Networking and Content Delivery
VPC Connectivity, Private Access, Network Protection, and Cost
CoreImplement subnet paths and filters, select private connectivity, audit protection controls, and reduce network processing and transfer cost without removing required resilience.
Aligned to AWS Certified CloudOps Engineer - Associate (SOA-C03) Version 1.1, verified August 24, 2026.
Why this matters
Routes, gateways, stateful and stateless filters, endpoints, peering, firewalls, and service-level protection act at different boundaries. A working path requires each applicable layer.
Must Know
- A public IPv4 path needs public addressing, a route to an internet gateway, and allowed filters. Private IPv4 internet egress uses a NAT gateway path; outbound-only IPv6 uses an egress-only internet gateway.
- Security groups are stateful instance or ENI-level allow controls. Network ACLs are ordered, stateless subnet-level allow and deny controls and must allow the applicable return path.
- Gateway and interface VPC endpoints have service-specific support and different route, DNS, endpoint-policy, security-group, and ENI behavior.
- AWS PrivateLink exposes a selected service through endpoint services and interface endpoints without merging route domains. VPC peering routes between non-overlapping VPCs and is not transitive.
- Route 53 Resolver DNS Firewall, AWS WAF, AWS Shield, and AWS Network Firewall protect different DNS, web, DDoS, and network-traffic surfaces; audit associations, rules, logs, and scope.
- Use flow and cost evidence to reduce avoidable NAT processing, cross-AZ or cross-Region paths, and hairpins while preserving security and availability.
Compare and Distinguish
- An internet gateway supports public VPC internet routing; NAT supplies private IPv4 egress; an egress-only internet gateway supplies outbound-only IPv6.
- Security groups are stateful allow controls; NACLs are stateless ordered allow/deny subnet controls; route tables choose a path.
- An endpoint privately reaches a supported service; PrivateLink publishes selected service access; peering provides routed VPC-to-VPC connectivity.
- WAF filters supported web requests; Network Firewall filters VPC traffic; DNS Firewall filters DNS queries; Shield mitigates supported DDoS events.
Scenario examples
- Scenario: Private IPv4 instances need outbound updates without inbound exposure. Route through a NAT gateway in the approved public path and retain stateful and stateless controls.
- Scenario: Consumers need one provider service privately without peering. Publish an endpoint service and configure accepted interface endpoints, DNS, security groups, and policy.
- Scenario: High-volume traffic to a supported AWS service crosses NAT. Compare endpoint and NAT pricing and path requirements, implement the supported endpoint, and verify the route.
Exam traps
- Do not use an egress-only internet gateway for IPv4.
- Do not add a deny rule to a security group.
- Do not expect peering to add routes or provide transit automatically.
- Do not remove multi-AZ resilience solely to reduce transfer cost.
Key takeaways
- Trace route and filtering layers separately.
- Choose the connectivity primitive from the traffic relationship.
- Audit protection at the traffic layer it actually sees.
- Optimize from measured path and cost evidence.
How it works
- Build the forward and return route for the exact address family and identify every stateful and stateless filter.
- Select the gateway, endpoint, or private-connectivity primitive that matches the stated relationship.
- Verify the live flow and its processing path, then compare the expected transfer and processing evidence.
When to use it
- Route public VPC internet traffic through an internet gateway, private IPv4 egress through a NAT gateway, and outbound-only IPv6 traffic through an egress-only internet gateway.
- Use security groups for stateful allow rules at the ENI, NACLs for ordered stateless subnet allow/deny rules, and route tables to select the traffic path.
- Choose a VPC endpoint for private access to a supported service, AWS PrivateLink to publish selected service access, and VPC peering for routed connectivity between VPCs.
- Apply AWS WAF to supported web requests, AWS Network Firewall to VPC traffic, Route 53 Resolver DNS Firewall to DNS queries, and AWS Shield to supported DDoS events.
Security and governance implications
- Associate WAF, Shield, DNS Firewall, or Network Firewall only with the traffic surface each service protects.
- Do not trade away required multi-AZ placement or open broad filters solely to simplify routing or reduce cost.
Failure signals and diagnosis
- Verify addressing, route targets, gateway or endpoint state, return path, SGs, and both NACL directions.
- For endpoints, inspect supported service and type, DNS, endpoint policy, security groups, and Region.
- For unexpected cost, map bytes through NAT, Availability Zones, Regions, load balancers, endpoints, and transit attachments.
More detail
- Know the required public IPv4, private IPv4 egress, and outbound-only IPv6 route components.
- Distinguish stateful security groups from ordered stateless NACLs, including the return path.
- Compare endpoints, PrivateLink, peering, and network-protection services by the service relationship and traffic surface they support.
Ready for the quiz?
- A private subnet cannot reach the internet. Which route and address-family evidence distinguishes a missing NAT gateway path from an egress-only internet gateway requirement?
- How do a route table, security group, and network ACL answer different questions about the same failed flow?
- What route, DNS, policy, and traffic evidence would prove that a supported service flow moved from a NAT gateway to a VPC endpoint?
Related objectives
- D5.1 — Task 5.1: Implement and optimize networking features and connectivity.
- 5.1.1 — Configure a VPC (for example, subnets, route tables, network ACLs, security groups, NAT gateways, internet gateway, egress-only internet gateway).
- 5.1.2 — Configure private networking connectivity (for example, VPC endpoints, AWS PrivateLink, VPC peering).
- 5.1.3 — Audit AWS network protection services (for example, Route 53 Resolver DNS Firewall, AWS WAF, AWS Shield, AWS Network Firewall) in a single account.
- 5.1.4 — Optimize the cost of network architectures.