AWS Academy Cloud Foundations — Module 5: Networking and Content Delivery

Module Objective: Describe how Amazon VPC provides an isolated virtual network, how traffic into and out of that network is controlled, and how AWS services distribute load and content across the global network.

Builds on Module 3, which introduced Regions, AZs, and edge locations as the physical backdrop for the logical networking covered here.

Amazon VPC Fundamentals

Amazon Virtual Private Cloud (VPC) is a logically isolated section of the AWS Cloud where a customer can launch resources in a virtual network they define. A VPC is scoped to a single Region and spans all of that Region's Availability Zones.

Property	Detail
IP address range	Defined as a CIDR block, e.g. `10.0.0.0/16`, when the VPC is created
Isolation	Traffic doesn't flow into or out of a VPC unless explicitly configured to do so
Default VPC	Every AWS account gets a default VPC per Region, pre-configured with public subnets, ready to use immediately

🔵 Why It Matters Amazon VPC is the networking foundation almost every other AWS service builds on top of — Amazon EC2 instances, Amazon RDS databases, and load balancers are all launched into a VPC (or its subnets).

Subnets and Route Tables

A VPC is divided into subnets, each tied to a single Availability Zone. Whether a subnet is "public" or "private" is entirely a function of its route table — AWS doesn't have a separate public/private subnet setting.

Concept	What It Is
Subnet	A range of IP addresses within a VPC, confined to one Availability Zone
Route table	A set of rules ("routes") determining where network traffic from a subnet is directed
Public subnet	A subnet whose route table sends internet-bound traffic (`0.0.0.0/0`) to an internet gateway
Private subnet	A subnet with no route to an internet gateway — resources here aren't directly reachable from, or able to reach, the internet

✅ Tip — Spread Subnets Across AZs Because each subnet lives in exactly one AZ, achieving multi-AZ high availability (Module 3) means creating at least one subnet per AZ the workload will use — commonly a public and a private subnet in each.

Connecting a VPC to the Internet

A VPC has no internet connectivity by default. Different components attach to a VPC depending on which direction traffic needs to flow.

Component	Purpose
Internet gateway (IGW)	Attached to a VPC to allow two-way communication between public subnet resources and the internet
NAT gateway	Placed in a public subnet to let resources in a private subnet initiate outbound internet traffic (e.g. for updates) without being directly reachable from the internet
Elastic IP address	A static, public IPv4 address that can be attached to a resource so its public address doesn't change

⚠️ Warning — NAT Gateway Is Not a Security Boundary A NAT gateway allows private-subnet resources to reach the internet, but it doesn't secure or filter that traffic on its own — traffic control is still handled by security groups, NACLs, and (for HTTP/S) tools like AWS WAF.

Controlling Traffic: Security Groups vs. Network ACLs

AWS provides two layers of traffic filtering inside a VPC, operating at different scopes and with different rule behavior.

Feature	Security Group	Network ACL (NACL)
Scope	Attached to individual resources (e.g. an EC2 instance's network interface)	Attached to an entire subnet
Rule type	Allow rules only	Allow and explicit deny rules
Statefulness	Stateful — return traffic is automatically allowed	Stateless — return traffic must be explicitly allowed
Rule evaluation	All rules are evaluated before deciding	Rules are evaluated in numbered order until a match is found

🔵 Note Traffic to a resource inside a subnet passes through the NACL first, then the security group. Both layers exist together — a security group can't override a NACL that's blocking traffic, and vice versa.

Elastic Load Balancing

Elastic Load Balancing (ELB) automatically distributes incoming traffic across multiple targets — such as EC2 instances — in one or more Availability Zones, improving both availability and fault tolerance.

Load Balancer Type	Best For
Application Load Balancer (ALB)	HTTP/HTTPS traffic; supports routing based on URL path or hostname
Network Load Balancer (NLB)	TCP/UDP traffic requiring extremely high performance and low latency
Gateway Load Balancer (GWLB)	Deploying and scaling third-party virtual security appliances

✅ Tip — Load Balancers Enable Multi-AZ by Design Because a load balancer spans multiple AZs and health-checks its targets, it can automatically stop sending traffic to an unhealthy instance or a failed AZ — a key building block for the high-availability patterns introduced in Module 3.

Amazon Route 53

Amazon Route 53 is AWS's scalable Domain Name System (DNS) web service, translating human-readable domain names into IP addresses. It can also register domain names and perform health checks.

Feature	What It Does
DNS resolution	Resolves domain names to the IP addresses (or other resources) they point to
Domain registration	Lets customers register and manage domain names directly
Routing policies	Supports simple, weighted, latency-based, geolocation, and failover routing, among others
Health checks	Monitors the health of endpoints and can reroute traffic away from unhealthy ones

🔵 Note Route 53 is named for port 53, the standard port used for DNS traffic — a naming convention worth remembering when trying to recall which service does what.

Amazon CloudFront

Amazon CloudFront is AWS's content delivery network (CDN) service. It caches copies of content at edge locations (Module 3's Points of Presence) around the world, so requests are served from a location physically close to the requester instead of always traveling back to the origin.

Concept	What It Is
Origin	The source of the content being distributed — commonly an Amazon S3 bucket or a web server
Edge cache	A copy of content stored at a Point of Presence close to end users
Distribution	The CloudFront configuration tying an origin to the set of edge locations serving it

✅ Tip — CloudFront Reduces Load, Not Just Latency Beyond speeding up delivery, caching content at the edge reduces the number of requests that ever reach the origin, which can lower both load and data transfer costs on the origin resource.

Key Terms for Module 5

Amazon VPC: A logically isolated virtual network within the AWS Cloud, scoped to a single Region
subnet: A range of IP addresses within a VPC, confined to a single Availability Zone
route table: A set of rules determining where network traffic from a subnet is directed
internet gateway: A VPC component allowing two-way communication between public subnet resources and the internet
NAT gateway: Lets private-subnet resources initiate outbound internet traffic without being directly reachable from the internet
security group: A stateful, allow-only firewall attached to individual resources
Network ACL (NACL): A stateless firewall, supporting allow and deny rules, attached to an entire subnet
Elastic Load Balancing (ELB): Automatically distributes incoming traffic across multiple targets in one or more Availability Zones
Amazon Route 53: AWS's scalable DNS web service, also supporting domain registration and health checks
Amazon CloudFront: AWS's content delivery network (CDN) service, caching content at edge locations worldwide

Review Questions

What determines whether a subnet is "public" or "private" in Amazon VPC?
What is the difference between an internet gateway and a NAT gateway, and when would a private-subnet resource need the latter?
What are the key differences between a security group and a network ACL?
How does Elastic Load Balancing contribute to the high-availability patterns introduced in Module 3?
What are three examples of routing policies supported by Amazon Route 53?
How does Amazon CloudFront's use of edge locations relate to the Points of Presence discussed in Module 3?
Why do both a security group and a NACL apply to traffic reaching an EC2 instance, rather than just one or the other?