# AWS Core Networking and Content Delivery

> Chapter 6 of the Courseiva AWS-CLOUD-PRACTITIONER curriculum — https://courseiva.com/learn/aws-cloud-practitioner/aws-core-services-networking

**Official objective:** 2.5 — Describe AWS networking and content delivery services

## Introduction

AWS networking is what connects your applications to the internet and to each other, securely and reliably. It solves the problem of how to make sure data gets from point A to point B without being intercepted, lost, or delayed. For the CLF-C02 exam, understanding these services is critical because they form the backbone of almost every real-world AWS setup, from a simple blog to a global streaming platform.

## The Town and Its Post Office Analogy

First, you build a house (your application) in a new town (AWS), but the house is useless if nobody can find it, get to it, or send you mail. This leads to the need for roads, addresses, and a postal service for your digital town.

Imagine you’ve just moved into a new housing estate. The estate is your Virtual Private Cloud (VPC) — a private, isolated piece of land you control. Your house is a server, like an Amazon EC2 instance. For anyone to visit you, they need a road into the estate. That road is an Internet Gateway — the on-ramp from the internet to your VPC. But you don’t want everyone driving straight to your front door. So you have a gate with a security guard who checks IDs — that’s a Security Group or Network Access Control List (NACL). 

Now, the post office delivers packets of data (mail) to your town. But your town might have different neighbourhoods: a public neighbourhood where the shopfronts (web servers) are, and a private neighbourhood where the back offices (databases) are. The post office needs a sorting office to decide which packets go where — this is a Route Table. If you want a faster way to get catalogues to customers across the country, you set up a distribution centre — this is Amazon CloudFront, a Content Delivery Network (CDN). It stores copies of your catalogue in cities worldwide so customers don’t have to travel all the way to your house to pick one up. 

This whole system — roads, gates, addresses, sorting offices, and distribution centres — is AWS’s core networking and content delivery. It makes sure your digital house is both safe and easy to find.

## Core explanation

At its simplest, networking is the art of connecting computers so they can talk to each other. In AWS, you have a giant global infrastructure of data centres, but you don’t just plug your server into a wall socket. Instead, you build a virtual network inside AWS called a Virtual Private Cloud (VPC). A VPC is a logically isolated section of the AWS cloud where you launch your resources, like servers (Amazon EC2 instances) and databases (Amazon RDS). Think of it as your own private bubble in the cloud.

Inside your VPC, you need to organise your resources. You divide your VPC into subnets — smaller sections that group resources together. A public subnet is one that has a route to the internet, so its resources can be reached from outside. A private subnet has no direct internet route, used for things like databases that should never be publicly accessible.

To allow resources in a private subnet to access the internet (for example, to download updates), you use a NAT Gateway (Network Address Translation). Imagine your house is on a private road with no direct access to the main street. The NAT Gateway is like a trusted neighbour who lets you use their mailbox to send and receive parcels. Your database inside the private subnet can send outbound traffic to the internet through the NAT Gateway, but the internet cannot initiate a connection back to the database.

To let the internet reach your resources in a public subnet, you attach an Internet Gateway (IGW) to your VPC. This is the door that opens to the outside world. But you don’t want just anyone walking in. That’s where Security Groups and Network Access Control Lists (NACLs) come in. A Security Group acts as a virtual firewall for a single resource (like an EC2 instance). You write rules like “allow web traffic (port 80) from anywhere” or “only allow SSH traffic (port 22) from my office IP address.” A NACL is a stateless firewall for an entire subnet, acting as a first line of defence. It’s like having a security guard at the entrance to a neighborhood (subnet) vs. a bouncer at your front door (Security Group).

Now, how does data find its way from one computer to another across the world? It does this through routing. Every VPC has a Route Table — a set of rules, called routes, that tell network traffic where to go. For example: “All traffic destined for the internet (0.0.0.0/0) should go to the Internet Gateway.” Or: “Traffic for another subnet in the same VPC should go directly to that subnet.” Without routing, your data would be lost, like a letter with no address.

What if you need to connect your on-premises data centre (your company’s physical building) to your AWS VPC? You use a Virtual Private Network (VPN) connection or AWS Direct Connect. A VPN encrypts your data and sends it over the public internet, like a secure tunnel. Direct Connect is a private, physical line from your data centre to AWS, which is faster and more reliable, but more expensive.

Finally, what about delivering content quickly to users all over the world? That’s where Amazon CloudFront comes in. CloudFront is a Content Delivery Network (CDN). Instead of having all your data sit in one data centre (e.g., in Virginia), CloudFront caches (stores copies) of your static content (like images, videos, and HTML pages) at edge locations — hundreds of data centres around the world. When a user in London requests your website, CloudFront delivers the cached version from the nearest edge location (say, London or Paris) instead of fetching it from Virginia. This dramatically reduces load times, called latency. CloudFront also provides security features like AWS WAF (Web Application Firewall) to block malicious traffic, and DDoS protection via AWS Shield.

To hand out domain names (like www.mywebsite.com) to your AWS resources, you use Amazon Route 53. This is a DNS (Domain Name System) service. DNS is like the phonebook of the internet: it translates human-friendly domain names into computer-friendly IP addresses. Route 53 can also route traffic based on the user’s location (geo-routing) or health of resources (failover routing).

## Real-world context

Consider a scenario: Sarah is a solutions architect at a medium-sized e-commerce company called “StyleHub.” The company currently runs its entire website on a single physical server in a local data centre. Traffic spikes during sales, the site slows down, and if the server fails, the site goes down completely. The CEO wants to move to AWS to be more scalable and reliable.

Sarah’s first task is to design the networking. She creates a VPC with a CIDR block of 10.0.0.0/16 — that’s 65,536 possible IP addresses, more than enough. She then creates two public subnets and two private subnets, each in different Availability Zones (AZs) for high availability. An Availability Zone is essentially a separate physical data centre within a region.

- She launches two web server EC2 instances in the public subnets, one in each AZ. She attaches an Application Load Balancer (ALB) in front of them to distribute incoming traffic. If one AZ fails, the ALB sends traffic to the other.
- She launches a relational database (Amazon RDS) in the private subnets. The database never gets a public IP address — it can only be reached by the web servers through internal routing.
- She creates a Security Group for the web servers allowing HTTP (port 80) and HTTPS (port 443) from the internet, and SSH (port 22) only from a specific management IP. For the database, the Security Group allows MySQL traffic (port 3306) only from the web server Security Group.
- To allow the web servers to download software patches from the internet, she sets up a NAT Gateway in one public subnet and updates the route table for the private subnets to send internet-bound traffic to the NAT Gateway.

Next, she optimises content delivery. The site has lots of product images and videos. She sets up CloudFront with the ALB as the origin. When a customer in Sydney, Australia, visits the site, CloudFront serves the cached images from an edge location in Sydney. The first request may be slower (cache miss), but subsequent ones are lightning fast. She also enables AWS Shield Advanced for DDoS protection.

Finally, she registers the domain “stylehub.com” with Route 53. She creates a record set that points to the CloudFront distribution. She also sets up a health check: if the website goes down, Route 53 automatically redirects traffic to a static backup page in an S3 bucket.

What does Sarah actually do day-to-day? She doesn’t click around the console for everything. She defines the entire network as code using AWS CloudFormation or Terraform. She sets up CloudWatch alarms to monitor network traffic, and uses AWS Config to ensure security group rules aren’t too permissive (e.g., no rule allowing SSH from 0.0.0.0/0). If a performance issue arises, she uses VPC Flow Logs to capture all IP traffic and analyse it in Amazon Athena.

This step-by-step process — designing subnets, configuring security, setting up CDN, managing DNS — is the practical reality of AWS networking for an IT professional. The CLF-C02 exam expects you to know which service does what in this workflow, not the exact configuraiton commands.

## Exam focus

The CLF-C02 exam focuses on your ability to distinguish between core networking services and understand their purpose. You will not be asked to configure a VPC or write a route table. Instead, the questions test scenario-based knowledge: “Which service should be used to reduce latency for global users?” or “Which component provides a firewall for a single EC2 instance?”

Here are the specific concepts the exam loves to test:

- VPC vs. Subnet vs. Internet Gateway vs. NAT Gateway: You must know the difference between them. A common trick is to present a scenario where you need to allow a private subnet to download OS updates. The correct answer will be a NAT Gateway (not an Internet Gateway, which is for public subnets).
- Security Group vs. NACL: This is a classic confusion point. Security Groups are stateful (if you allow inbound, outbound is automatically allowed) and operate at the instance level. NACLs are stateless (you must explicitly allow both inbound and outbound traffic) and operate at the subnet level. The exam will give you a scenario asking which is stateful.
- CloudFront vs. Global Accelerator: Both improve performance globally, but they do different things. CloudFront is a CDN for caching static and dynamic content (HTTP/HTTPS). Global Accelerator uses the AWS global network to route TCP/UDP traffic to the nearest healthy endpoint, improving performance for non-HTTP workloads (e.g., gaming, VoIP). The exam will ask: “Which service should you use to cache video content?” — answer: CloudFront. “Which service should you use to improve performance for a UDP gaming application?” — answer: Global Accelerator.
- Route 53 routing policies: Simple, weighted, latency-based, geolocation, failover, and multi-value. You need to know the basic use case for each. For example, “Which routing policy sends traffic to the region with the lowest latency?” — answer: Latency-based routing.
- Direct Connect vs. VPN: Direct Connect is a dedicated private connection, more reliable and consistent, but costly. VPN is over the internet, cheaper but less reliable. The exam will present a scenario requiring consistent, high-bandwidth, low-latency connection to on-premises — answer: Direct Connect.
- AWS WAF, AWS Shield, and AWS Firewall Manager: Know that WAF protects against web exploits (SQL injection, cross-site scripting), Shield protects against DDoS attacks, and Firewall Manager centrally manages firewall rules across accounts.

Key definitions to memorise:
- VPC: Virtual Private Cloud — your private section of AWS.
- Subnet: A range of IP addresses in your VPC, in a single Availability Zone.
- Internet Gateway: Allows a VPC to connect to the internet.
- NAT Gateway: Allows private subnets to access the internet but prevents internet from initiating a connection to them.
- Security Group: Stateful, instance-level firewall.
- NACL: Stateless, subnet-level firewall.
- Route Table: Contains rules that determine where network traffic is directed.
- CloudFront: Global content delivery network (CDN).
- Route 53: DNS and domain registration service.
- Direct Connect: Dedicated private network connection to AWS.
- Global Accelerator: Uses AWS global network to improve performance for non-HTTP traffic.

Exam traps read scenarios that say “need to block a specific IP address from accessing a subnet” — the trap is to pick a Security Group (which can’t block IPs directly at the subnet level). The correct answer is a NACL, because it operates at the subnet level and can explicitly deny inbound/outbound traffic from an IP range.

## Step by step

1. **Create a VPC** — First, you define a VPC with an IP address range (CIDR block). This sets the boundaries for your entire network. Every resource you launch will live within this VPC, ensuring isolation from other AWS accounts.
2. **Create Subnets** — Divide your VPC into subnets, each in a different Availability Zone. This provides high availability. You designate some subnets as public (with a route to the internet) and others as private (no direct internet access).
3. **Configure an Internet Gateway** — Attach an Internet Gateway to your VPC and add a route in the public subnet’s route table pointing 0.0.0.0/0 to the Internet Gateway. This allows resources in public subnets (like web servers) to communicate with the internet.
4. **Set up a NAT Gateway for Private Subnets** — Deploy a NAT Gateway in a public subnet. Then update the private subnet’s route table to send internet-bound traffic (0.0.0.0/0) to the NAT Gateway. This allows private resources (like databases) to download updates without being reachable from the internet.
5. **Apply Security Groups and NACLs** — Create Security Group rules to allow only necessary traffic to your EC2 instances (e.g., HTTP on port 80). For NACLs, set inbound and outbound rules at the subnet level to block or allow traffic by IP range. Remember: NACLs require explicit allow rules for both directions.
6. **Configure Content Delivery with CloudFront** — Create a CloudFront distribution and set your web server (or ALB) as the origin. CloudFront caches content at edge locations worldwide. This step dramatically improves load times for global users and offloads traffic from your origin servers.

## Comparisons

### Security Group vs Network ACL (NACL)

**Security Group:**
- Operates at the instance level (acts as a virtual firewall for individual resources)
- Stateful: if you allow inbound traffic, the outbound reply is automatically permitted
- Supports only allow rules; you cannot explicitly deny traffic by IP or port

**Network ACL (NACL):**
- Operates at the subnet level (acts as a firewall for an entire subnet)
- Stateless: you must define separate inbound and outbound rules explicitly
- Supports both allow and deny rules; you can block specific IPs

### Internet Gateway (IGW) vs NAT Gateway

**Internet Gateway (IGW):**
- Allows resources with public IPs in a VPC to communicate with the internet
- Must be attached to a public subnet to enable internet access
- Bidirectional: internet can initiate connections to resources in the subnet

**NAT Gateway:**
- Allows resources in a private subnet to access the internet
- Deployed in a public subnet and used by private subnets via route tables
- Unidirectional: only resources in private subnets can initiate outbound traffic; the internet cannot initiate connections to them

### Amazon CloudFront vs AWS Global Accelerator

**Amazon CloudFront:**
- Primarily a content delivery network (CDN) for caching static and dynamic web content
- Works at the application layer (HTTP/HTTPS protocols)
- Reduces latency by serving cached content from edge locations

**AWS Global Accelerator:**
- Designed to improve performance for both HTTP and non-HTTP traffic (e.g., UDP, TCP)
- Works at the network layer (Layer 4) by optimising routing across the AWS global network
- Does not cache content; instead, it routes traffic to the nearest healthy endpoint via anycast IP

### AWS Direct Connect vs Site-to-Site VPN

**AWS Direct Connect:**
- A dedicated physical connection from your data centre to AWS, bypassing the public internet
- Delivers more consistent, low-latency, and high-bandwidth performance
- More expensive to set up and requires longer provisioning times (weeks)

**Site-to-Site VPN:**
- Uses encrypted tunnels over the public internet
- Performance can vary due to internet congestion; generally less consistent
- Cheaper and faster to set up (minutes to hours)

## Common misconceptions

- **Misconception:** A Security Group and a NACL are the same thing, just at different levels. **Reality:** Security Groups are stateful and work at the instance level, while NACLs are stateless and work at the subnet level. This means if you allow inbound HTTPS traffic in a Security Group, outbound replies are automatically allowed. In a NACL, you must explicitly allow both inbound and outbound traffic. (Both provide firewalling, so beginners assume they are interchangeable. The stateless vs. stateful distinction is subtle but crucial for exam questions.)
- **Misconception:** An Internet Gateway (IGW) allows private subnets to access the internet. **Reality:** An IGW only provides internet access to resources that have a public IP address, typically in a public subnet. Private subnets need a NAT Gateway to access the internet without being reachable from the internet. (The word 'internet' in 'Internet Gateway' misleads people into thinking it covers all connections to the internet, regardless of subnet type.)
- **Misconception:** CloudFront and Route 53 do the same thing — both help speed up content delivery. **Reality:** CloudFront caches content at edge locations to reduce latency. Route 53 is a DNS service that translates domain names to IP addresses. While Route 53 can route traffic to the nearest endpoint using latency-based routing, it does not cache content. (Both services improve global performance, so beginners conflate them. However, CloudFront handles content caching at Layer 7, while Route 53 handles DNS resolution at Layer 4.)
- **Misconception:** A NAT Gateway and a NAT Instance are the same thing — you can pick either one. **Reality:** A NAT Gateway is a managed AWS service that is highly available and scales automatically. A NAT Instance is a manually configured EC2 instance that acts as a NAT. AWS recommends using a NAT Gateway for production to avoid single points of failure and complex management. (Beginners see 'NAT' in both names and think they are interchangeable. The exam stresses using managed services where possible.)
- **Misconception:** AWS Direct Connect is a type of VPN connection. **Reality:** Direct Connect is a physical, dedicated line from your on-premises data centre to AWS that does not traverse the public internet. A VPN, by contrast, uses encrypted tunnels over the public internet. Direct Connect is for high-bandwidth, low-latency, and regulatory compliance needs. (Both connect on-premises to AWS, so learners assume they’re just different brands of the same thing. The key differentiator is private vs. public internet.)

## Key takeaways

- A VPC is your own private network within AWS, isolated from all other AWS customers.
- Security Groups are stateful firewalls for individual EC2 instances, while NACLs are stateless firewalls for entire subnets.
- To enable a private subnet to access the internet for updates, you must use a NAT Gateway, not an Internet Gateway.
- Amazon CloudFront caches content at edge locations to reduce latency for global users, serving static and dynamic web content.
- Amazon Route 53 is a DNS service that translates domain names to IP addresses and offers advanced routing policies like latency-based and failover routing.
- AWS Direct Connect provides a dedicated physical connection from your data centre to AWS, bypassing the public internet for consistent performance.

## FAQ

**What is the difference between a public subnet and a private subnet in AWS?**

A public subnet has a route to an Internet Gateway, allowing resources with public IP addresses to be reachable from the internet. A private subnet has no direct internet route and cannot be reached from the internet, making it suitable for databases and backend services.

**Do I need both a Security Group and a NACL?**

You don’t have to use both, but AWS recommends using them together as layers of defence. Security Groups provide instance-level stateful filtering, while NACLs provide subnet-level stateless filtering. In practice, many scenarios only use Security Groups.

**What is an edge location in CloudFront?**

An edge location is a data centre that CloudFront uses to cache copies of your content. There are hundreds of them worldwide, so users receive data from the nearest location, reducing latency.

**How does Route 53 know which server to send traffic to?**

Route 53 uses routing policies that you define. For example, with latency-based routing, it checks the lowest latency between the user and your resources. With failover routing, it sends traffic to a secondary resource if the primary fails health checks.

**What is a CIDR block and why does it matter for my VPC?**

A CIDR block (Classless Inter-Domain Routing) defines the range of IP addresses available in your VPC, like 10.0.0.0/16 which gives 65,536 addresses. You must choose a range that doesn’t overlap with your other networks (e.g., your office network) to avoid IP conflicts.

**Can I connect my office network to AWS without using the public internet?**

Yes, you can use AWS Direct Connect, which is a dedicated private physical line from your on-premises data centre to AWS. It provides more consistent performance and security compared to a VPN over the internet.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/aws-cloud-practitioner/aws-core-services-networking