Articles on VPC, CloudFront, Route 53, Direct Connect, and other networking services
Dynamically discover microservice endpoints using DNS-based and API-based approaches. Learn how to automate service registration and deregistration through integration with ECS and EKS.
This article explains the DNS-based routing that CloudFront uses to route user requests to the nearest PoP, the multi-layer cache structure of edge locations and regional edge caches, and the design factors that determine the cache hit ratio.
This article explains design methods for dedicated line connections using AWS Direct Connect and introduces how to achieve stable private network connectivity through the choice between dedicated and hosted connections, redundant configurations, and integration with VPC.
Design redundant dedicated connections and connect to VPCs across multiple regions with Direct Connect Gateway. This article also covers bandwidth aggregation with LAG and MACsec encryption.
Learn how to route traffic onto the AWS global network using Anycast IPs, design endpoint groups, and achieve failover through health checks.
Route traffic onto the AWS global network early using Anycast IPs to direct clients to the nearest edge location. This guide covers ALB/NLB integration and failover design.
This article introduces techniques for visualizing the topology of a global network that includes Transit Gateway and VPN, and for verifying connectivity with route analysis.
Connect to AWS services privately without traversing the internet. Learn about free Gateway Endpoints and building Endpoint Services.
Alias records and seven types of routing policies make advanced traffic control possible. This article introduces the design of multi-region failover using health checks.
This article explains how to build service discovery using AWS Cloud Map. It introduces DNS-based and API-based service discovery, integration with ECS/EKS, and working with App Mesh (AWS ended support for App Mesh on September 30, 2026).
Consolidates multiple VPCs and on-premises networks in a hub-and-spoke topology and establishes security boundaries through route table isolation. It also introduces multi-region connectivity through peering.
This article explains RAM sharing design, strategies for splitting service networks, and the hierarchical design of Auth Policy when operating VPC Lattice in a multi-account environment.
Simplifies cross-VPC / cross-account communication between microservices with L7 service networking that does not require Envoy proxies. Introduces IAM authentication and how to choose between VPC Lattice and App Mesh (AWS ended support for App Mesh on September 30, 2026).
Learn how to design public/private subnet separation, layered security group management, and reduce NAT Gateway costs with Gateway VPC Endpoints.
Learn about running applications at the 5G edge with Wavelength, Wavelength Zone design, and practical use cases.
Learn about Elastic IP allocation, EC2 association, cost implications of unused EIPs, and alternative approaches to consider.
This article explains why the 4 load balancer types, ALB, NLB, GWLB, and CLB (Classic), coexist instead of being unified, from the layers of the OSI reference model, their performance characteristics, and their history.
Learn how to declaratively configure canary deployments, retry policies, and mTLS encryption using Envoy sidecars, and visualize service dependencies with X-Ray integration (AWS discontinued support for App Mesh on September 30, 2026).
Learn how Security Groups operate statefulness through connection tracking, why NACLs are stateless, the ephemeral port pitfall, and design patterns for defense in depth combining both.
Learn why the default VPC CIDR is set to /16, the history of RFC 1918 private address space, the 5 reserved IP addresses in each subnet, and common CIDR design mistakes.
Learn how Internet Monitor tracks application performance over the internet, analyzes availability by ISP, and detects health events.
AWS Private 5G provides a private cellular network using CBRS spectrum as a managed service. It enables stable wireless connectivity across large areas such as factories, warehouses, and campuses - connectivity that is difficult to achieve with Wi-Fi - deployable in just days. This article covers network design, SIM management, and when to choose Private 5G over Wi-Fi from a practical perspective.
A comprehensive walkthrough covering domain registration, transfers from other registrars, public and private hosted zone design, and enabling DNSSEC.
Starting with how Route 53 got its name from port number 53 and America's Route 66, this article explores why DNS uses UDP port 53, and what happens behind the scenes during DNS resolution.
Learn what the DNS resolver at the CIDR+2 address inside a VPC actually is, how it works with private hosted zones, how Route 53 Resolver endpoints enable hybrid DNS, and how to use DNS query logs.