Networking & CDN

An ALB listener rule matches on host header, URL path, HTTP header, HTTP method, query string, or source IP. Rules are evaluated in priority order, lowest number first; the first match wins, and unmatched requests fall through to the listener's default action.

A target group is the named set of backends an Elastic Load Balancing listener forwards to, plus the health check run against each member. A target that fails enough consecutive checks is marked unhealthy and stops receiving new requests.

Pick an ALB when the routing decision depends on the HTTP request itself - host, path, header or method - or when you want WAF, cookie stickiness or built-in OIDC login. Pick an NLB for raw TCP/UDP, static IPs and lowest latency.

Network Load Balancer is the right choice when traffic is not HTTP, when you need a fixed IP per Availability Zone, or when you need very high connection volume at minimal added latency. You give up HTTP-aware routing, WAF and authentication actions.

Read the reason code from describe-target-health first. Target.Timeout means the probe never arrived — usually the target's security group does not allow the health-check port from the load balancer. Target.ResponseCodeMismatch means it arrived but the status code fell outside the matcher.

Security groups attach to network interfaces, are allow-only and stateful, so return traffic is automatically permitted. Network ACLs attach to subnets, allow or deny in numbered order, and are stateless, so every direction needs an explicit rule.

A subnet is public only because the route table associated with it sends 0.0.0.0/0 to an internet gateway. The instance also needs a public IPv4 or Elastic IP address, or its packets have no return path.

Gateway endpoints add a route-table entry for S3 or DynamoDB only and cost nothing. Interface endpoints put a PrivateLink network interface with a private IP into your subnets, cover most AWS services, and bill per endpoint-hour plus per gigabyte processed.

An internet gateway attaches to the VPC and gives two-way internet reach, mapping public IPv4 addresses one-to-one. A NAT gateway hides private instances behind one public address and keeps state only for flows that start inside, so traffic can leave but connections can never be started inbound.

VPC peering is non-transitive: each connection carries traffic only between the two VPCs it joins, so A cannot reach C through B. Fix it with a direct A-to-C peering connection, or attach all three VPCs to a Transit Gateway.

DNS forbids a CNAME at a zone apex, which must also hold SOA and NS records. Route 53's alias record is an A record whose target is an AWS resource, so the apex can point at a load balancer and still return plain addresses.

Two delays stack: Route 53 must see enough consecutive failed health-check probes to mark the primary unhealthy, and then every cached copy of the old answer must expire. Shorten both with a faster health check, a lower failure threshold, and a low record TTL.

Delegation. A new Route 53 public hosted zone is assigned four name servers, and nothing on the internet consults them until the domain's registrar publishes those four as the domain's NS records. Records exist but are unreachable until then.

Latency-based routing sends a query to whichever AWS region Route 53 measures as fastest from the requester's network, so it optimises performance. Geolocation routing answers by the requester's mapped location — continent, country or subdivision — so it enforces where traffic must go.

Weighted records share a name, and Route 53 picks one per query with probability equal to its weight divided by the total — for example 5 against 95. The real user share drifts because each cached answer serves many clients for the whole TTL.

An origin is a backend CloudFront fetches from: an S3 bucket, a load balancer, any HTTP server. A cache behavior maps a URL path pattern to one origin. CloudFront tests behaviors in their configured order and falls back to the default behavior.

CloudFront's cache key is the distribution, the matched cache behavior and exactly the query strings, headers and cookies named in the attached cache policy. Values named in neither policy are stripped, so the origin never sees them at all.

Use the bucket's REST endpoint as the origin, keep Block Public Access on, and attach an Origin Access Control so CloudFront signs each origin request with SigV4; the bucket then grants read only to the CloudFront service principal for that distribution. OAC, unlike OAI, works with SSE-KMS objects and non-GET methods.

CloudFront Functions run only on viewer request and viewer response, in a tiny sandboxed JavaScript runtime with no network access — ideal for header and URI rewrites. Lambda@Edge also hooks origin request and origin response, and can call other services.

CloudFront signed URLs authorize one object each and change the URL; signed cookies authorize many objects and leave URLs unchanged. Both are verified by CloudFront against the public keys in the trusted key group attached to that cache behavior.

The function returned a shape API Gateway cannot map to an HTTP response. A Lambda proxy handler must return an object with a numeric statusCode, an optional headers map, and a body that is already a string — returning a raw object or a bare value produces 502.

HTTP APIs are cheaper and lower-latency, so default to them for plain Lambda or HTTP backends. Choose REST APIs when you need what HTTP APIs omit: API keys and usage plans, stage response caching, request validation, VTL mapping templates, private endpoints, or AWS WAF.

Pick by who the caller is. AWS principals get IAM SigV4. End users with tokens from an OIDC issuer get the built-in JWT authorizer on an HTTP API, or a Cognito user pool authorizer on a REST API. Anything else needs a Lambda authorizer.

A REST API Lambda authorizer must return a principalId, plus a policyDocument — an IAM policy allowing execute-api:Invoke on the requested method ARN. Anything in the optional context map is passed through to the integration as caller identity.

Each API Gateway throttle is a token bucket: burst is the bucket's capacity, rate is how many tokens per second refill it. A request is rejected by the first empty bucket it meets, checked from the most specific usage-plan limit outward to the region-wide account limit.