Every workload that runs in a VPC ultimately relies on a small set of networking primitives. An Amazon Virtual Private Cloud (VPC) is a logically isolated virtual network scoped to a Region, defined by a CIDR block (for example, 10.0.0.0/16) and subdivided into subnets, route tables, and gateways. Every AWS account automatically gets a default VPC in each Region. Subnets are either public—with a route to an Internet Gateway and resources using public IPs that can both send and receive internet traffic—or private, with no direct internet route and resources relying on a NAT Gateway placed in a public subnet for outbound-only connectivity (think software updates). A typical multi-tier application puts web servers in public subnets and databases in private ones. Traffic protection happens in two complementary layers: Security Groups at the ENI level are stateful with only allow rules, while Network ACLs (NACLs) at the subnet level are stateless, support both allow and deny rules, and evaluate in numeric order; using both provides defense in depth.
Connecting VPCs together without traversing the public internet relies on several building blocks. VPC Peering creates private IP links between two VPCs across accounts or regions with no transitive routing and no overlapping CIDR blocks, and the route tables on both sides must be updated to take advantage of the link. AWS Transit Gateway acts as a central hub that connects VPCs, VPNs, and Direct Connect gateways, scaling to five thousand attachments and eliminating the complexity of full-mesh peering. AWS PrivateLink extends private connectivity to AWS services, SaaS offerings, and other VPCs through Interface VPC Endpoints (ENIs in your subnets), keeping traffic on the AWS backbone. The endpoints themselves come in two flavors: gateway endpoints, free and limited to S3 and DynamoDB with a route-table entry, and interface endpoints that support most services and charge per hour plus per gigabyte.
Hybrid networking pairs Site-to-Site VPN, which creates encrypted IPsec tunnels over the public internet (two tunnels per connection for redundancy, often paired with Direct Connect as a backup), with AWS Direct Connect, a dedicated private connection from one gigabit to one hundred gigabits offering consistent performance and lower bandwidth costs. AWS Client VPN uses OpenVPN-based clients so remote users can reach AWS and on-premises resources through mutual TLS or SAML-based single sign-on, ideal for distributed workforces.
Routing and content delivery use Amazon Route 53, the AWS DNS service named after port 53, which supports domain registration, public and private hosted zones, and routing policies including Simple (single resource), Weighted (traffic split by percentage), Latency-based (lowest latency region), Failover (primary plus standby), Geolocation (user location driven), Geoproximity (resource location with bias), and Multivalue Answer (multiple IPs with health checks). Health checks monitor endpoints from multiple global probes and integrate with failover and multivalue policies to remove unhealthy targets. Elastic Load Balancing distributes traffic across multiple targets through three flavors: the Application Load Balancer (ALB) at Layer 7 for HTTP and HTTPS with path- and host-based routing, the Network Load Balancer (NLB) at Layer 4 for TCP and UDP with ultra-low latency and millions of requests per second, and the Classic Load Balancer (CLB), retained for legacy workloads. Target Groups route requests to registered EC2 instances, IP addresses, Lambda functions (ALB only), or other ALBs, performing health checks and sending traffic only to healthy targets.
Amazon CloudFront is AWS's global content delivery network with more than six hundred Points of Presence that route users to the nearest edge via DNS and Anycast IPs, cache responses by TTL and cache key, and forward cache misses to origins such as S3, ALB, EC2, MediaStore, or custom endpoints, with origin failover through origin groups. Each Cache Behavior in a distribution defines which origin, viewer protocol policy, cache policy, and origin request policy apply to a URL pattern. CloudFront Functions are sub-millisecond JavaScript at the edge for viewer request and response events, ideal for URL rewrites and cache key normalization, while Lambda@Edge offers Node.js or Python with access to all four request lifecycle phases (viewer request, viewer response, origin request, origin response) for richer tasks such as A/B testing, header rewrites, and lightweight authentication. Signed URLs and signed cookies gate private content using a trusted key group or AWS account, with signed cookies especially useful for HLS and DASH streaming. For private S3 origins, Origin Access Control (OAC) replaces the older OAI, keeps the bucket private, and supports SSE-KMS plus dynamic requests.