Networking and content delivery services: choosing the right one

The services at a glance

The Networking and Content Delivery category covers ten services in three groups. Each service name links to its own tutorial. For SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry, Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry, and Network ACLA stateless firewall for a subnet, with numbered allow and deny rules checked in order. Because it is stateless, return traffic needs its own rule, usually for a range of ephemeral ports.Glossary entry, see VPC security layers.

Build the network

Service	What it does
Amazon VPC	Your isolated network: subnets, route tables, gateways, endpoints, peering, Flow Logs
AWS PrivateLink	Private access to services and resources through VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry, without internet or peering

Connect networks

Service	What it does
AWS Transit Gateway	A hub that connects many VPCs and On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry networks with transitive routing
AWS Site-to-Site VPN	Encrypted IPsec tunnels between your network and AWS over the internet
AWS Direct Connect	A dedicated private connection from your data center to AWS
AWS Client VPN	Managed remote-access VPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entry for individual users

Deliver applications to users

Service	What it does
Elastic Load Balancing	Spreads traffic across targets: Application, Network, and Gateway Load Balancers
Amazon CloudFront	A global CDN (Content delivery network)A network of servers in many locations that caches content close to users, so that pages, images, and video load faster and the origin server handles less traffic. Amazon CloudFront is the AWS CDN.Glossary entry (CDN) that caches content at Edge locationAn AWS site in a city, separate from the Regions, where Amazon CloudFront caches content close to users. Route 53, AWS WAF, AWS Shield, and AWS Global Accelerator also use the edge network, which has hundreds of locations.Glossary entry
AWS Global Accelerator	Static anycast IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry addresses that route users over the AWS global network to the best Regional endpoint
Amazon Route 53	DNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entry, domain registration, Health checkA regular test, such as a request to a web page, that a load balancer, an Auto Scaling group, or Route 53 makes to see whether a resource is working. Unhealthy resources stop receiving traffic or are replaced.Glossary entry, and routing policies

Three choices to make

Which VPCs need to talk? Two VPCs: peering. Many VPCs and on premises: Transit Gateway. One service to many consumers: PrivateLink.
How does on premises connect? Quick and encrypted over the internet: Site-to-Site VPN. Consistent bandwidth and LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry: Direct Connect (often with a VPN as backup or for encryption). Individual remote users: Client VPN.
How do users reach the application? Cacheable web content: CloudFront. Static IPs and fast FailoverSwitching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.Glossary entry for TCP (Transmission Control Protocol)The transport protocol that delivers data reliably and in order: it sets up a connection first and resends lost packets. HTTP, SSH, and most database connections run over TCP.Glossary entry or UDP (User Datagram Protocol)A transport protocol that sends packets without setting up a connection or resending lost ones, trading reliability for low latency. DNS, video calls, and games often use it; Network Load Balancer and AWS Global Accelerator support UDP.Glossary entry: Global Accelerator. Name-based routing between AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry: Route 53. Spread load across instances or containers: Elastic Load Balancing.

Reverse mindmap: from the question to the service

Networking: which service?

Inside AWS
- Isolated network, subnets, routing leads to Amazon VPC
- Two VPCs directly leads to VPC peering
- Many VPCs, transitive routing leads to Transit Gateway
- Private access to AWS services leads to PrivateLink interface endpoint
- S3 or DynamoDB privately, free leads to Gateway endpoint
To on premises and users
- Encrypted tunnel over the internet leads to Site-to-Site VPN
- Dedicated, consistent connection leads to Direct Connect
- Remote employees leads to Client VPN
To the world
- Cache static and dynamic content globally leads to CloudFront
- Static IPs, fast Regional failover leads to Global Accelerator
- DNS and routing policies leads to Route 53
- Spread HTTP traffic across targets leads to Application Load Balancer
- Extreme performance TCP or UDP leads to Network Load Balancer

Commonly confused pairs

If the choice is between	Choose the first when	Choose the second when
VPC peering or Transit Gateway	Few VPCs, lowest cost	Many VPCs, transitive routing, on-premises links
Transit Gateway or PrivateLink	Full network connectivity	Access to one service, even with overlapping CIDR (Classless Inter-Domain Routing)A notation for a range of IP addresses: an address, a slash, and the number of fixed leading bits, such as 10.0.0.0/16 for 65,536 addresses. VPCs and subnets are defined by CIDR blocks; the smaller the number after the slash, the larger the range.Glossary entry
Site-to-Site VPN or Direct Connect	Quick setup, encrypted over the internet	Consistent bandwidth and latency, private connection
CloudFront or Global Accelerator	Caching HTTP (Hypertext Transfer Protocol)The protocol that web browsers and APIs use to send requests, such as GET and POST, and receive responses. On its own it is not encrypted; HTTPS adds TLS.Glossary entry content at the edge	Static IPs and fast failover, including non-HTTP traffic
S3 Transfer Acceleration or CloudFront	Faster long-distance uploads to one S3 bucket	Caching and delivering content to viewers
Gateway endpoint or interface endpoint	S3 or DynamoDB from inside the VPC, free	Other services, or access from on premises

Key takeaways

Build with VPC and PrivateLink; connect with Transit Gateway, Site-to-Site VPN, Direct Connect, and Client VPN; deliver with ELB, CloudFront, Global Accelerator, and Route 53.
Peering is one-to-one and non-transitive; Transit Gateway is the hub for many networks; PrivateLink exposes single services.
VPN is quick and encrypted; Direct Connect is dedicated and consistent.