AWS Advanced Networking Specialty

Build rock-solid VPC foundations. Master primary and secondary CIDR blocks, public/private/isolated subnet design, NAT Gateway vs NAT instance tradeoffs, VPC peering scale limits (125 peers per VPC), IPv6 dual-stack designs, and the Egress-Only Internet Gateway used to allow IPv6 egress without inbound access. Learn route-table precedence and why the most-specific-route always wins.

Connect on-premises to AWS the right way. Compare Direct Connect dedicated vs hosted connections, master the three VIF types (private, public, transit), understand LAG for redundant circuits, SiteLink for global DX-to-DX traffic, Direct Connect Gateway for multi-region and multi-VPC scenarios, BGP attributes (local preference, AS_PATH, MED, communities), accelerated VPN over the AWS global backbone, and Client VPN mutual authentication + authorization rules. Includes the classic VPN CloudHub spoke topology.

Design hub-and-spoke and fully routed enterprise topologies. Master Transit Gateway attachments (VPC, VPN, DX Gateway, peering, Connect), route table association vs propagation, inter-region peering over the AWS backbone, TGW Connect using GRE tunnels for SD-WAN appliances, and AWS Cloud WAN — the managed global backbone with a declarative core network policy, segments, and sharing. Learn the decision matrix for when Transit Gateway is enough vs when Cloud WAN pays off.

Keep traffic private without internet exposure. Understand Gateway Endpoints (free, S3 + DynamoDB only, route-table based) vs Interface Endpoints (ENI-based PrivateLink with hourly + per-GB pricing), VPC Endpoint Services for exposing your own NLB-fronted service to other accounts (SaaS producer/consumer), and the newer VPC Lattice service network mesh with auth policies, health checks, and weighted traffic for service-to-service communication across VPCs and accounts.

Choose the right load balancer for the scenario. ALB for HTTP/HTTPS/gRPC/WebSocket with path and host routing; NLB for TCP/UDP/TLS with ultra-low latency and preserved client IP; GWLB for inserting inline security appliances via GENEVE encapsulation; and Global Accelerator for two static anycast IPs backed by the AWS global edge for fast non-HTTP failover — contrast with CloudFront edge caching for static and HTTP content.

Build enterprise security perimeters on AWS. Master AWS Network Firewall with Suricata-compatible stateful rule groups, Gateway Load Balancer for inserting third-party NGFWs (Palo Alto VM-Series, Fortinet, Check Point) transparently, the centralized egress inspection pattern with a dedicated inspection VPC behind Transit Gateway, AWS WAF rule priority (lowest number evaluated first) with managed rule groups, and Shield Advanced DDoS protection with DRT engagement and cost protection.

Operate and debug large networks at scale. VPC Flow Logs default vs custom format fields, Traffic Mirroring for packet-level IDS, Reachability Analyzer for static path analysis between ENIs, Network Access Analyzer for finding unintended network paths at the organization level, Transit Gateway Network Manager for topology and event insights, CloudWatch Internet Monitor for end-user experience, and Route 53 Resolver DNS Firewall with block/alert/allow rules against malicious domains.