Domain 3 — Networking & Storage
A revision sheet for Skill Builder Modules 5 & 6. Memory hooks, exam traps, and trigger words distilled from your vault notes.
VPC Connectivity Menu
A VPC is your isolated private network (CIDR like 10.0.0.0/16, regional), split into subnets (one AZ each; public = has an Internet Gateway route). The single most-tested networking topic is how traffic gets in and out.
| Path | What it is | Over internet? | Use it for |
|---|---|---|---|
| Internet Gateway (IGW) | The VPC's door to the public internet; public subnets route 0.0.0.0/0 → IGW. | Public-facing apps, web servers, load balancers. | |
| VPN (via VGW) | A Site-to-Site VPN: an encrypted IPsec tunnel between on-prem and the VPC. AWS side = Virtual Private Gateway, your side = Customer Gateway. | Quick, cheap hybrid link over the public internet. | |
| Direct Connect (DX) | A dedicated private physical fibre line to AWS that bypasses the public internet. | Consistent low latency, high bandwidth, large/sensitive data, compliance. |
IGW = public door · VPN = encrypted tunnel over the internet · Direct Connect = private dedicated cable, no internet.
Direct Connect alone is private but NOT encrypted. Need a dedicated line and encryption? Run a VPN over Direct Connect. Also know by name: Transit Gateway (hub connecting many VPCs + on-prem) and VPC Endpoints / PrivateLink (reach AWS services privately, no internet).
Security Groups vs NACLs
Packet path inward: internet → IGW → subnet's NACL (border guard) → instance's Security Group (bouncer) → EC2.
| Security Group | Network ACL (NACL) | |
|---|---|---|
| Operates at | Instance level (the ENI) | Subnet level |
| State | Stateful return traffic auto-allowed | Stateless must allow return traffic explicitly |
| Rule types | everything else implicitly denied | can explicitly block |
| Evaluation | All rules evaluated together | Number order — first match wins |
| Default | Denies all inbound, allows all outbound | Default allows all; custom denies all until you add rules |
Security Group = Stateful · NACL = Can say no (deny) + has no memory (stateless). Need to block a specific IP? → NACL (SGs can't deny).
DNS & Edge Delivery
Amazon Route 53 = AWS's managed DNS (names → IPs) and a domain registrar. Routes to AWS resources (ELB, CloudFront, S3) and on-prem, with health checks.
| Route 53 policy | Sends traffic by… |
|---|---|
| Simple | One record → one resource. |
| Weighted | A % split across endpoints (A/B testing, canary). |
| Latency-based | The Region with the lowest latency for the user. |
| Geolocation | The user's physical location. |
| Failover | A backup if the primary is unhealthy (disaster recovery). |
- CDN — caches content at edge locations near users
- HTTP/HTTPS web content (static + dynamic)
- Lower latency + absorbs spikes; DDoS protection with Shield
- No caching — routes over the AWS backbone
- For TCP/UDP apps: gaming, IoT, VoIP, APIs
- Gives static anycast IPs + fast failover
CloudFront caches at the edge. Global Accelerator does not cache — it speeds up non-HTTP traffic and hands you static IPs by routing over AWS's private backbone.
The 3 Storage Types
The master key: there are only three types of storage. Every service maps to one — learn three ideas, not twelve names.
| Type | What it really is | Analogy | AWS service |
|---|---|---|---|
| Block | Raw disk cut into blocks; OS puts a filesystem on top; attaches to one machine. | A hard drive in one computer | |
| File | Files in folders over a network protocol (NFS/SMB); many machines mount at once. | A shared team network drive | |
| Object | Whole objects (data + metadata + ID) in a flat pool, via URL/API; infinite scale. | A web-accessible valet locker |
- Attaches to one EC2 instance
- Scope: one AZ
- You pick the size
- Snapshots = point-in-time backups in S3
- Mounted by many EC2s at once
- Scope: regional (spans AZs)
- Auto-scales elastically
- FSx = the Windows / specialized variant
EBS = one Box · EFS = Fleet (shared by many). Instance store = ephemeral, lost on stop — don't confuse with EBS.
S3 Storage Classes — One Cost Dial
All classes share the same 11-nines durability — they are not safer-vs-riskier. They differ on storage cost vs retrieval cost/speed vs availability. Two questions decide everything: how often will I read it, and how fast do I need it back?
Intelligent-Tiering vs Standard-IA: unknown pattern + hands-off → Intelligent-Tiering; known-infrequent → Standard-IA. One Zone-IA: trigger is "recreatable / fine if lost," not just "cheapest." The 3 Glaciers differ only by retrieval speed (ms / min–hrs / hrs).
Lifecycle & Moving Big Data
Lifecycle policy = rules that slide objects down the dial as they age, e.g. Standard → Standard-IA (30d) → Glacier (90d) → delete. Exam cue: "automatically move old data to cheaper storage" → lifecycle policy (a feature, not a class).
| Service | What it does |
|---|---|
| Storage Gateway | Hybrid bridge: on-prem apps keep their protocol, data lives in AWS, hot data cached locally. Types by interface: File (S3/FSx) · Tape (VTL → S3+Glacier) · Volume (iSCSI → S3+EBS snapshots). |
| AWS Backup | One central place to back up across many AWS services. |
| Snow Family | Physically ship data when the network is too slow: Snowcone (portable) → Snowball (suitcase, TB–PB) → Snowmobile (a truck, exabytes). |
Snow family: cone < ball < mobile = small < medium < gigantic. Storage Gateway trigger: "keep using the on-prem app but store/back up in AWS" → Storage Gateway.
Exam Trigger Words
Learn the triggers, not the lists. When the question says the phrase on the left, the answer is on the right.
| When the question says… | Answer |
|---|---|
| "frequently accessed" / default | |
| "unknown / changing / unpredictable" + "automatic" cost saving | |
| "infrequently accessed" but "available immediately" | |
| infrequent + "can tolerate loss" / "reproducible" | |
| "archive / long-term / rarely" + hours OK + cheapest | |
| "automatically move old data to cheaper storage" | |
| "on-premises" + "store/back up in AWS" | |
| dedicated private line, consistent, no internet | |
| encrypted on-prem ↔ AWS over the internet | |
| "block / deny a specific IP" at the subnet | |
| cache content near users / CDN | |
| "shared file system" for many EC2s |
Sourced from your vault: DevOps/AWS-Cloud-Practitioner.md, DevOps/S3.md, DevOps/VPN.md · generated 30 Jun 2026