Domain 3 of 4 · Chapter 5 of 8

Network Services

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing AWS Certified Cloud Practitioner premium course — no separate purchase.

Included in this chapter:

  • The VPC and its building blocks
  • VPC security: security groups vs. network ACLs
  • DNS and hybrid connectivity: Route 53, VPN, Direct Connect
  • Edge and scaling services: CloudFront, API Gateway, Global Accelerator, PrivateLink, Transit Gateway

Security group vs. network ACL

PropertySecurity groupNetwork ACL
Operates atInstance / network interface levelSubnet boundary
StateStateful (return traffic auto-allowed)Stateless (allow both directions)
Rule typesAllow rules onlyAllow and explicit deny rules
Default behaviorDenies all inbound, allows all outboundDefault ACL allows all traffic
Rule evaluationAll rules evaluated togetherRules processed in number order

Decision tree

Need only private access to one service, no full network route? Yes AWS PrivateLink private, stays off the internet No Connecting an on-premises network to AWS? Yes Need consistent, dedicated performance off the internet? No Public internet via an internet gateway Yes AWS Direct Connect dedicated private link No AWS Site-to-Site VPN quick encrypted internet tunnel
Cheat sheet

Cheat sheet

  • A VPC is your logically isolated private network in AWS
  • A subnet lives in exactly one Availability Zone
  • Public vs. private subnet is decided by the route table
  • NAT gateway gives private subnets outbound-only internet
  • Security groups are stateful; NACLs are stateless
  • Security groups allow only; NACLs can also deny
  • Security group = instance; NACL = subnet
  • Default security group blocks outside inbound; default NACL allows everything
  • Route 53 does DNS, domain registration, and health checks
  • Site-to-Site VPN is an encrypted IPsec tunnel over the internet
  • Direct Connect is a dedicated private link that bypasses the internet
  • Direct Connect is private but not encrypted on its own
  • CloudFront caches content at edge locations near users
  • API Gateway is a managed front door for your APIs
  • Global Accelerator gives you two static anycast entry-point IPs
  • CloudFront caches; Global Accelerator optimizes the path
  • PrivateLink keeps service traffic off the public internet
  • Transit Gateway is a central hub for many VPCs and on-prem
  • Network controls govern traffic, not identity
  • CloudFront serves from cache until TTL, then refetches from origin

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html
  2. https://docs.aws.amazon.com/vpc/latest/userguide/how-it-works.html
  3. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html
  4. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html
  5. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html
  6. https://docs.aws.amazon.com/vpc/latest/userguide/default-security-group.html
  7. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
  8. https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html
  9. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/Welcome.html
  10. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html
  11. https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html
  12. https://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html
  13. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html
  14. https://docs.aws.amazon.com/apigateway/latest/developerguide/welcome.html
  15. https://docs.aws.amazon.com/global-accelerator/latest/dg/what-is-global-accelerator.html
  16. https://aws.amazon.com/global-accelerator/faqs/
  17. https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html
  18. https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html