Inside a VPC, the choice of how instances reach the internet or AWS services affects both security and cost. A NAT Gateway lets private-subnet resources make outbound calls (for package updates, for example) while remaining unreachable from the internet. Gateway VPC Endpoints are free and route traffic privately to S3 and DynamoDB through the VPC routing table. Interface VPC Endpoints, powered by PrivateLink, provide private connectivity to most other AWS services for an hourly and per-GB price.
Connecting multiple VPCs and on-premises networks quickly grows complex. VPC peering is one-to-one with no transitive routing, so a hub-and-spoke pattern with many VPCs is better served by AWS Transit Gateway. AWS Network Firewall delivers managed stateful inspection inside a VPC, and AWS Firewall Manager centrally applies WAF and firewall rules across an organization. For hybrid DNS, Route 53 Resolver inbound and outbound endpoints let on-premises resolvers query private hosted zones and let VPC resources resolve on-premises names.
Load balancing and global traffic management are layered services. The Application Load Balancer (ALB) operates at layer 7 and supports path- and host-based routing, ideal for microservices and HTTP workloads, and its listener security policy is where you enforce TLS 1.2 or higher. The Network Load Balancer (NLB) operates at layer 4, preserves client source IPs, supports static IPs, and handles TCP and UDP. In front of regional ALBs, AWS Global Accelerator advertises anycast IPs from the AWS edge for cross-region failover and lower first-hop latency. Route 53 supports failover routing, where health-checked primary and secondary records automatically redirect traffic when the primary becomes unhealthy. CloudFront, the CDN, accelerates static and dynamic content at the edge; to force HTTPS you set the Viewer Protocol Policy to HTTPS Only or Redirect HTTP to HTTPS, PriceClass_100 limits costs to North America and Europe edges, and Origin Access Control keeps S3 origins private.