AWS networking has two halves. Inside a Region, Amazon VPC provides isolated IP networks in which subnets, route tables, gateways, and firewalls determine what can reach what. At the edge, Elastic Load Balancing, Amazon CloudFront, Amazon API Gateway, and Amazon Route 53 accept traffic from users and deliver it to those private networks. This page covers VPC design and connectivity, the load balancer family, CloudFront, API Gateway, and DNS, and ends with the most common and costly mistakes. For protocol-level background, see Networking Fundamentals and Cloud Networking.

How a request reaches an application

flowchart LR
    U([User]) --> R53[Route 53<br/>DNS]
    R53 --> CF["CloudFront edge<br/>+ AWS WAF"]
    CF -- cache hit --> U
    CF -- cache miss --> ALB["Application Load Balancer<br/>(public or VPC origin)"]
    subgraph VPC
        ALB --> T1[Target in AZ-a]
        ALB --> T2[Target in AZ-b]
        T1 --> DB[(Database<br/>isolated subnet)]
        T2 --> DB
    end

DNS resolves the hostname to the nearest CloudFront edge. Cached responses return from the edge; cache misses travel over the AWS backbone to the origin, usually an Application Load Balancer, which spreads requests across healthy targets in several Availability Zones. Security groups at each hop admit only the traffic expected from the previous hop.

Amazon VPC

A VPC is a logically isolated network in one Region with one or more IPv4 CIDR blocks (between /16 and /28) and optionally IPv6. It spans every Availability Zone in the Region; each subnet lives in exactly one AZ. AWS reserves five addresses in every subnet (network address, VPC router, DNS, one for future use, and broadcast), so a /24 provides 251 usable addresses.

Building blocks

A subnet is public if its route table sends 0.0.0.0/0 to an internet gateway, private if it sends it to a NAT gateway, and isolated if it has no default route at all.

Security groups and network ACLs

Security groups are the primary control. Referencing security groups instead of IP ranges (“the database accepts port 5432 from the app tier’s security group”) keeps rules correct as instances scale in and out. Network ACLs are best reserved for broad subnet-level denies, such as blocking a known-bad range.

Reference design: three tiers across AZs

flowchart TB
    IGW([Internet gateway])
    subgraph VPC["VPC 10.0.0.0/16"]
        direction LR
        subgraph AZA["Availability Zone a"]
            PubA["Public 10.0.0.0/24<br/>ALB node · NAT GW"]
            AppA["Private 10.0.16.0/20<br/>App tasks / instances"]
            DataA["Isolated 10.0.64.0/24<br/>DB writer"]
        end
        subgraph AZB["Availability Zone b"]
            PubB["Public 10.0.1.0/24<br/>ALB node · NAT GW"]
            AppB["Private 10.0.32.0/20<br/>App tasks / instances"]
            DataB["Isolated 10.0.65.0/24<br/>DB standby"]
        end
        GWE["Gateway endpoints<br/>S3 · DynamoDB"]
    end
    IGW <--> PubA
    IGW <--> PubB
    PubA --> AppA
    PubB --> AppB
    AppA --> DataA
    AppB --> DataB
    AppA -. outbound via NAT .-> PubA
    AppB -. outbound via NAT .-> PubB
    AppA -.-> GWE
    AppB -.-> GWE
    DataA -. synchronous replication .- DataB

• Public subnets hold only things that must accept internet traffic or provide egress: load balancer nodes and NAT gateways. They can be small.
• Private subnets hold application compute. Size them generously; containers (with awsvpc networking), Lambda functions in a VPC, and EKS pods each consume an IP address.
• Isolated subnets hold databases and caches with no route to the internet.
• Gateway endpoints for S3 and DynamoDB are free and keep that traffic off the NAT gateway.

Plan the VPC CIDR so it does not overlap with on-premises networks or other VPCs you may connect later; overlapping ranges cannot be routed between. Amazon VPC IP Address Manager (IPAM) allocates non-overlapping ranges across an Organization.

Egress: NAT gateways, endpoints, and IPv6

NAT gateways are convenient but are often the largest networking charge: an hourly fee plus a per-GB processing fee on every byte, on top of normal data transfer (in US East, USD 0.045 per hour and USD 0.045 per GB). Three decisions control that cost and the availability of egress:

1. Availability mode. A classic zonal NAT gateway lives in one public subnet and one AZ; highly available designs need one per AZ, each with its own route table entries. A regional NAT gateway is a single resource that expands automatically into every AZ where the VPC has workloads (it can take up to an hour to expand into a newly used AZ). It needs no public subnet, supports up to 32 IP addresses per AZ instead of 8, and can be routed to from every private subnet with one route table. Regional mode does not support private NAT; use zonal NAT gateways for private (VPC-to-VPC) address translation.
2. VPC endpoints. Traffic to AWS services does not need the internet. Gateway endpoints (S3, DynamoDB) are route-table entries and have no charge. Interface endpoints (AWS PrivateLink) place an ENI in your subnets for most other services (ECR, CloudWatch Logs, Secrets Manager, STS, SQS, and so on) and are billed per hour per AZ and per GB, usually far less than NAT processing for high-volume traffic.
3. IPv6. Dual-stack subnets with an egress-only internet gateway give outbound internet access with no NAT charge. AWS charges USD 0.005 per hour for every public IPv4 address (in use or idle) since February 2024, which also makes IPv6 and private subnets more attractive.

VPC Block Public Access is an account- and Region-wide switch that authoritatively blocks internet gateway traffic, either in both directions or ingress only (NAT and egress-only gateways still work), regardless of route tables and security groups. Specific VPCs or subnets can be excluded. It is a strong guardrail for accounts that should never be internet-facing.

Connecting networks

flowchart TD
    Q{What needs to connect?}
    Q -->|Two VPCs, few pairs| PEER["VPC peering<br/>non-transitive, no bandwidth charge within an AZ"]
    Q -->|Many VPCs and on-premises| TGW["Transit Gateway<br/>hub-and-spoke routing, route domains"]
    Q -->|Global WAN across Regions| CWAN["Cloud WAN<br/>policy-defined global network"]
    Q -->|Expose one service to other VPCs/accounts| PL["PrivateLink<br/>endpoint service behind an NLB"]
    Q -->|Service-to-service across VPCs and accounts,<br/>with auth and L7 routing| LAT["VPC Lattice<br/>service network, IAM auth policies"]
    Q -->|On-premises data center| HYB["Site-to-Site VPN (fast to set up)<br/>or Direct Connect (dedicated, predictable)"]

Elastic Load Balancing

Load balancers spread traffic across targets (instances, IP addresses, containers, Lambda functions) in multiple AZs, remove unhealthy targets using health checks, and terminate TLS.

Behaviour that matters in practice:

• Health checks should hit a lightweight endpoint that verifies the process can serve requests, not deep dependencies; a database blip that fails every target’s health check takes the whole service offline.
• Deregistration delay (connection draining, default 300 seconds) holds a target in rotation for in-flight requests during deployments. Lower it for short requests to speed up deploys.
• Cross-zone load balancing is on by default for ALBs and off by default for NLBs; with it off, each AZ’s node only uses targets in its own AZ.
• Slow start and least outstanding requests routing on ALB avoid overwhelming newly registered or slower targets.

aws elbv2 create-target-group --name web-tg \
  --protocol HTTP --port 8080 --target-type ip --vpc-id vpc-0abc123 \
  --health-check-path /health --health-check-interval-seconds 15 \
  --healthy-threshold-count 2 --unhealthy-threshold-count 3

Amazon CloudFront

CloudFront is AWS’s content delivery network. It terminates TLS and HTTP/2 or HTTP/3 connections at edge locations close to users, serves cached responses from there, and forwards cache misses to the origin over the AWS backbone through regional edge caches. Even uncacheable dynamic traffic benefits from shorter TLS handshakes and a better network path.

Origins

Origin groups provide failover to a secondary origin on specified error codes, and Origin Shield adds a central caching layer in front of the origin to raise the cache hit ratio.

Caching

Caching behaviour is configured per path pattern (cache behavior) with reusable policies:

• A cache policy defines the cache key (which headers, cookies, and query strings vary the response) and TTLs. Every value added to the cache key lowers the hit ratio, so include only what changes the response.
• An origin request policy controls what is forwarded to the origin without becoming part of the cache key.
• A response headers policy adds security headers (HSTS, CSP), CORS headers, and Server-Timing.

Use long TTLs with content-hashed filenames (app.3f9c2a.js) for static assets so deployments never need invalidation; invalidations beyond the free monthly allowance are billed per path. Keep short or zero TTLs for HTML and personalised responses.

Edge compute

CloudFront KeyValueStore gives CloudFront Functions a low-latency key-value lookup (for redirects or feature flags) without redeploying the function.

AWS WAF web ACLs attach to CloudFront distributions (as well as ALBs and API Gateway) to filter requests before they reach the origin; AWS Shield Standard DDoS protection applies to all CloudFront distributions at no charge. See Security.

Amazon API Gateway

API Gateway is a managed front door for APIs backed by Lambda, HTTP services, or direct AWS service integrations. It offers three API types:

Choose HTTP APIs for straightforward Lambda or HTTP proxies with JWT authentication; choose REST APIs when you need usage plans, WAF, caching, request validation, private endpoints, or response streaming. REST API integrations time out after 29 seconds by default (HTTP APIs allow up to 30); for longer operations, return 202 Accepted and complete the work asynchronously, or use response streaming.

# REST API: throttle and meter a client tier
aws apigateway create-usage-plan --name basic \
  --api-stages apiId=a1b2c3d4e5,stage=prod \
  --throttle burstLimit=100,rateLimit=50 \
  --quota limit=100000,period=MONTH

# HTTP API: JWT authorizer against a Cognito user pool
aws apigatewayv2 create-authorizer --api-id a1b2c3d4e5 \
  --name cognito-jwt --authorizer-type JWT \
  --identity-source '$request.header.Authorization' \
  --jwt-configuration Audience=my-app-client-id,Issuer=https://cognito-idp.us-east-1.amazonaws.com/us-east-1_EXAMPLE

API Gateway or ALB? An ALB is priced per hour and per load balancer capacity unit rather than per request, which is cheaper at sustained high request rates and supports long-lived connections, gRPC, and WebSockets. API Gateway adds API management (keys, quotas, validation, per-client throttling) and scales to zero cost at zero traffic. Many architectures use API Gateway for public, partner-facing APIs and an ALB for high-volume first-party traffic.

For API design itself (resource modelling, versioning, pagination, error formats), see API Design.

Amazon Route 53

Route 53 provides public and private DNS, domain registration, and health checks. Alias records point a name (including the zone apex, example.com) at AWS resources such as CloudFront, ALBs, and API Gateway without a CNAME and without query charges.

Route 53 Resolver handles DNS inside VPCs; inbound and outbound Resolver endpoints connect it with on-premises DNS, and Resolver DNS Firewall blocks lookups of malicious or unapproved domains. AWS Global Accelerator is the alternative to DNS-based steering when clients need two static anycast IP addresses and sub-minute failover independent of DNS caching.

Common pitfalls

See Also

• AWS Hub - Overview of all AWS documentation
• Networking Fundamentals - TCP/IP, DNS, routing, and load balancing concepts
• Cloud Networking - Cross-provider cloud network design
• Security - IAM, WAF, Shield, and network security controls
• Compute Services - EC2, Lambda, and containers inside a VPC
• Infrastructure as Code - Defining VPCs and load balancers in CloudFormation and CDK
• Cost Optimization - Data transfer and NAT cost control
• Kubernetes - EKS networking builds on these VPC primitives