Networking: VPC, Route 53 and CloudFront

So far the service map has servers, containers, functions, storage and databases, but nothing connecting them. In the old server room the network was a switch, a firewall and a router that Mateo configured from a laptop with a blue console cable. In AWS the network is software, and it is built before anything else, because every EC2 instance, database and load balancer must be placed inside it. Gwen spends this session at the whiteboard drawing boxes inside boxes.

This lesson covers the private network you build in AWS, called a virtual private cloud; the parts inside it; the two layers of firewall rules; ways to connect networks together and to reach AWS services privately; and the two services that sit at the edge between users and the application: Amazon Route 53 for domain names and Amazon CloudFront for content delivery. Connecting the clinics and head office to AWS is the next lesson.

Amazon VPC

An Amazon Virtual Private Cloud (Amazon VPC) is a logically isolated network in one AWS Region that you define and control. You choose its private IP address range, written in CIDR notation such as 10.20.0.0/16, which gives about 65,000 addresses. Nothing can reach resources in a VPC, and they cannot reach anything outside it, unless you configure a path. Every account comes with a default VPC in each Region so that people can launch instances quickly, but production systems normally use VPCs designed for them.

A VPC spans all the Availability Zones in its Region, but it is divided into subnets, and each subnet lives in exactly one Availability Zone. A subnet is a smaller block of the VPC's addresses, such as 10.20.1.0/24 (256 addresses, of which AWS reserves five). Placing subnets in two or three zones is how a network supports the multi-AZ designs from the earlier lessons.

Public and private subnets, gateways and routes

What makes a subnet public or private is not its name but its route table, the set of rules that tells traffic where to go next.

• An internet gateway is attached to a VPC to allow communication with the internet. A public subnet has a route sending internet-bound traffic (0.0.0.0/0) to the internet gateway, and resources in it can have public IP addresses. Load balancers and a few tightly controlled systems belong here.
• A private subnet has no route to the internet gateway. Resources there cannot be reached from the internet. Application servers and databases belong here.
• A NAT gateway sits in a public subnet and lets resources in private subnets start outbound connections to the internet, for example to download software updates, while still blocking inbound connections from the internet. A NAT gateway is per Availability Zone, so resilient designs use one in each zone.
• Virtual private gateways and transit gateways connect a VPC to on-site networks; they appear in lesson 6.

Gwen's design for Cascade Ridge production follows the figure: a VPC in us-west-2 with public and private subnets in two Availability Zones. The Application Load Balancer for VetLedger and BookVet sits in the public subnets. The VetLedger instances and the RDS database sit in private subnets. A NAT gateway in each zone lets the Windows servers fetch updates. A matching VPC, with a different address range so the two can later be connected, is planned in the disaster recovery Region.

# Plan subnets for the production VPC with Python's ipaddress module.
import ipaddress

vpc = ipaddress.ip_network("10.20.0.0/16")
print("VPC", vpc, "has", vpc.num_addresses, "addresses")
subnets = list(vpc.subnets(new_prefix=24))[:4]
names = ["public-a", "public-b", "private-a", "private-b"]
for name, net in zip(names, subnets):
    usable = net.num_addresses - 5            # AWS reserves five addresses in each subnet
    print(f"{name:10s} {str(net):15s} usable {usable}")

VPC 10.20.0.0/16 has 65536 addresses
public-a   10.20.0.0/24    usable 251
public-b   10.20.1.0/24    usable 251
private-a  10.20.2.0/24    usable 251
private-b  10.20.3.0/24    usable 251

Security in a VPC: security groups and network ACLs

A VPC has two layers of traffic rules, and the exam loves to compare them.

In practice, security groups do most of the work. A powerful habit is to refer to other security groups instead of IP addresses: the VetLedger instances' security group allows the application port only from the load balancer's security group, and the database's security group allows the SQL Server port only from the VetLedger instances' group. If an instance is replaced, the rules still work. Network ACLs act as a coarse outer layer, for example to block a range of addresses at the subnet edge.

Hannah asks where vulnerability scanning fits, since the exam guide mentions Amazon Inspector alongside VPC security. Inspector automatically scans EC2 instances, container images in ECR and Lambda functions for known software vulnerabilities and unintended network exposure, and ranks findings by risk. It does not filter traffic; it tells you what to fix. Gwen adds it to the security column of the service map.

# Simulate how a stateless network ACL evaluates rules: lowest number first, first match wins.
rules = [(100, "allow", 443), (110, "allow", 1024), (200, "deny", None), ("*", "deny", None)]

def nacl_decision(port):
    for num, action, rule_port in rules:
        if rule_port is None or rule_port == port:
            return f"port {port}: rule {num} -> {action}"
    return "no match"

for p in (443, 3389, 1024):
    print(nacl_decision(p))

port 443: rule 100 -> allow
port 3389: rule 200 -> deny
port 1024: rule 110 -> allow

Connecting VPCs and reaching AWS services privately

As organizations grow, they have many VPCs: one per environment, per account or per Region. Several services connect them.

• VPC peering connects two VPCs so they can talk using private addresses, within or across Regions and accounts. Peering is not transitive: if A peers with B and B with C, A cannot reach C through B.
• AWS Transit Gateway acts as a central hub that connects many VPCs and on-site networks, replacing a web of peering connections with a hub-and-spoke design.
• VPC endpoints let resources reach AWS services such as S3 or DynamoDB without going through the internet or a NAT gateway. Gateway endpoints serve S3 and DynamoDB; interface endpoints, powered by AWS PrivateLink, give private addresses inside the VPC for many other AWS services and for services offered by other companies.

Cascade Ridge will use a gateway endpoint for S3, so that the nightly report jobs write to S3 without passing through the NAT gateway, which also avoids NAT data charges. Gwen expects a Transit Gateway later, once there are separate production, development and security accounts, each with its own VPC.

Amazon Route 53

People reach BookVet by typing a name, not an IP address. Amazon Route 53 is AWS's highly available and scalable Domain Name System (DNS) service. It does three jobs.

• Domain registration: buying and renewing domain names such as cascaderidgevet.example.
• DNS hosting: answering queries for the records in a hosted zone, such as which address serves www or book. Public hosted zones answer the internet; private hosted zones answer only inside chosen VPCs.
• Health checks and routing policies: checking whether endpoints are healthy and choosing how to answer. Simple routing returns one answer; weighted routing splits traffic in chosen proportions, useful for testing a new version with a small share of users; latency-based routing sends users to the Region that responds fastest for them; failover routing sends traffic to a standby when the primary is unhealthy; geolocation and geoproximity routing answer by where the user is.

Failover routing matters most to Dr. Kaur. If the primary Region were ever unavailable, Route 53 health checks would notice and point book.cascaderidgevet.example at the copy in the disaster recovery Region. Gwen is careful to say that DNS failover is only one piece: the recovery copy must also have current data and running servers, which is a disaster recovery design question for a later course.

Amazon CloudFront and the edge

Lesson 1 of the first course introduced edge locations, the hundreds of sites around the world where AWS serves content close to users. Amazon CloudFront is the content delivery network that uses them. You point a CloudFront distribution at an origin, such as an S3 bucket or a load balancer. When a user requests a file, CloudFront serves it from the nearest edge location if it has a cached copy, and fetches it from the origin only on a cache miss. Users get faster responses; the origin handles far fewer requests.

CloudFront also improves security: it can require HTTPS, integrates with AWS WAF (the web application firewall) and AWS Shield for protection against distributed denial-of-service attacks, and can restrict an S3 bucket so that it is reachable only through CloudFront. For dynamic, uncacheable traffic such as API calls, CloudFront still helps because connections from the edge to the origin travel over the AWS global network.

A related service, AWS Global Accelerator, also uses the edge network but does not cache. It gives an application two static IP addresses and routes user traffic onto the AWS network at the nearest edge, then to the healthiest Regional endpoint. It suits non-HTTP applications and cases that need fixed IP addresses or very fast Regional failover.

Logging network traffic

When something goes wrong on a network, the first question is often whether the traffic arrived at all. VPC Flow Logs capture information about the IP traffic going to and from network interfaces in a VPC: source and destination addresses and ports, the protocol, the number of bytes, and whether the traffic was accepted or rejected by security groups and network ACLs. Flow logs do not capture the content of the traffic. They are delivered to CloudWatch Logs or S3, where they can be searched or analyzed with Athena.

Hannah wants flow logs turned on for the production VPC from day one, kept for a year, so that if a security question ever arises there is a record of what talked to what. Mateo sees a more everyday use: the next time a clinic says it cannot reach VetLedger, a flow log will show in a minute whether the traffic is being rejected by a rule, which today takes him an afternoon of guessing.