Design High-Performing Architectures
Network Topology, Hybrid Connectivity, and Private Access
CoreChoose subnet/routing topology, hub/mesh connectivity, hybrid links, endpoints, and resource placement.
Aligned to the current SAA-C03 exam guide, verified August 16, 2026.
Why this matters
Network architecture is a path-selection problem constrained by trust, address space, protocol, latency, bandwidth, scale, and failure boundaries. The right answer connects only what must communicate and avoids turning service access, network routing, and internet egress into one interchangeable mechanism.
Must Know
- Build multi-tier VPCs from required flows: public entry points, private application/data tiers, route tables, security boundaries, and independent AZ paths.
- VPC peering provides direct non-transitive routing between VPCs and fits a limited mesh. Transit Gateway provides a hub for many VPCs and on-premises networks.
- PrivateLink exposes supported services privately through interface endpoints without broad routed connectivity or overlapping-address concerns between consumer and provider.
- Gateway endpoints privately reach supported services such as S3 and DynamoDB; interface endpoints use private IPs and PrivateLink for supported endpoints.
- Site-to-Site VPN gives encrypted network-to-network connectivity over the internet. Client VPN serves remote individual clients. Direct Connect supplies dedicated private connectivity but not encryption by default.
- A resilient hybrid design uses redundant connections and paths matched to the required on-premises-link failure boundary.
- Place communicating resources to meet latency and transfer needs without collapsing required AZ or Region isolation.
Compare and Distinguish
- VPC peering vs Transit Gateway: peering wins for a small number of direct relationships; Transit Gateway wins for scalable hub-and-spoke routing and central attachments.
- PrivateLink vs peering/Transit Gateway: PrivateLink wins for access to one service with limited network exposure; routed connectivity wins when networks must communicate broadly.
- VPC endpoint vs NAT: endpoint wins for supported private service access; NAT wins for general outbound internet/public endpoints.
- Site-to-Site VPN vs Client VPN: network-to-network connectivity versus remote-user access.
- VPN vs Direct Connect: internet-based encrypted setup and lower entry effort versus dedicated, more consistent connectivity. Combine them when encryption and dedicated transport are both required.
- Multi-AZ vs multi-Region placement: AZ distribution handles local failure with lower latency; Region distribution is for Region failure, geography, or residency.
Scenario examples
- Scenario: Twenty VPCs and two data centers need controlled central routing. Think: Transit Gateway avoids a growing peering mesh.
- Scenario: A provider offers one API privately to customer VPCs with overlapping CIDRs. Think: PrivateLink exposes the service without full routed connectivity.
- Scenario: Private workloads call S3 and also external package repositories. Think: route S3 through a gateway endpoint and retain controlled NAT for the internet.
- Scenario: A company needs dedicated hybrid bandwidth and encrypted traffic. Think: Direct Connect addresses transport consistency; add VPN encryption rather than assuming the circuit encrypts.
Exam traps
- VPC peering and PrivateLink are not transitive network hubs.
- A NAT gateway is not a private endpoint or an inbound path.
- Direct Connect is not encrypted by default.
- One VPN or Direct Connect path can remain a single link failure boundary.
- Transit Gateway simplifies topology but does not authorize traffic by itself.
- A route alone does not overcome security-group, NACL, endpoint-policy, or service-policy denial.
Key takeaways
- Define source, destination, protocol, trust boundary, scale, and failure boundary before selecting connectivity.
- Use PrivateLink for service-specific private exposure and Transit Gateway for routed hub connectivity.
- Use endpoints for supported AWS services instead of sending that traffic through NAT.
- Treat dedicated transport, encryption, and redundancy as separate requirements.
How it works
- Route tables select attachment, gateway, peer, endpoint, or local destinations.
- Transit Gateway exchanges routes among attached networks according to configured tables; peering routes directly between two VPCs.
- PrivateLink places consumer-side endpoint interfaces that connect to a provider service without exposing provider routing.
- VPN encrypts tunnels across the internet; Direct Connect establishes dedicated connectivity through a connection and virtual network path.
When to use it
- Use peering for a small direct topology, Transit Gateway for many networks, and PrivateLink for a private service.
- Use Site-to-Site VPN for network links, Client VPN for users, and Direct Connect for dedicated hybrid requirements.
- Use VPC endpoints for supported service traffic that should remain private.
Security and governance implications
- Segment routes and attachments by trust and enforce least privilege at identity, endpoint, and resource layers.
- Encrypt hybrid traffic when required, including over dedicated links.
- Log and monitor critical network paths without storing unnecessary sensitive payload data.
- Design redundant egress and hybrid paths for the failure boundary.
Operational and diagnostic signals
- For failed connectivity, check DNS, both route domains, attachment state, security groups, NACLs, endpoint policy, and service authorization.
- For asymmetric or intermittent hybrid traffic, inspect redundant-path routing and on-premises behavior.
- For scale limits in a peering mesh, reconsider topology instead of adding ad hoc transit routes.
- For unexpected internet/NAT paths, confirm endpoint support, private DNS, and route selection.
More detail
- Overlapping address space, transitive routing, inspection needs, DNS, and route ownership can eliminate otherwise plausible connectivity choices.
- Hybrid link performance depends on on-premises devices, carrier path, redundancy, routing, and application behavior as well as AWS services.
- Resource placement trades latency and transfer path against failure isolation; preserve the stated resilience requirement before optimizing proximity.
Ready for the quiz?
- When does Transit Gateway beat peering?
- Why can PrivateLink handle a case where routed networks should remain isolated?
- Which requirement distinguishes Client VPN from Site-to-Site VPN?
- Why might Direct Connect still use VPN?
- What layers must permit a private endpoint flow?
Related objectives
- D3.4.K2
- D3.4.K4
- D3.4.S1
- D3.4.S2