In Part-10 we used an Application Load Balancer, and for a web application that is the right default. But every so often the requirements say "the customer needs a fixed IP to allow-list", "it is not HTTP, it is MQTT on port 8883", "we need a million connections per second", or "we …

In Part-1 we created IAM users inside one AWS account. Sooner or later - usually the first time a developer deletes something in production while "just testing" - you realise that one account is the wrong unit. The AWS answer is AWS Organizations - many accounts (dev, test, prod, security, sandbox) under one …

In Part-19 we were the consumer - we created interface endpoints to reach AWS services privately. This Part-20 flips the table: we are the provider. We have an application in our VPC and want other VPCs - other teams, other accounts, customers - to reach it privately, without VPC peering, without exposing it to the …

We have been creating security groups since Part-4 without really stopping to look at them - allow SSH from my IP, allow HTTP from anywhere, next. In this Part-16 the security group gets the full treatment, because it is the one piece of AWS networking you will touch every single day, and because a surprising amount …

Part-12 ended with the problem - VPC peering is point-to-point and not transitive, so ten VPCs need 45 peering connections, and none of them can share a VPN to the office. AWS Transit Gateway is the fix: a regional router you attach every VPC, VPN and Direct Connect to once, and then control who reaches whom with …

In Part-14 I kept saying "add the S3 gateway endpoint and that traffic stops costing NAT money". This Part-19 is that feature in full. A VPC endpoint lets instances in a private subnet reach AWS services - S3, DynamoDB, Systems Manager, ECR, CloudWatch Logs, Secrets Manager, two hundred more - without an …

Every time a security group or a network ACL drops a packet, it does so silently. Your SSH hangs, your health check fails, and nothing anywhere tells you which rule said no. VPC Flow Logs is the feature that ends the guessing - it writes one line for every network flow that reaches a network interface, with the …

In Part-5 I built one VPC. Real accounts have several - a dev VPC and a prod VPC, a VPC per team, a shared-services VPC with the monitoring and the directory - and sooner or later an instance in one needs to talk to a database in another privately, without going out to the internet and back in. The simplest way to do …

In Part-4 I launched an EC2 instance into the default VPC and did not think about the network at all. That is fine for a lab and wrong for everything else - a database with a public IP address is how companies end up in the news. In this Part-5 we build the network that every real AWS workload sits in: a VPC (Virtual …

In Part-10 we put an Application Load Balancer in front of an Auto Scaling group. The moment that ALB got a public DNS name, scanners started knocking - SQL injection in query strings, ../../etc/passwd in paths, login forms hammered from a thousand IPs. Security groups cannot help; they work on ports, not on the …