Networking, connectivity, and content delivery

Cloud networking determines how application components communicate and how users reach them. A complete design considers IP address ranges, subnets, routes, firewalls, DNS, connection types, and traffic distribution. Connectivity provides the paths between environments, while content delivery improves how application responses and files reach users. These responsibilities are related but distinct: a valid DNS record does not guarantee network reachability, and a reachable server does not guarantee acceptable performance.

A virtual network creates a logically isolated environment for resources. In AWS, an Amazon VPC is regional and can contain subnets in multiple Availability Zones; each subnet belongs to one Availability Zone. Route tables determine where traffic goes, while security groups and network access control lists filter traffic. An internet gateway supports internet connectivity, but attaching one does not automatically make every resource public. For direct IPv4 internet access, a resource also needs appropriate routing, a public IPv4 address, and permissive security rules. Private workloads can use a NAT gateway for outbound IPv4 internet connections without accepting unsolicited inbound connections through that gateway.

DNS translates names into records that clients use to locate endpoints. Amazon Route 53 provides DNS capabilities, including routing policies that can consider health or geography. DNS routing is not the same as forwarding application requests: clients typically resolve a name and then connect to the returned endpoint. Elastic Load Balancing operates on application or network traffic and distributes connections or requests across healthy targets. Deploying targets across Availability Zones improves resilience, but applications must still handle failures and maintain sufficient capacity.

Hybrid connectivity links an office or data center to cloud resources. A site-to-site VPN uses encrypted tunnels over an underlying network, commonly the public internet. A dedicated connection, such as AWS Direct Connect, provides a private connectivity path that can offer more predictable performance, but it does not encrypt traffic by default. Dedicated links also require provisioning and resilient design. Neither option automatically creates redundant end-to-end connectivity; engineers must account for customer routers, connection paths, and routing configuration.

Edge locations place selected networking and delivery functions closer to users. A content delivery network such as Amazon CloudFront can cache eligible images, scripts, video segments, and other responses at distributed locations, reducing latency and repeated requests to the origin. Edge locations are not Availability Zones and do not mean that the complete application or database runs near every user. Cache misses and noncacheable requests still require origin access. Edge infrastructure can also support traffic acceleration: AWS Global Accelerator uses the AWS global network to route traffic toward regional application endpoints rather than caching content.

For an online store, DNS can direct users to a CDN, which serves cached product images and forwards uncached requests to a regional load balancer. The load balancer distributes requests to application servers in private subnets across multiple Availability Zones. An encrypted VPN or dedicated connection can separately connect the store's corporate network to private backend systems. These mechanisms solve different problems and are often combined rather than substituted for one another.

The main trade-offs involve cost, operational complexity, freshness, and performance. Longer cache lifetimes reduce origin traffic but can serve outdated content; personalized responses require carefully designed cache keys and policies to prevent data exposure. Cross-zone, cross-region, internet, and hybrid traffic can have different charges. Measure latency, packet loss, connection failures, and cache hit rates before changing the design. Network reachability is also not authorization: reachable services still need appropriate identity controls, encryption, and application security.