Performance · 24% · Compressed recall. Read the
Learn guide first.
Connect networks
| Option |
Connects |
Note |
| VPC Peering |
VPC↔VPC (1:1) |
Non-transitive, no overlapping CIDRs |
| Transit Gateway |
Many VPCs + on-prem |
Hub, transitive, scales |
| Gateway endpoint |
VPC→S3/DynamoDB |
Free, route-table based |
| Interface endpoint |
VPC→most services |
PrivateLink, ENI, hourly cost |
| Site-to-Site VPN |
On-prem↔VPC |
Over internet, encrypted, quick/cheap, variable |
| Direct Connect |
On-prem↔AWS |
Dedicated, consistent low latency, not encrypted (add VPN over it) |
Route 53 policies
| Policy |
Based on |
| Simple |
One record |
| Weighted |
Proportions (canary/A-B) |
| Latency-based |
Lowest latency |
| Failover |
Health (active-passive) |
| Geolocation |
User location |
| Geoproximity |
Distance + bias |
| Multivalue |
Up to 8 healthy records |
Alias (free): point zone apex → ELB/CloudFront/S3 (CNAME can't do apex).
CloudFront vs Global Accelerator
|
CloudFront |
Global Accelerator |
| Does |
Caches web content |
Routes traffic (no cache) |
| For |
HTTP/S static+dynamic |
TCP/UDP, gaming/VoIP/IoT, static IPs |
| IP |
Edge |
2 static anycast IPs |
| Failover |
— |
Instant cross-Region |
Cache web content globally? → CloudFront
TCP/UDP perf + static IPs + failover?→ Global Accelerator
Lowest latency Region? → Route 53 latency-based
Route by user location? → Route 53 geolocation
Many VPCs + on-prem? → Transit Gateway
Private S3/DynamoDB, free? → Gateway endpoint
Consistent private low latency to on-prem?→ Direct Connect
Quick encrypted on-prem link? → Site-to-Site VPN
Flashcards
Lowest latency vs geolocation routing?
Latency-based = lowest measured network latency. Geolocation = by user's geographic location (compliance/localization), not necessarily fastest.
Is VPC peering transitive?
No. A↔B and B↔C doesn't let A reach C. Use Transit Gateway for many-to-many.
Private access to S3 from a VPC, free?
Gateway VPC endpoint (S3 & DynamoDB only). Interface endpoints (PrivateLink) are billed and for other services.
CloudFront vs Global Accelerator?
CloudFront caches HTTP content at the edge. Global Accelerator routes TCP/UDP over the AWS backbone with static anycast IPs and instant failover — no caching.
Consistent low-latency private link to on-prem?
Direct Connect (add a VPN over it for encryption).
Point the root domain (zone apex) at an ELB?
Route 53 Alias record (a CNAME can't be used at the apex).
Active-passive DNS failover?
Route 53 Failover routing with health checks.
Common traps
- Peering non-transitive → many VPCs use Transit Gateway.
- Gateway endpoint = S3/DynamoDB free; Interface = others (billed).
- DX consistent but unencrypted; VPN encrypted but internet-variable.
- Latency-based ≠ Geolocation.
- Alias, not CNAME, at the zone apex.
- CloudFront caches; Global Accelerator routes (TCP/UDP, static IPs).