Module 6 · SAA-C03

Networking and content delivery

VPC, subnets, route tables, Security Group / NACL, NAT, endpoints, connecting VPCs to each other and to on-prem, Route 53, CloudFront, Global Accelerator.

DomainSecure architectures
DomainResilient architectures
DomainHigh-performing architectures
DomainCost-optimized architectures
15 diagrams
10 scenarios
13 services

5-minute essentials

A VPC lives in one Region; a subnet lives in exactly one AZ.To survive the loss of an AZ, every tier (ALB, app, NAT, database) must be present in at least 2 AZs.
A subnet is "public" only because its route table has 0.0.0.0/0 → Internet Gateway.There is no other public/private switch. An instance also needs a public IP (auto-assigned or Elastic IP) to reach and be reached from the internet directly.
VPC and subnet CIDRs: /16 to /28; each subnet loses 5 addresses (first 4, last 1).A /24 leaves 251 usable addresses, a /28 leaves 11. You cannot resize an existing CIDR; if you run short, add a secondary CIDR.
Security Group: attached to an ENI, allow rules only, stateful. NACL: attached to a subnet, allow and deny, stateless, evaluated by rule number.To block a specific IP: use a NACL (or WAF for web). A NACL must also open the return direction (ephemeral ports 1024–65535).
A NAT Gateway lets instances in a private subnet reach out to the internet, but lets no one from outside connect in.The zonal type (default) sits in a public subnet, one per AZ, so one AZ going down doesn't take internet away from the other. Since November 2025 there is also a regional type that spans AZs automatically.
Gateway endpoint (S3 and DynamoDB only) is free and is a target in the route table. Interface endpoint (PrivateLink) is an ENI with a private IP, billed per hour and per GB.Access S3 from a private subnet without going through NAT: gateway endpoint, cheap and never leaves for the internet. From on-prem or through Transit Gateway you must use an interface endpoint.
VPC peering is not transitive and does not allow overlapping CIDRs.A–B and B–C does not mean A can reach C. Many VPCs that need to talk to each other, or share one path to on-prem: Transit Gateway.
Site-to-Site VPN: IPsec encryption over the internet, up in minutes, up to 1.25 Gbps per tunnel (large bandwidth tunnels up to 5 Gbps).Good as a temporary connection or as a backup path for Direct Connect.
Direct Connect: private line, consistent latency, 1/10/100/400 Gbps ports, takes weeks to provision. Not encrypted by default.Need encryption: VPN over Direct Connect, or MACsec on supported ports.
Route 53 has 8 routing policies: simple, weighted, latency, failover, geolocation, geoproximity, IP-based, multivalue answer.The exam often asks which one fits a requirement: active-passive DR → failover; by the user's country → geolocation; fastest → latency.
CloudFront caches content at the edge; lock down the S3 bucket with OAC (Origin Access Control) so only CloudFront can read it.OAI is the legacy approach and does not support SSE-KMS or PUT/DELETE; AWS recommends OAC.
Global Accelerator gives 2 static anycast IPs, brings TCP/UDP traffic onto the AWS network at the nearest edge, and fails over when an endpoint is unhealthy.Need fixed IPs for customers to whitelist, UDP for gaming / VoIP, or fast failover that doesn't depend on DNS caching: Global Accelerator, not CloudFront.
Every public IPv4 address is billed hourly, including an Elastic IP attached to an instance.Older questions say an EIP attached to a running instance is free: no longer true.

Diagrams

Two-AZ VPC: public subnets, private subnets, NAT per AZ

Public subnets have a 0.0.0.0/0 route to the Internet Gateway. Private subnets reach the internet through the NAT Gateway in the same AZ, so one AZ failing doesn't take internet away from the other.

Step by step

Requests from the internet come in through the Internet Gateway to the ALB in the public subnets.
The ALB balances load across app instances in the private subnets of both AZs; the app has no public IP.
The app writes to the RDS primary; RDS replicates synchronously to the standby in the other AZ (Multi-AZ).
The app downloads patches: out through the NAT Gateway in the same AZ, then the Internet Gateway; no one can initiate the reverse direction.

A request passing through a NACL and a Security Group

A NACL keeps no state, so it needs rules for the return direction too; a Security Group is stateful, so return traffic is allowed automatically.

VPC peering is not transitive; Transit Gateway acts as a hub

Left: A–B and B–C are peered, but A cannot reach C. Right: every VPC attaches to the Transit Gateway, reaches the others, and shares the VPN to on-prem.

Step by step

Peering is a one-to-one connection. A–B and B–C are peered.
Peering is not transitive: A cannot go through B to reach C; for that you must create an extra A–C peering.
Transit Gateway: each VPC, VPN or Direct Connect is an attachment; the TGW route tables decide who can reach whom.

Direct Connect as the primary path, Site-to-Site VPN as backup

Direct Connect uses a private line through a DX location; the VPN goes over the internet with IPsec encryption. Both connect to the same gateway on the AWS side, and BGP prefers the DX path.

Step by step

Normally: traffic goes over Direct Connect (consistent latency, high bandwidth, not encrypted by default).
DX fails: BGP switches to the Site-to-Site VPN over the internet, IPsec-encrypted, lower bandwidth.
To connect many VPCs or several Regions, replace the virtual private gateway with Transit Gateway / Direct Connect gateway.

Gateway endpoint vs interface endpoint

A gateway endpoint (S3, DynamoDB) is a target in the route table and is free. An interface endpoint is an ENI with a private IP in the subnet, is billed, and can be used from on-prem too.

Step by step

To S3 / DynamoDB: the route table has the service's prefix list pointing to the gateway endpoint. No NAT, no endpoint charge.
Other services: the interface endpoint is an ENI; private DNS makes the service name resolve to this private IP.
From on-prem (or through Transit Gateway, inter-Region peering) only an interface endpoint works.

PrivateLink: customers call your service over private IPs

The provider puts the service behind an NLB and creates an endpoint service. Customers create an interface endpoint in their own VPC. Only one service is exposed, one-way, and overlapping CIDRs still work.

Step by step

The customer's app calls the private IP of the interface endpoint in their own VPC.
Traffic stays on the AWS network to your NLB; no peering, IGW or NAT needed, and overlapping CIDRs are fine.

CloudFront in front of a private S3 bucket (OAC) and an ALB

Users hit the nearest edge. Static content comes from a private S3 bucket via OAC; API calls go to the ALB. WAF is attached to the distribution.

Step by step

Users reach the nearest edge location; WAF filters requests before they hit the cache.
Cache miss: CloudFront signs the request with OAC; the bucket policy allows only this distribution, so no one can read the bucket directly.
The /api/* path goes to the ALB; it can be cached per cache policy or not cached at all.

Route 53 failover between two Regions

The primary record has a health check attached. When the health check reports a failure, Route 53 returns the secondary record. Switchover time depends on the record's TTL.

Step by step

Normally: the primary's health check is healthy and Route 53 returns the primary Region's address.
Health check fails: Route 53 returns the secondary record; users move to the secondary Region once their DNS cache TTL expires.

Global Accelerator: 2 static anycast IPs in front of multiple Regions

Users enter the nearest edge via static IPs and continue over the AWS network to a healthy endpoint. Supports TCP and UDP; failover does not depend on DNS caching.

Step by step

Customers whitelist 2 static IPs; traffic enters the AWS network right at the edge near the player.
Global Accelerator picks a healthy endpoint by location, weight and traffic dial; if an endpoint fails, new connections go to another Region immediately.

Two-way DNS with Route 53 Resolver endpoints

Inbound endpoint: on-prem resolves names in the VPC (private hosted zone). Outbound endpoint + forwarding rule: the VPC resolves the company's internal domain names.

Step by step

On-prem resolves a name in the private hosted zone: the company DNS forwards to the inbound endpoint's IPs.
EC2 resolves a corp.example name: Resolver matches the forwarding rule and sends the query through the outbound endpoint to the company DNS.

IPv6: egress-only Internet Gateway

IPv6 addresses in a VPC are all public, and there is no IPv4-style NAT. An egress-only IGW lets instances go out to the internet over IPv6 but blocks connections initiated from outside.

Step by step

IPv6 goes out through the egress-only IGW; return traffic is allowed automatically (stateful).
IPv4 still goes through the NAT Gateway as usual.
IPv6 connections initiated from the internet are blocked.

The route table decides whether a subnet is public or private

Every route table has a built-in local route for the VPC CIDR. A subnet is public because its 0.0.0.0/0 route points to the Internet Gateway; a private subnet goes out to the internet through a NAT Gateway, while traffic to S3 matches the prefix list and uses the gateway endpoint (the more specific route wins).

Step by step

Instances in the public subnet: the 0.0.0.0/0 route points to the Internet Gateway, so with a public IP they can reach and be reached from the internet.
Instances in the private subnet: 0.0.0.0/0 points to the NAT Gateway (in the public subnet), outbound only.
Traffic to S3 matches the prefix list (a more specific route than 0.0.0.0/0), so it uses the gateway endpoint, not NAT.

CloudFront: path-based cache behaviors and a failover origin group

Each cache behavior matches a path pattern and points to an origin (or origin group), with its own cache policy. An origin group has 2 origins: when a GET / HEAD / OPTIONS request gets a selected error code from the primary origin, CloudFront retries it on the secondary origin.

Step by step

The request hits the nearest edge; on a cache hit it is returned immediately.
/static/* matches the first behavior: fetched from the private S3 bucket via OAC, cached for a long time.
/api/* matches the second behavior: goes to API Gateway, usually not cached or cached briefly.
Everything else uses the default behavior to the origin group: if the primary origin returns a selected error code (e.g. 502, 503, 504), the secondary origin is tried.

VPC Flow Logs: recording who talks to whom

Flow logs are enabled at the VPC, subnet or ENI level and record IP connection info (source, destination, port, ACCEPT / REJECT), not packet contents. Use them to find a Security Group / NACL blocking by mistake or to investigate suspicious access.

Step by step

Each connection through the ENI produces a record: addresses, ports, protocol, bytes, ACCEPT or REJECT.
Pick a destination: CloudWatch Logs (fast alerting), S3 (long-term, cheap) or Firehose (push to other tools).
Query the logs on S3 with Athena, e.g. find every REJECTed connection to port 22.

Choosing how to connect a VPC

Start with the question: what does the VPC need to connect to? Each branch leads to the service the exam usually expects; details for each service are in the module's other diagrams.

Step by step

App in a private subnet reading S3: gateway endpoint, no NAT, no endpoint charge.
15 VPCs across many accounts sharing one path to on-prem: Transit Gateway.
High volume, consistent latency to on-prem: Direct Connect, plus a VPN as backup.

Quick comparisons

Security Group vs Network ACL

	Security Group	Network ACL
Attached to	ENI (instance, ALB, RDS…)	Subnet
Rule types	Allow only	Allow and deny
State	Stateful: return traffic is allowed automatically	Stateless: must open both inbound and outbound
Order	All rules evaluated	Evaluated by rule number, stops at the first match
Default	New SG: denies all inbound, allows all outbound	Default NACL: allows all; custom NACL: denies all
References	Can reference another SG (e.g. only allow the ALB's SG in)	IP ranges only

Connecting on-prem to AWS

Option	Goes over	Encryption	Bandwidth	Setup time	Use when
Site-to-Site VPN	Internet	Yes (IPsec)	Up to 1.25 Gbps per tunnel (large bandwidth tunnel: 5 Gbps)	Minutes	Need it fast, cheap, or as a backup path
Direct Connect	Private line to a DX location	No, unless you add VPN or MACsec	1/10/100/400 Gbps ports	Weeks	Large data volumes, consistent latency needed
DX + backup VPN	Both	Per path	Same as DX	Same as DX	Need a private line but cannot accept losing connectivity when DX fails
Client VPN	Internet, from each user's machine	Yes (TLS)	Per user	Minutes	Remote employees accessing the VPC

VPC endpoints

	Gateway endpoint	Interface endpoint (PrivateLink)
Services	S3 and DynamoDB only	Most AWS services, third-party services
How it works	A target in the route table	ENI with a private IP in your subnet
Cost	Free	Per hour per AZ + per GB
Usable from on-prem, inter-Region VPC peering, Transit Gateway	No	Yes
Access control	Endpoint policy + bucket policy (aws:sourceVpce)	Endpoint policy + Security Group

CloudFront vs Global Accelerator

	CloudFront	Global Accelerator
Purpose	Cache and deliver HTTP(S) content	Get traffic onto the AWS network as early as possible, pick a healthy endpoint
Protocols	HTTP, HTTPS, WebSocket	TCP, UDP
Cache	Yes	No
Addressing	Domain name, changing IPs	2 static anycast IPs (dual-stack: plus 2 IPv6)
Failover	Origin group (backup origin)	Switches to a healthy endpoint automatically, no waiting for DNS cache expiry
Best for	Web, images, video, APIs that need caching	Gaming, VoIP, IoT, apps that need fixed IPs for whitelisting

Route 53: choosing a routing policy

Policy	Answers based on	Exam example
Simple	One record (may hold several IPs, returned in random order, no health check)	A simple website
Weighted	Percentages	Gradually shift 10% of traffic to a new version
Latency	The Region with the lowest latency to the user	Global users, app running in multiple Regions
Failover	Health check: primary fails, go to secondary	Active-passive DR
Geolocation	The user's continent / country / state	Content per country's laws, blocking countries
Geoproximity	Distance to resources, can be expanded with a bias	Pull more traffic to a new Region
IP-based	The user's source IP range (CIDR)	Customers from ISP X go to endpoint Y
Multivalue answer	Up to 8 healthy records, chosen at random	Simple DNS-level load balancing with health checks

Exam scenarios

1EC2 in a private subnet needs to download patches from the internet, but no one from the internet may connect in. What do you do?

Show answer

Right: NAT Gateway in a public subnet (one per AZ), with the private subnet's 0.0.0.0/0 route pointing to the NAT Gateway in the same AZ
NAT only allows connections initiated from inside. With one NAT shared by several AZs, if the AZ holding the NAT goes down, the other AZs lose internet.

Wrong: Attach an Elastic IP to the EC2 instance
For an EIP to work, the subnet needs a route to an Internet Gateway, i.e. it becomes public: the instance is exposed to the internet.

Wrong: Create an Internet Gateway and route 0.0.0.0/0 from the private subnet to it
The subnet becomes public.

2An application in a private subnet reads and writes S3 heavily; the NAT Gateway bill has spiked. Cheapest fix?

Show answer

Right: Gateway endpoint for S3, added to the private subnet's route table
Traffic to S3 goes straight through the endpoint, not through NAT, with no endpoint charge.

Wrong: Replace the NAT Gateway with a NAT instance
Slightly cheaper but you have to run it yourself, you still pay for data transfer, and it doesn't fix the root cause.

Wrong: Interface endpoint for S3
Works, but costs per hour and per GB; a gateway endpoint does this for free.

3You need to block an IP range that is attacking a public ALB.

Show answer

Right: A deny rule in the NACL of the ALB's subnets, or AWS WAF with an IP set attached to the ALB
NACLs can deny by IP range; WAF blocks at the HTTP layer and can filter on many other criteria too.

Wrong: Add a deny rule to the ALB's Security Group
Security Groups have no deny rules.

4A company has 15 VPCs across many accounts that need to talk to each other and share one Direct Connect line to on-prem.

Show answer

Right: Transit Gateway as the hub (shared across accounts via RAM), with a Direct Connect gateway attached to the Transit Gateway
Hub-and-spoke: one attachment per VPC, and the Transit Gateway route tables decide who can reach whom.

Wrong: Full-mesh peering between the VPCs
15 VPCs need 105 peering connections, and peering is not transitive, so they cannot share the path to on-prem.

5You need a private, high-bandwidth, consistent-latency connection to on-prem that must not go down if that line fails; the budget is limited.

Show answer

Right: Direct Connect as the primary path, Site-to-Site VPN as the backup
Cheaper than two DX lines. For maximum availability, use two DX lines at two different DX locations.

Wrong: A single Direct Connect line
A single point of failure.

Wrong: Two Site-to-Site VPN connections
They go over the internet, so latency is inconsistent and bandwidth is limited.

6You sell a service running behind an NLB to hundreds of customers; they want to call it via private IPs in their own VPCs, and their CIDRs may overlap with yours.

Show answer

Right: AWS PrivateLink: create an endpoint service on the NLB; customers create interface endpoints in their own VPCs
Exposes only that service, one-way from customer to you, and overlapping CIDRs are fine.

Wrong: VPC peering with each customer
No overlapping CIDRs allowed, hundreds of connections are hard to manage, and it opens the whole network instead of one service.

7A static website on S3 must be delivered globally over HTTPS, and no one may read directly from the bucket.

Show answer

Right: CloudFront with a private S3 bucket as origin, OAC enabled, and a bucket policy that allows only that distribution
Users can only get in through CloudFront (caching, HTTPS, WAF), and the bucket stays private.

Wrong: Enable S3 static website hosting and make the bucket public
Anyone can read the bucket directly; the S3 website endpoint does not support HTTPS.

Wrong: Use OAI
Still works but is the legacy approach; no support for SSE-KMS or PUT/DELETE.

8An application runs in two Regions. Normally everyone goes to the primary Region; if the primary Region fails, traffic switches to the secondary automatically.

Show answer

Right: Route 53 failover routing: primary record with a health check, secondary record pointing to the secondary Region
When the health check fails, Route 53 returns the secondary record.

Wrong: Latency routing
Splits users across both Regions by latency; that is not active-passive.

Wrong: Weighted 100/0 without health checks
Does not switch automatically when the primary Region fails.

9A multiplayer game uses UDP in 3 Regions; enterprise customers demand a fixed list of IPs to open in their firewalls.

Show answer

Right: AWS Global Accelerator
2 static anycast IPs, UDP support, picks the nearest healthy endpoint, failover without waiting on DNS.

Wrong: CloudFront
HTTP(S)/WebSocket only, and IPs change.

Wrong: Route 53 latency routing
The IPs are still each Region's own and change when endpoints change; failover depends on DNS caching.

10On-prem servers need to resolve names in a Route 53 private hosted zone, and EC2 needs to resolve the company's internal domain names.

Show answer

Right: Route 53 Resolver: inbound endpoint (on-prem queries into the VPC) and outbound endpoint + forwarding rule (VPC queries out to on-prem DNS)
This is the AWS way to do two-way DNS in a hybrid network over VPN or Direct Connect.

Wrong: Copy DNS records to both sides by hand
Drifts easily, no automatic updates.

Quick picks

What needs to connect to what?

When you need	Use
Instances in a private subnet need outbound internet (one-way)	NAT Gateway (zonal: one per AZ; or regional mode) · see diagram
From a VPC to S3 / DynamoDB without going over the internet	Gateway endpoint (free) · see diagram
From a VPC to other AWS services, or to S3 from on-prem	Interface endpoint (PrivateLink) · see diagram
A few VPCs need to talk directly, no overlapping CIDRs	VPC peering · see diagram
Many VPCs, many accounts, sharing one path to on-prem	Transit Gateway · see diagram
Let customers call one of your services, CIDRs may overlap	PrivateLink (endpoint service on an NLB) · see diagram
On-prem ↔ AWS, needed right away or as a backup	Site-to-Site VPN · see diagram
On-prem ↔ AWS, high volume, consistent latency	Direct Connect (+ backup VPN) · see diagram
Global delivery of web/images/video, with caching	CloudFront (+ OAC for S3) · see diagram
Global TCP/UDP, static IPs needed, fast failover	Global Accelerator · see diagram
Switch to the secondary Region when the primary fails (DNS)	Route 53 failover routing + health check · see diagram

Common pitfalls

One (zonal) NAT Gateway shared by all AZs: if the AZ holding the NAT goes down, the remaining AZs lose internet.
NAT Gateway placed in a private subnet: no internet access (a zonal NAT must sit in a public subnet with a route to the IGW).
Opening a NACL inbound but forgetting outbound for ephemeral ports 1024–65535: connections hang because reply packets are blocked.
Assuming that with peering A–B and B–C, A can reach C.
Peering two VPCs with overlapping CIDRs: cannot be created.
Using a Security Group to "block" an IP: SGs have no deny.
Accessing S3 from a private subnet through NAT when a gateway endpoint does it for free.
Using a gateway endpoint for traffic from on-prem or through Transit Gateway: doesn't work, you need an interface endpoint.
Assuming Direct Connect is encrypted: it isn't, you need VPN over DX or MACsec.
Picking CloudFront for UDP traffic or when the question requires static IPs: that's Global Accelerator.
Picking latency routing for an active-passive requirement: that's failover routing.
Thinking an Elastic IP attached to a running instance is free.

Services in this module

Numbers that change (checked against AWS docs)

NAT Gateway supports 5 Gbps, scaling automatically to 100 Gbps; 1 million packets/second, scaling to 10 million; no Security Group attached. checked 2026-10-16 ↗
NAT Gateway has a regional mode that spans the AZs with workloads automatically and needs no public subnet (launched November 2025). checked 2026-10-16 ↗
Public IPv4 costs 0.005 USD/hour, including Elastic IPs attached to resources. checked 2026-10-16 ↗
Route 53 has 8 routing policies: simple, failover, geolocation, geoproximity, latency, IP-based, multivalue answer, weighted. checked 2026-10-16 ↗
Transit Gateway: up to 100 Gbps in each direction per VPC attachment per AZ. checked 2026-10-16 ↗
Direct Connect dedicated: 1, 10, 100, 400 Gbps ports. checked 2026-10-16 ↗
Site-to-Site VPN: standard tunnels up to 1.25 Gbps, large bandwidth tunnels up to 5 Gbps; MTU 1446. checked 2026-10-16 ↗
AWS recommends OAC over OAI; OAI does not support SSE-KMS, PUT/DELETE, or newer Regions. checked 2026-10-16 ↗
IPv4 subnets from /28 to /16; the first 4 and last 1 addresses are reserved. checked 2026-10-16 ↗
VPC IPv4 from /16 to /28; an existing CIDR cannot be resized, you can only add secondary CIDRs. checked 2026-10-16 ↗
Gateway endpoints are free; not usable from on-prem, inter-Region peering, or through Transit Gateway. checked 2026-10-16 ↗
Global Accelerator assigns 2 static anycast IPv4 addresses (dual-stack: plus 2 IPv6); health checks and endpoint failover are automatic. checked 2026-10-16 ↗
A CloudFront origin group has 2 origins (primary, secondary); it fails over when the primary returns a selected code among 400, 403, 404, 416, 429, 500, 502, 503, 504, and only for GET, HEAD, OPTIONS requests. checked 2026-10-19 ↗
VPC Flow Logs publish to CloudWatch Logs, S3 or Amazon Data Firehose; data is collected outside the traffic path, so throughput and latency are unaffected. checked 2026-10-19 ↗

Practice this module →