
VPC sharing: one network, many accounts
AWS Resource Access Manager lets a central networking account own a VPC's subnets while other accounts launch resources directly into them, no peering, no Transit Gateway, no per-account VPC required.
PrivateLink: a service exposed as an ENI, nothing more
AWS PrivateLink places an Elastic Network Interface in the consumer's subnet, backed by an NLB in front of the provider's service, so no VPC peering, no route table entries, no public exposure is ever required.
VPC Lattice moves service networking up to Layer 7
VPC Lattice registers services into a shared service network with automatic discovery, IAM-based authorization, and path-based routing, without per-pair endpoint configuration.
PrivateLink vs. VPC Lattice vs. Transit Gateway: the 2026 pattern
Real, current pricing shows VPC Lattice materially cheaper than PrivateLink-plus-NLB for equivalent service access, and the emerging pattern layers all three by role rather than picking one winner.
Route 53 Resolver: DNS that crosses the on-premises boundary
Inbound endpoints let on-premises resolvers query AWS-hosted DNS; outbound endpoints let AWS resources query on-premises DNS, with conditional forwarding rules deciding which queries go where.
Five layers deep: NACL to Shield Advanced
Security Groups, NACLs, AWS Network Firewall, AWS WAF, and Shield Advanced each defend a different layer, and a mature architecture runs all five together, not any one in isolation.
Global Accelerator: two static IPs, one fast path
Global Accelerator provides two static anycast IPs that route any TCP/UDP traffic onto AWS's backbone at the nearest edge, with fast health-check-based failover, unlike CloudFront's HTTP-only caching model.
Three tools that answer 'why can't this reach that'
Reachability Analyzer tests one specific path hop by hop; Network Access Analyzer scans your whole network for unintended access patterns; Traffic Mirroring copies real packets out for deep inspection.
IPv6 in AWS is additive, not a migration
You enable IPv6 as a dual-stack addition alongside existing IPv4, never as a replacement, and adoption is now extending into VPC endpoints for private, IPv6-only workloads.
Bandwidth is a design decision, not a given
Elastic Network Adapter (ENA) driver choice, cluster placement groups, and instance-type bandwidth ceilings together determine real achievable throughput, and the wrong choice silently caps it well below what the account-level quota allows.
Scenario: a global SaaS platform's hub-and-spoke backbone
A multi-tenant SaaS company standardizes on Transit Gateway as its backbone, VPC Lattice for internal service-to-service calls, and PrivateLink specifically for the one API it exposes to enterprise customers' own VPCs.
Scenario: a trading platform's latency and compliance walls
A low-latency trading system uses cluster placement groups and NLB for microsecond-sensitive paths, while a separate compliance-mandated VPC, walled off by Network Firewall and strict NACLs, handles regulated customer data.
Scenario: merging two companies' networks without an outage
An acquiring company uses Transit Gateway and Direct Connect Gateway to bridge two previously separate networks with overlapping CIDR ranges, resolved through PrivateLink and NAT rather than a disruptive re-IP.
Scenario: a network that survives losing a region
A multi-region disaster recovery architecture uses Route 53 health-check failover for DNS-layer redirection, Global Accelerator for connection-layer failover, and Transit Gateway peering across regions for data replication paths.
Scenario: exiting a data center without a hard cutover
A company migrating off a legacy data center runs Direct Connect (primary) plus Site-to-Site VPN (automatic failover) throughout a months-long, workload-by-workload migration, only decommissioning the circuit once the last workload moves.
The Advanced Networking Specialty exam, domain by domain
ANS-C01's four domains, and which slides in this deck map to each, for anyone specifically targeting that certification.
The traps that recur across every certification level
Five patterns of mistake that show up as distractors from the Associate exam through the Specialty, not isolated facts to memorize per-service.
Quick-fire recall
A rapid-drill term list spanning the whole deck, for a last pass before an exam or a design review.
The one-page decision cheat sheet
A single decision tree distilling every connectivity and security choice in this deck down to the first question that actually narrows the field.
Readiness checklist: is this network actually enterprise-grade?
The minimum signals that separate a genuinely production-ready AWS network from one that merely works in a demo.