AWS Builder Center

Builder Center

Week 5: Networking and Content Delivery

Building on our VPC basics, this article covers connecting cloud to on-premise infrastructure via VPN and Direct Connect, streamlining multi-VPC networks, and optimizing global speed using Route 53 and CloudFront.

Moving on from the several connections that can happen between VPCs, we explore two AWS services that relate to VPC and on-site connections, namely: AWS Direct Connect and Site-to-Site VPN.
Site-to-Site VPN sets up an encrypted tunnel over the public internet to link your network to a VPC. Here, the data is protected, but the quality of the network depends on network traffic conditions. There are several factors to consider when setting up a Site-to-Site VPN:
  • Setup and Cost: Quick to configure via software with low upfront costs.
  • Performance: Standard speed reaches up to 1.25 Gbps per tunnel, though performance varies depending on internet conditions (you can scale this higher by combining multiple tunnels with Transit Gateway).
  • Security: Uses IPsec encryption, keeping data perfectly safe as it travels across public networks.
Direct Connect provides a dedicated, private fiber line from your premises directly to AWS, skipping the public internet altogether. There are also factors to consider here:
  • Setup and Cost: It requires physical hardware setup, either in your own facility or through a co-location partner, and it can take anywhere from 4 to 12 weeks to be established. It also comes with higher baseline costs.
  • Performance: Delivers consistent bandwidth ranging from 1 Gbps to 100 Gbps (or more) with stable, ultra-low latency and zero fluctuations from internet congestion.
  • Security: The connection is physically private and can be further enhanced with MACsec encryption for data-in-transit.

VPC Endpoints, Transit Gateway & PrivateLink

Now, what if resources in your private subnet need to talk to other AWS services like S3 or DynamoDB, but you don't want that traffic touching the public internet at all? That brought about VPC Endpoints. A VPC Endpoint is a secure, private connection that lets your VPC resources talk to supported AWS services using AWS's own internal private network, bypassing the public internet entirely.
This leads us to AWS PrivateLink, which is actually the underlying technology that powers certain VPC endpoints (specifically, Interface Endpoints). Think of PrivateLink as a secure conduit that drops a private network card (an ENI) directly into your subnet. This is huge because it allows you to securely share your own applications, or connect to third-party SaaS apps across different AWS accounts. The best part? PrivateLink completely eliminates IP overlap conflicts, so networks can connect even if they use the exact same IP ranges.
Finally, remember how we talked about VPC Peering not supporting transitive routing? If you have tens or hundreds of VPCs, managing all those individual peering lines becomes a total nightmare. To solve this, AWS created the Transit Gateway. I'd look at Transit Gateway as a centralized cloud router for your entire infrastructure. Instead of peering every VPC to every other VPC in a messy web, you just plug all your VPCs, AWS accounts, and on-premises offices directly into this one central hub. It acts as a single router that handles all cross-network communication, easily scaling your network without the headache.

Content Delivery Services

As part of AWS' plans to ensure that there's indeed space for everyone in it, we get introduced to two services today: Amazon Route 53 and CloudFront.
Amazon Route 53 is AWS' highly available and scalable Domain Name System (DNS) service. It is used to route users to an address on the internet by translating a human-friendly URL (likebuilder.aws.com) to the IP address that uniquely identifies computers. It is IPv4 and IPv6 compliant, handles domain registration, and runs automated health checks to ensure traffic only goes to healthy servers. Route 53 supports several intelligent routing policies:
  • Simple routing: Directs traffic to a single resource.
  • Geolocation: Routes traffic based on the user's physical location.
  • Geoproximity: Routes traffic based on the geographic location of your resources.
  • Weighted: Distributes traffic across multiple resources based on percentages you define.
  • Failover: Redirects users to a backup server if your primary server fails its health check.
  • Latency-based: Routes traffic to the AWS region that provides the fastest response time for the user.
  • Multivalue answer: Responds to DNS queries with up to eight healthy IP addresses for basic load balancing.
Amazon CloudFront is AWS’s fast Content Delivery Network (CDN) service that securely delivers data, videos, applications, and APIs to users globally with low latency. Instead of making users fetch data from your origin server (like an EC2 instance or S3 bucket) halfway across the world, CloudFront caches copies of your content at a network of worldwide data centers called Edge Locations. When a user requests content, it is instantly delivered from the closest Edge Location. It integrates seamlessly with AWS Shield and Web Application Firewall (WAF) to block malicious attacks directly at the edge, keeping your applications both lightning-fast and highly secure.
# aws-networking# networking-content-delivery# cloud-practitioner# aws-academy# aws-student-builders-groups
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article