AWS Advanced Networking Specialty Course Notes

Network Design is a service-selection and tradeoff domain. CloudFront is the CDN/edge-delivery choice for HTTP(S) content and can cache static or dynamic content; Global Accelerator provides static anycast IPs and moves application traffic onto the AWS global network toward healthy regional endpoints. Route 53 public hosted zones serve internet DNS, private hosted zones serve associated VPCs, and Resolver inbound/outbound endpoints plus rules integrate hybrid DNS. ALB is Layer 7 HTTP/HTTPS; NLB is Layer 4 TCP/UDP/TLS; GWLB inserts virtual appliances. Flow Logs provide flow metadata, Traffic Mirroring provides packet copies, and Reachability Analyzer evaluates configuration-based reachability without sending packets. Hybrid resilience requires independent physical/failure paths. VPC peering is direct and non-transitive, Transit Gateway is a scalable transitive routing hub, and PrivateLink gives service-oriented private access without broad network routing. IP plans must reserve growth and avoid overlap wherever routed connectivity may be required.

• Treating CloudFront as static-only.

• Reduce design questions to protocol, scope, routing model, failure domain, security boundary, and scale.

Network Implementation converts design intent into exact AWS configuration. Route tables use longest prefix match, not shortest prefix. Security groups are stateful resource-level allow controls; network ACLs are stateless subnet-level allow/deny controls evaluated by rule number, so return traffic matters. Direct Connect VIF type must match the destination model: private VIF for private VPC connectivity, public VIF for AWS public service prefixes, and transit VIF for Transit Gateway connectivity through a Direct Connect gateway. Site-to-Site VPN requires correct tunnel parameters, both tunnels, and the intended static/BGP routing model. Automation should be repeatable, version-controlled, validated, observable, and reversible. AWS RAM/VPC sharing preserves central VPC ownership while participant accounts deploy permitted resources into shared subnets.

• Saying shortest prefix wins.

• Sort matching routes from most specific to least specific.

Network Management and Operation is evidence-driven troubleshooting. Verify control-plane state separately from data-plane/application behavior. For BGP, check session state, advertised/received prefixes, propagation, selected routes, and path attributes. VPC Flow Logs record flow metadata such as addresses, ports, protocol, bytes/packets, action, and log status; they are not packet captures and some metadata is best-effort. Reachability Analyzer statically models AWS network configuration and does not send packets, so 'reachable' does not prove the application is healthy. MTU problems require end-to-end path analysis, encapsulation awareness, and Path MTU Discovery/ICMP understanding. Performance and cost optimization should model the complete traffic path, including AZ/Region crossings and per-service processing charges.

• Equating BGP adjacency with correct routing.

• Troubleshoot route/BGP → AWS controls → flow evidence → packets/application.

Network Security, Compliance, and Governance combines traffic-path engineering with centralized control. Stateful inspection needs a consistent forward and return path; centralized Transit Gateway/firewall designs commonly use appliance mode or equivalent routing techniques to preserve flow symmetry. DNS protection can include controlled delegation, DNSSEC where appropriate, Resolver DNS Firewall, query logging, and hybrid Resolver endpoints/rules. TLS protects application sessions, IPsec protects network-layer tunnels, and MACsec provides Layer-2 point-to-point encryption on supported Direct Connect links; Direct Connect is not inherently encrypted. SCPs constrain AWS API permissions, while Firewall Manager centrally manages supported WAF, Shield Advanced, security-group/NACL, Network Firewall, and DNS Firewall policies. DDoS defense is layered: Shield and distributed architecture address network/transport attacks; WAF handles HTTP(S) application filtering/rate-based controls. Interface endpoints use PrivateLink/private IPs; gateway endpoints provide route-table-based private access specifically to S3 and DynamoDB without IGW/NAT.

• Assuming stateful firewalls tolerate arbitrary asymmetry.

• For inspection, draw forward and return paths through every AZ/TGW/firewall route.