AWS Networking — ELB, Route 53, VPC, Direct Connect, VPN

The layers (don’t confuse them)

Layer 1 — DNS: Route 53 — "which server do I talk to?" (name → IP)
Layer 2 — Load balancing: ELB/ALB — "which instance handles this?" (spread traffic)
Layer 3 — Network: VPC — "where do instances live?" (subnets, firewalls)
Layer 4 — Connectivity: DX/VPN — "how does MY office reach AWS?"

Route 53 (DNS)

• Domain registration + DNS hosting. Resolves app.com → ALB DNS name → IP.
• Routing policies: simple, weighted, latency, geolocation, failover, multivalue.
• Health checks → failover to healthy region.
• NOT a load balancer — just name resolution. Alias records point at AWS resources (ALB, S3, CloudFront).

ELB family (3 types)

Type	Layer	Use
ALB (Application)	L7 HTTP/HTTPS	Path routing (/api → X, /admin → Y), host-based, WebSocket
NLB (Network)	L4 TCP/UDP	Raw speed, static IPs, private link
GLB (Gateway)	L3 IP	Firewall/virtual appliances

Exam: ALB = smart URL routing; NLB = raw TCP speed + static IP.

VPC (network container)

• Subnets per AZ: public (has IGW) vs private (no IGW).
• IGW = internet gateway (public access). NAT Gateway = private → outbound only.
• Route tables decide traffic paths. Security Groups = instance firewall (allow only). NACLs = subnet firewall (allow/deny).
• Isolated by default — you choose what’s public.

VPC 10.0.0.0/16
├── Public subnet — IGW → internet
├── Private subnet — NAT for outbound
└── DB subnet — no internet

Direct Connect vs VPN

	Direct Connect	Site-to-Site VPN
Physical	Dedicated fiber (partner)	None — public internet
Speed	1-100 Gbps	~1.25 Gbps/tunnel
Latency	Consistent low	Variable
Cost	$$$ + months setup	Cheap, minutes setup
Security	Private fiber	IPsec over internet
Use	Big data, hybrid, steady traffic	Quick hybrid, DX backup

Mental model: DX = private highway (fast, expensive, slow to build); VPN = encrypted route over public roads (quick, cheap, slower). Can coexist — VPN as DX failover.

Full flow

User → Route 53 (DNS) → ALB (L7) → EC2 in VPC (private subnets)
Office user → Direct Connect/VPN → private route → VPC

Exam facts

• Route 53 = DNS, NOT load balancing
• ALB = layer 7 HTTP; NLB = layer 4 TCP
• VPC = network boundary with subnets + firewalls
• Direct Connect = private dedicated link (faster, pricier)
• VPN = encrypted tunnel over internet (cheaper, slower)

Related

• [[aws/index]]
• [[aws/compute-map/index]]