The document discusses advanced AWS networking architectures including AWS Transit Gateway, AWS PrivateLink, and AWS Global Accelerator. It provides an overview of each service and how they can help interconnect VPCs at scale, provide private connectivity to services, and route traffic across regions with low latency. Examples of use cases are also presented, such as using Transit Gateway to interconnect multiple VPCs and VPNs through a single connection point.

1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Planning advanced AWS networking
architectures
Bhavin Desai
Senior solutions architect
Amazon Web Services
S V C 3 0 4
Pratik Mankad
Partner solutions architect
Amazon Web Services

2. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
NAT
InstanceB
10.1.1.11/24
Instance BNAT-GW
NAT-GW
0.0.0.0/0
AWS Region
Availability Zone 2Availability Zone 1
Private subnet
VGW
VPC
Peering
VPC
Flow Logs
VPN
The
internet
Private subnet
Public subnet
InstanceA
Public subnet
Amazon Simple
Storage Service
(Amazon S3)
VPC CIDR 10.1.0.0/16
10.1.0.11/24
InstanceC
10.1.2.11/24
InstanceD
10.1.3.11/24
DXGW
+ Expand + IPv6
IGWVPCE
10.1.0.0/16 Local
0.0.0.0/0 IGW
S3.prefix.list VPCE-123
On premises VGW
VPC-B PCX-123
Destination Target
Intra or
Inter
region
10.1.0.0/16 Local
S3.prefix.list VPCE-123
On premises VGW
VPC-B PCX-123
Destination Target
AWS PrivateLink
Service Provider VPC
NLB
On premises
VPC-B
EIP - 10.1.0.11 : 54.23.12.43
EIP - 10.1.1.11 : 54.19.12.23
Let’s take a closer look
Amazon
DynamoDB
AWS Lambda
AWS Direct
Connect
Amazon Simple
Queue Service
(Amazon SQS)
Amazon Simple
Notification
Service (Amazon
SNS)
AWS IOT
Amazon
CloudWatch
AWS
PrivateLink
AWS Transit
Gateway
Onpremises
AWS PrivateLink
Enabled Services
Other Routes TGW
Other Routes TGW
Amazon S3

4. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
What is AWS Transit Gateway
A gateway that provides simple, scalable, and secure
connectivity across networks

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
Before AWS Transit Gateway
AWS Cloud

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
Interconnecting VPCs at scale—Peering
AWS Cloud
Connecting large number of
VPCs in a mesh is challenging
to manage
Connecting on-premises networks to
each new VPC can take weeks to
months to implement due to
customer’s internal processes

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
Interconnecting VPCs at scale—AWS Transit Gateway
AWS Cloud

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
Single VPN with AWS Transit Gateway
AWS Cloud Server contents

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
AWS Transit Gateway
Benefits
• Centrally interconnect multiple
VPCs across accounts
• One central connection point for
VPN and Direct Connect
• Reduce or eliminate need for peer
to peer networking
• Increase VPN throughput via ECMP
routing (50 Gbps+)
• Peer AWS Transit Gateway across
regions
• Leverage the AWS Global Network
for low latency
cross-region connectivity
• Regional construct
reduces blast radius
• Reduces time to configure on-
premises connectivity to AWS
• Easily monitor and manage from a
central point
• Integrated with CloudWatch and
VPC Flow Logs
• Leverage existing VPC security
groups and network access control
lists
*2H ‘19

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
AWS Transit Gateway use cases

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
AWS Transit
Gateway Shared services
+ VPN
VPN
VPC
Route Destination
10.1.0.0/16 vpc-att-1xxxx
10.2.0.0/16 vpc-att-2xxxx
Route Destination
10.3.0.0/16 vpc-att-3xxxx
10.4.0.0/16 vpc-att-4xxxx
Route Destination
10.0.0.0/8 VPN
10.4.0.0/16 vpc-att-4xxxx
VPCs attach to a route table with
routes to shared resources
Shared resources attach to a route
table with routes to all resources
Use case 1: Shared services with AWS Transit Gateway

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
Use Case 2: Outbound Internet with NAT Gateway
100.64.0.0/16
Outbound VPC
SNAT
SNAT
AWS Transit Gateway
VPC route domain
10.1.0.0/16 10.2.0.0/16
Outbound route domain
Spoke route table Outbound VPC route table
VPC B
VPC Attachment route table, per AZ
Route Destination
10.2.0.0/16 Local
0.0.0.0/0 tgw-xxxxxxxxx
Route Destination
100.64.0.0/16 Local
10.0.0.0/8 tgw-xxxxxxxxx
0.0.0.0/0 igw-xxxxxxxxx
Route Destination
0.0.0.0/0 ngw-xxxxxxx
0.0.0.0/0 vpc-att-outbound 10.1.0.0/16 vpc-att-a
10.2.0.0/16 vpc-att-b
Apply SNAT
outbound to the
internet
SNAT
VPC A
Use Case 2: Outbound internet with NAT Gateway

14. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

15. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

16. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
Before

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
AWS Region 1 AWS Region 2

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
After

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
AWS Region 1 AWS Region 2
3.10.3.1253.10.3.125

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
Client StateAWS’s Global
Network
Static Anycast
IPs
Applications can keep state,
with connections routed to
the same endpoint, after
initial connection.
Traffic routed through AWS
Global Accelerator traverses
AWS global network (instead
of the public internet).
Global Accelerator uses static
IP addresses as a fixed entry
point to your applications.
These IP addresses are anycast
from AWS edge locations.

22. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
What is AWS PrivateLink?
• Services specific link between a consumer VPC and a provider VPC
• Interface VPC endpoint in consumer VPC
• NLB as service frontend in provider VPC
• Three types of services accessible over AWS PrivateLink
• AWS services
• Customer-hosted internal services
• Third-party services (SaaS)

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
Sharing a service with AWS PrivateLink: Advantages
Load BalancerPrivate IP:
10.10.1.6
Endpoint Service
Service name: com.amazonaws…
VPC Endpoint
One-way access
Security group for
the connection
Support for overlapping
addresses
Share to thousands of
VPCs
Share a single service

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
AWS PrivateLink—How it works
10.1.0.0/16
10.1.1.0/24
Availability Zone
10.1.1.127
10.1.2.0/24
Availability Zone
10.1.2.35
172.16.0.0/16
172.16.1.0/24
Availability Zone
172.16.2.0/24
Availability Zone
Network Load Balancer
API API
One IP address for each Availability
Zone
The endpoint is a local IP address
Access is unidirectional

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
AWS PrivateLink—How it works
10.1.0.0/16
10.1.1.0/24
Availability Zone
10.1.1.127
10.1.2.0/24
Availability Zone
10.1.2.35
172.16.0.0/16
172.16.1.0/24
Availability Zone
172.16.2.0/24
Availability Zone
172.16.1.9 172.16.2.41
API API
10.1.0.0/16
10.1.1.0/24
Availability Zone
10.1.1.162
10.1.2.0/24
Availability Zone
10.1.2.22
Support for overlapping IP address
ranges
. . . thousands
DNS names are created:
• 1 FQDN for all IP
addresses
• Multiple FQDNs, one for
each Availability Zone
VPC Endpoint: vpce-xxxx.vpce-svc-xxxx.us-east-
2.vpce.amazonaws.com

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
AWS PrivateLink—How it works
10.1.0.0/16
10.1.1.0/24
Availability Zone
10.1.1.127
10.1.2.0/24
Availability Zone
10.1.2.35
172.16.0.0/16
172.16.1.0/24
Availability Zone
172.16.2.0/24
Availability Zone
172.16.1.9 172.16.2.41
API API
10.1.0.0/16
10.1.1.0/24
Availability Zone
10.1.1.162
10.1.2.0/24
Availability Zone
10.1.2.22
. . . thousands
CNAME api.example.com
--> ALIAS vpce-xxxx.vpce-svc-xxxx.us-east-
2.vpce.amazonaws.com
VPC Endpoint: vpce-xxxx.vpce-svc-xxxx.us-east-
2.vpce.amazonaws.com
Amazon Route 53
Private Hosted Zone
VPC Endpoint: api.example.com
Private Hosted Zone
Association

28. Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Bhavin Desai
Pratik Mankad