Networking for High Performance
Amazon CloudFront — CDN. Caches at 400+ edge locations. Reduces latency for global users. DDoS protection via Shield Standard.
CloudFront Origins:
- S3 bucket (with Origin Access Control / OAC — replaces deprecated OAI)
- VPC Origin (private ALB, NLB, EC2 — without exposing to internet)
- Custom HTTP (S3 static website, public ALB, any HTTP backend)
CloudFront features:
- Geo Restriction — block or allow countries using 3rd-party Geo-IP DB.
- Cache Invalidation — force refresh of cached content. Invalidate
/*or specific paths. - CloudFront vs S3 CRR: CloudFront = global CDN with TTL caching, great for static content worldwide. S3 CRR = near real-time replication to specific regions, for dynamic content needing low latency in few regions.
AWS Global Accelerator — routes traffic to AWS endpoints via AWS private network (not public internet). Uses 2 static Anycast IPs. Health checks with < 1 minute failover. Good for non-HTTP (TCP/UDP), IoT (MQTT), VoIP, or HTTP needing static IPs or deterministic regional failover.
CloudFront vs Global Accelerator: CloudFront caches at edge. Global Accelerator routes via AWS backbone (no caching).
Amazon Route 53 — authoritative DNS. 100% availability SLA. Also a domain registrar.
DNS record types:
- A — hostname to IPv4
- AAAA — hostname to IPv6
- CNAME — hostname to another hostname. CNAMEs cannot be used for the root domain. E.g., can't use CNAME for example.com but can for www.example.com.
- NS — name servers for hosted zone
- Alias — points to an AWS resource. Works for root domain AND subdomains. Free. Native health check. Can't set TTL. Points to: ELB, CloudFront, API Gateway, Elastic Beanstalk, S3 Websites, VPC Interface Endpoints, Global Accelerator. Cannot alias to an EC2 DNS name.
CNAME vs Alias: Use Alias when pointing to AWS resources. It's free and supports zone apex.
Hosted Zones:
- Public Hosted Zone — routes internet traffic. $0.50/month/zone.
- Private Hosted Zone — routes within VPCs.
Route 53 Routing Policies:
- Simple — single or multiple values (random selection by client). No health checks.
- Weighted — split traffic by percentage (weights don't need to sum to 100). A/B testing.
- Latency — route to lowest-latency region. Based on user-to-AWS-region latency.
- Failover — primary + secondary (disaster recovery). Requires health check on primary.
- Geolocation — based on user's exact geographic location. Most specific location wins. Create a Default record.
- Geoproximity — based on distance with a bias value (+/- to expand/shrink region influence). Requires Route 53 Traffic Flow.
- IP-based — route based on client IP CIDRs. Optimize for ISP-specific routing.
- Multi-Value — return multiple healthy IPs (up to 8). Not a substitute for ELB.
Route 53 Health Checks: Only for public resources. About 15 global health checkers. Healthy if >18% checkers report healthy. For private resources: create a CloudWatch Alarm → create Health Check that monitors the alarm.
Hybrid DNS (Route 53 Resolver Endpoints):
- Inbound Endpoint: on-premises DNS can resolve AWS domain names.
- Outbound Endpoint: Route 53 Resolver forwards queries to on-premises DNS resolvers.