Situation and constraints
Pine Logistics is moving a customer portal and an internal inventory service to AWS. Customers must reach the public portal by name. The inventory service must not accept direct internet traffic. Employees in the head office need a reliable path to internal resources, and product images should load quickly for distant customers.
The team initially draws one large “AWS network” box and places everything inside it. That picture cannot answer important questions: Which addresses belong to the company? Which resources are public or private? Where does traffic go? What controls traffic at a resource or subnet? How does a browser turn a domain name into a destination? How does the office connect to AWS?
Pine needs a layered mental model. It does not need to calculate CIDR ranges, configure Border Gateway Protocol, or choose advanced routing policies for this scenario.
The decision to make
Pine should separate five networking jobs:
- Use Amazon Virtual Private Cloud (Amazon VPC) to create a logically isolated virtual network for AWS resources.
- Use subnets, route tables, and gateways to decide where resources live and where traffic can travel.
- Use security groups and, where appropriate, network access control lists (network ACLs) to control network traffic.
- Use Amazon Route 53 for Domain Name System (DNS) routing and Amazon CloudFront to deliver cacheable content closer to users.
- Choose AWS Site-to-Site VPN—a virtual private network—for encrypted connectivity over the internet or AWS Direct Connect for a dedicated network path from the organization toward AWS.
These choices solve different problems. A VPC does not give users a memorable domain name. DNS does not encrypt office-to-cloud traffic. CloudFront does not turn a private internal service into a hybrid network. A dedicated connection does not automatically encrypt application traffic.
A practical mental model
Think of the workload as a business campus.
The VPC is the campus boundary and address plan. Subnets are sections of the campus where resources are placed. A route table is a set of direction signs that says where traffic for a destination should go. A gateway is an entrance or connection point. A security group is a guard assigned to a resource's network interface. A network ACL is a checkpoint applied at the subnet boundary.
Route 53 is the directory that translates a friendly name into the right destination. CloudFront is a network of local distribution points that can serve cached content closer to customers. Site-to-Site VPN is an encrypted tunnel that uses internet connectivity. Direct Connect is a dedicated network connection that bypasses internet service providers in the network path.
The analogy is useful only if the layers remain distinct. Direction signs do not grant permission to enter, and a security rule does not create a route. Traffic usually needs both a valid path and permission from the relevant controls.
Inside the VPC
An Amazon VPC is a logically isolated virtual network in the AWS Cloud. Pine chooses its address range and places resources into subnets within an AWS Region. An Availability Zone is a separate infrastructure failure boundary inside that Region. A subnet exists in one Availability Zone, so placing resilient components across subnets in multiple Availability Zones removes a single-zone dependency and can support high availability when the service and application are designed for it.
A public subnet is not merely a subnet whose name contains “public.” Its route table has a path to an internet gateway, and a resource still needs suitable addressing and security controls to communicate with the internet. A private subnet lacks a direct route for unsolicited internet access to its resources. The shared VPC Networking Model develops these components in more detail.
Pine can place internet-facing entry points in public subnets and keep internal application or database resources in private subnets. This is a conceptual placement decision, not a guarantee of security by itself. The company must still configure routes, identities, resource policies, encryption, and traffic controls.
Security groups and network ACLs
Security groups provide stateful traffic filtering for associated network interfaces. They use allow rules; return traffic for an allowed connection is automatically permitted. AWS guidance treats security groups as the primary VPC network access control.
Network ACLs operate at the subnet level, support both allow and deny rules, and are stateless, so return traffic must be allowed explicitly. They can provide coarse-grained defense in depth. Pine should not treat an ACL as a replacement for correctly scoped security groups. The shared security groups versus network ACLs reference explains the boundary.
| Question | Matching component |
|---|---|
| Where is an AWS resource logically placed? | VPC and subnet |
| Where can traffic for a destination travel? | Route table and gateway |
| What traffic may reach a resource interface? | Security group |
| What coarse traffic policy applies at a subnet boundary? | Network ACL |
Users, names, and edge delivery
When a customer enters a domain name, DNS connects that name to destination information. Amazon Route 53 provides DNS capabilities and can route names to AWS resources. It is not a content cache and does not carry the web page simply because it answered the DNS request.
Amazon CloudFront is a content delivery network. It uses edge locations to serve cached content closer to users and forwards requests to an origin when needed. For Pine, static product images are a strong example. CloudFront can reduce latency and origin load, but Pine still chooses where the authoritative application and data live.
Route 53 and CloudFront often work together: Route 53 resolves the application's name, while CloudFront delivers content through its edge network. Use the shared Amazon Route 53 reference and Amazon CloudFront reference for deeper service details.
Connecting the office
AWS Site-to-Site VPN creates tunnels using Internet Protocol Security (IPsec) between Pine's on-premises network equipment and an AWS-side endpoint. It uses internet connectivity, can be established relatively quickly, and encrypts traffic through the tunnel. Each connection includes two tunnels for high availability, but Pine must configure and monitor its side correctly.
AWS Direct Connect links the internal network to a Direct Connect location using a dedicated network connection. It provides a more consistent private network path that bypasses internet service providers, which can suit steady hybrid connectivity requirements. It normally takes more planning and provider coordination than an internet VPN.
Direct Connect is not the same as encryption. AWS documentation notes that customers must use supported transit-encryption options when encryption in transit is required. Pine can also combine Direct Connect and VPN patterns for particular requirements, but that design is beyond this foundational decision.
The simplest comparison is intent: choose Site-to-Site VPN when encrypted connectivity over the internet fits; choose Direct Connect when a dedicated network path and more predictable connectivity justify the additional setup and cost.
Recommended reasoning
Pine should first design the isolation boundary and traffic paths in a VPC. Public entry points can receive customer traffic, while the internal service remains in private subnets with security groups allowing only required sources and ports. Network ACLs are an optional additional subnet-level control, not the main identity or application security system.
For customers, Route 53 maps the public name to the appropriate endpoint. CloudFront serves suitable cached content from edge locations. Neither service changes the company's data-location obligations or replaces multi-Availability Zone application design.
For the office, Pine can begin with Site-to-Site VPN if encrypted internet-based connectivity meets its needs. If the business needs a dedicated path with steadier network characteristics, it can evaluate Direct Connect. Availability requirements may justify redundant connections, but Cloud Practitioner learners only need the service-category distinction.
Where the manifest services fit
Amazon VPC provides the isolated network and its subnets, routes, and gateways. Amazon Route 53 provides DNS. Amazon CloudFront delivers content through edge locations. These are complementary networking categories, not interchangeable products.
AWS Site-to-Site VPN provides encrypted tunnels between an on-premises network and AWS over internet connectivity. The shared Site-to-Site VPN reference covers its AWS-side and customer-side components.
AWS Direct Connect provides dedicated connectivity from a customer network through a Direct Connect location. The Direct Connect reference explains virtual interfaces, resilience, and encryption considerations.
Common exam confusion
- Public subnet versus public resource: A route to an internet gateway is part of public connectivity; the resource also needs suitable addressing and security rules.
- Route table versus security group: A route table provides a path. A security group filters permitted traffic at the resource interface.
- Security group versus network ACL: Security groups are stateful and resource-associated; network ACLs are stateless and subnet-level.
- Route 53 versus CloudFront: Route 53 is DNS. CloudFront is content delivery and caching at edge locations.
- Region versus edge location: Workloads and authoritative data live in selected Regions; CloudFront edge locations bring cached delivery closer to users.
- VPN versus Direct Connect: Site-to-Site VPN uses encrypted tunnels over internet connectivity. Direct Connect supplies a dedicated path.
- Direct Connect versus encryption: A dedicated path does not automatically mean application traffic is encrypted.
Recall prompts
- What does a VPC isolate, and what does a subnet represent?
- Why does traffic need both a route and permission?
- How do security groups differ from network ACLs?
- What separate jobs do Route 53 and CloudFront perform?
- When is Site-to-Site VPN the clearer hybrid connectivity answer?
- What requirement points toward Direct Connect?
- Why does Direct Connect not automatically answer an encryption requirement?
Summary
Pine's network is a set of layers. A VPC and subnets provide isolation and placement. Route tables and gateways provide traffic paths. Security groups and network ACLs filter traffic at different levels. Route 53 handles DNS, while CloudFront delivers cacheable content through edge locations.
For hybrid connectivity, Site-to-Site VPN provides encrypted internet-based tunnels, and Direct Connect provides a dedicated network path. The reliable exam method is to name the networking job first—placement, routing, filtering, naming, edge delivery, or hybrid connection—and then choose the matching service.
Official references: CLF-C02 Domain 2, CLF-C02 Domain 3, VPC infrastructure security, Amazon Route 53 DNS, AWS Site-to-Site VPN, and AWS Direct Connect.