Learn AWS Networking and Content Delivery

Region, Availability Zone, Local Zone, Wavelength Zone, Outposts, edge network, AZ ID, service scope, dan fault-domain thinking untuk desain jaringan AWS produksi.

OSI/TCP-IP Mapping to AWS Services

23 min

Memetakan OSI/TCP-IP ke layanan AWS agar engineer bisa men-debug, mendesain, dan memilih primitive networking dengan tepat, bukan sekadar menghafal nama layanan.

Life of a Packet in AWS

Menelusuri life of a request di AWS dari DNS, edge, load balancer, VPC route, security boundary, workload, dependency, hingga response path.

Control Plane vs Data Plane

Memahami control plane vs data plane di AWS networking agar desain, deployment, failover, dan debugging tidak bergantung pada asumsi yang salah.

Networking Decision Framework

25 min

Framework praktis untuk memilih layanan AWS networking dan content delivery berdasarkan intent, topology, routing semantics, security boundary, failure mode, dan cost.

Amazon VPC Internal Model

23 min

Model internal Amazon VPC dari first principles: CIDR, subnet, route table, ENI, gateway, endpoint, firewall boundary, dan cara membaca VPC sebagai graph traffic intent.

IP Addressing, CIDR, and Subnet Design

Desain IP addressing, CIDR, dan subnet AWS secara production-grade: kapasitas, growth, AZ matrix, reserved IP, IPv6, overlap, summarization, dan failure-aware subnet sizing.

Subnet Taxonomy: Public, Private, and Isolated

Subnet taxonomy production-grade di AWS: public, private, isolated, route intent, workload placement, multi-AZ subnet matrix, dan anti-pattern yang sering membuat desain VPC rapuh.

Route Tables, Local Routes, and Routing Precedence

Route table Amazon VPC secara mendalam: local routes, explicit associations, main route table, longest prefix match, route priority, prefix lists, propagated routes, blackhole routes, gateway route tables, dan debugging path produksi.

Internet Gateway and Public Connectivity

Internet Gateway dan public connectivity di Amazon VPC secara mendalam: apa yang membuat subnet public, syarat resource bisa diakses dari internet, alur inbound/outbound IPv4 dan IPv6, public IP, Elastic IP, DNS, asymmetric routing, failure mode, dan runbook debugging.

NAT Gateway, NAT Instance, and Egress Design

NAT Gateway, NAT instance, dan egress design di Amazon VPC secara mendalam: outbound-only access, per-AZ NAT, centralized egress, port exhaustion, NAT metrics, NAT64/DNS64, private NAT Gateway, cost traps, failure mode, dan production runbook.

Security Groups Deep Dive

Security Groups secara mendalam sebagai stateful resource firewall di Amazon VPC: mental model, inbound/outbound rules, connection tracking, SG referencing, least privilege, east-west traffic, ephemeral ports, debugging, dan production governance.

Network ACLs Deep Dive

Network ACLs secara mendalam sebagai stateless subnet guardrail di Amazon VPC: inbound/outbound rule evaluation, allow/deny semantics, ephemeral ports, subnet association, public/private subnet examples, debugging, anti-patterns, dan governance.

Elastic Network Interface

Elastic Network Interface secara mendalam sebagai boundary tempat IP address, security group, attachment, source/destination check, service-managed networking, dan packet ownership hidup di Amazon VPC.

VPC DHCP, DNS, and Resolver Basics

VPC DHCP, DNS attributes, AmazonProvidedDNS, Route 53 Resolver, hostnames, split-horizon basics, resolver path, operational failure modes, dan debugging name resolution di Amazon VPC.

IPv6 in Amazon VPC

11 min

IPv6 di Amazon VPC dari first principles: dual-stack, IPv6-only, public/private IPv6, routing, egress-only internet gateway, security controls, DNS64/NAT64, migration strategy, dan failure model produksi.

VPC Endpoints: Gateway and Interface

10 min

VPC endpoints dari sisi implementasi: gateway endpoint, interface endpoint, AWS PrivateLink, endpoint policies, private DNS, S3/DynamoDB access, service access tanpa internet/NAT, cost model, dan debugging production path.

Endpoint Policies and Private DNS

9 min

Endpoint policies dan Private DNS dari sisi implementasi: bagaimana request melewati VPC endpoint, bagaimana IAM/resource policy/endpoint policy dievaluasi bersama, bagaimana private DNS mengubah path tanpa mengubah kode aplikasi, dan bagaimana mendesain guardrail private service access di production.

VPC Flow Logs and Traffic Mirroring

9 min

VPC Flow Logs dan Traffic Mirroring untuk observability dan troubleshooting produksi: bagaimana membaca flow records, membuktikan packet path, membedakan routing/security/auth failure, kapan butuh packet capture, dan bagaimana membangun forensic-ready network telemetry.

Multi-Account Networking Foundation

Fondasi desain multi-account networking di AWS: account boundary, ownership model, centralized network account, shared services, routing domain, DNS authority, egress, inspection, IPAM, dan invariants untuk platform produksi skala enterprise.

VPC Peering Design

9 min

Desain VPC Peering secara produksi: direct private routing antar-VPC, non-transitive behavior, route table design, DNS resolution, overlapping CIDR limitation, cross-region behavior, scaling limit, failure modes, observability, dan kapan harus pindah ke Transit Gateway atau PrivateLink.

AWS Transit Gateway Core Model

Deep dive AWS Transit Gateway core model: attachment, route table, association, propagation, static route, blackhole route, attachment subnet, appliance mode, data-plane packet path, dan invariant produksi untuk desain hub-and-spoke multi-VPC.

Transit Gateway Routing Patterns

Transit Gateway routing patterns untuk produksi: hub-spoke, isolated route domains, shared services, centralized egress, inspection VPC, on-prem segmentation, blackhole guardrail, route propagation strategy, dan debugging pattern-level.

TGW Cross-Region and Multi-Account

7 min

Transit Gateway cross-region dan multi-account: TGW peering, static routing, AWS RAM sharing, ownership boundary, DNS limitation, encryption behavior, route-domain propagation, dan production migration strategy.

Transit Gateway Connect and SD-WAN

6 min

Transit Gateway Connect dan SD-WAN integration: GRE tunnel, Connect attachment, Connect peer, BGP sessions, transport attachment, route propagation, ECMP, MTU, failure mode, dan enterprise branch connectivity pattern.

AWS Cloud WAN Deep Dive

AWS Cloud WAN deep dive untuk membangun, mengelola, dan mengoperasikan global network lintas Region, account, VPC, branch, data center, segment, policy, dan inspection domain.

VPC Sharing and Centralized Network Ownership

VPC sharing dan centralized network ownership untuk multi-account AWS: owner/participant model, shared subnet, AWS RAM, boundary permission, operational contract, security, debugging, dan governance.

Amazon VPC IPAM

Amazon VPC IPAM dari first principles: scopes, pools, allocations, operating regions, compliance, overlap detection, BYOIP, public/private address governance, automation, dan produksi multi-account.

Overlapping CIDR and NAT Patterns

Overlapping CIDR dan NAT patterns di AWS: kenapa overlap berbahaya, kapan masih bisa diterima, remediation dengan renumbering, PrivateLink, private NAT Gateway, proxy, DNS, dan migration strategy.

Hybrid Connectivity Mental Model

Hybrid connectivity mental model untuk menghubungkan AWS dengan on-premises, branch, data center, partner network, dan network domain lain secara aman, resilient, observable, dan defensible.

AWS Site-to-Site VPN

AWS Site-to-Site VPN deep dive untuk hybrid connectivity: customer gateway, target gateway, tunnel, IPsec/IKE, BGP/static routing, failover, monitoring, security, dan production runbook.

AWS Direct Connect Foundations

AWS Direct Connect foundations untuk hybrid connectivity: dedicated/hosted connection, Direct Connect location, cross-connect, virtual interface, Direct Connect gateway, resiliency, encryption, cost, dan production checklist.

Direct Connect Routing and BGP

Direct Connect routing and BGP deep dive: private/public/transit VIF routing, BGP attributes, local preference communities, active-active, active-passive, failover, route filtering, asymmetric path, dan production runbook.

Direct Connect + VPN Patterns

Direct Connect plus VPN patterns untuk encrypted private connectivity, internet VPN backup, private IP VPN over Direct Connect, routing preference, failover, observability, dan runbook produksi.

AWS Client VPN and Remote Access

AWS Client VPN dan remote access deep dive: endpoint, client CIDR, target network association, routing, authorization rules, split tunnel, authentication, security group, multi-VPC access, observability, cost, dan runbook produksi.

AWS Verified Access and Zero Trust Access

AWS Verified Access dan zero trust access deep dive: trust provider, instance, group, endpoint, Cedar policy, request flow, comparison dengan Client VPN/bastion, endpoint types, observability, security, dan production rollout.

Hybrid DNS with Route 53 Resolver

Hybrid DNS dengan Route 53 Resolver deep dive: inbound endpoint, outbound endpoint, forwarding rules, private hosted zones, split-horizon DNS, multi-account sharing, loop prevention, observability, dan troubleshooting.

Enterprise Hybrid Reference Architecture

26 min

Enterprise hybrid reference architecture for AWS networking, combining Transit Gateway, Direct Connect, VPN, Route 53 Resolver, inspection, shared services, multi-account governance, and operational runbooks.

DNS From First Principles

DNS from first principles for AWS engineers: recursive and authoritative DNS, delegation, zones, records, TTL, caching, negative caching, split-horizon DNS, resolver paths, propagation myths, and debugging.

Amazon Route 53 Public Hosted Zones

Public hosted zone Route 53 dari first principles: authoritative DNS, delegation, records, alias, apex, DNSSEC, operational safety, dan production runbook.

Route 53 Routing Policies

Route 53 routing policies dari sudut desain produksi: simple, weighted, latency, failover, geolocation, geoproximity, IP-based, multivalue answer, TTL, health check semantics, dan anti-pattern.

Route 53 Health Checks and Failover

Route 53 health checks dan DNS failover dari sudut produksi: endpoint checks, calculated checks, CloudWatch alarms, TTL reality, active-passive DR, failure detection, dan runbook debugging.

Route 53 Private Hosted Zones

10 min

Route 53 Private Hosted Zones dari first principles: private DNS, VPC association, split-horizon, resolver precedence, cross-account association, service naming, hybrid access, dan debugging.

Route 53 Resolver and DNS Firewall

Route 53 Resolver dan DNS Firewall dari first principles: resolver rule, inbound/outbound endpoint, query logging, DNS Firewall, domain list, rule group, exfiltration defense, governance, dan debugging.

AWS Global Accelerator Deep Dive

AWS Global Accelerator dari first principles: anycast IP, accelerator, listener, endpoint group, endpoint weight, traffic dial, health check, client affinity, failover, client IP preservation, dan production use cases.

Route 53 vs Global Accelerator vs CloudFront

Decision framework untuk memilih Amazon Route 53, AWS Global Accelerator, dan Amazon CloudFront sebagai global front door aplikasi produksi.

Elastic Load Balancing Mental Model

Mental model Elastic Load Balancing untuk memahami listener, rule, target group, health check, connection lifecycle, cross-zone routing, dan failure mode sebelum masuk ALB/NLB/GWLB detail.

Application Load Balancer Deep Dive

23 min

Deep dive Application Load Balancer untuk HTTP/HTTPS routing, listener rules, target groups, health checks, TLS, gRPC, WebSocket, authentication, mTLS, deployment pattern, dan debugging produksi.

Network Load Balancer Deep Dive

Deep dive Network Load Balancer untuk TCP, UDP, TLS, static IP, source IP preservation, health checks, PrivateLink provider pattern, zonal behavior, performance, dan debugging produksi.

Gateway Load Balancer and Appliance Insertion

Deep dive Gateway Load Balancer untuk appliance insertion, GENEVE encapsulation, inspection VPC, centralized firewalling, route-table steering, failover, MTU, flow stickiness, dan debugging produksi.

Load Balancer Security and TLS Patterns

11 min

Deep dive pola security dan TLS pada load balancer AWS, termasuk TLS termination, passthrough, re-encryption, SNI, ACM, mTLS, ALB vs NLB behavior, CloudFront origin TLS, certificate rotation, dan runbook debugging.

Load Balancer Failure and Debugging

27 min

Production-oriented guide for debugging Elastic Load Balancing failures, unhealthy targets, HTTP 502/503/504, TCP resets, TLS issues, asymmetric routing, and observability signals.

CloudFront Mental Model

First-principles mental model of Amazon CloudFront as a global edge proxy and cache, including distributions, origins, cache behaviors, request lifecycle, cache hit/miss semantics, and architectural trade-offs.

Cache Key and Origin Request Policy

Deep implementation guide for CloudFront cache keys, cache policies, origin request policies, headers, cookies, query strings, TTLs, cache correctness, and cache hit ratio engineering.

CloudFront Origins

Implementation-focused guide to CloudFront origins including S3, ALB, API Gateway, EC2/custom origins, VPC origins, origin groups, origin failover, TLS, DNS, security, and operational failure modes.

CloudFront Security

Implementation-focused guide to CloudFront security using origin access control, legacy origin access identity, signed URLs, signed cookies, custom-origin protection, HTTPS, geo restriction, WAF placement, and direct-origin bypass prevention.

CloudFront Functions and Lambda@Edge

Implementation-focused guide to CloudFront Functions and Lambda@Edge, covering event lifecycle, rewrite and redirect patterns, authorization, cache key mutation, origin selection, limits, deployment safety, and debugging.

CloudFront Invalidation, Versioning, and Deployments

CloudFront invalidation, immutable versioning, cache-safe deployment, rollback, blue/green, canary, and operational release patterns for production-grade content delivery.

CloudFront Observability, Performance, and Cost

CloudFront observability, logs, metrics, real-time diagnostics, cache hit ratio engineering, origin latency, compression, Origin Shield, price classes, and cost-aware production operations.

AWS PrivateLink Provider/Consumer Model

AWS PrivateLink provider/consumer model from first principles: endpoint service, interface endpoint, NLB provider front door, private DNS, acceptance workflow, security boundaries, overlapping CIDR, SaaS/private API patterns, and production debugging.

Amazon VPC Lattice Deep Dive

Amazon VPC Lattice from first principles: service network, services, listeners, rules, target groups, auth policies, resource/service association, cross-account service-to-service access, observability, security, failure modes, and decision framework.

AWS Cloud Map and Service Discovery

Service discovery dari sudut pandang networking: AWS Cloud Map, namespace, service, instance registry, DNS/API discovery, health semantics, TTL, dan failure mode produksi.

API Gateway Networking Positioning

API Gateway dari sudut pandang networking: public/regional/private API, VPC Link, private integration ke ALB/NLB/Cloud Map, PrivateLink, CloudFront, WAF, dan boundary production architecture.

EKS and Kubernetes Networking on AWS

EKS and Kubernetes networking on AWS from first principles: VPC CNI, Pod IPs, Services, Ingress, AWS Load Balancer Controller, security groups for Pods, NetworkPolicy, DNS, egress, observability, and production failure modes.

Network Security Reference Model

A production reference model for AWS network security: packet boundary, identity boundary, service boundary, DNS boundary, edge boundary, inspection, governance, logging, and failure-mode driven design.

AWS WAF Deep Dive

Deep dive AWS WAF untuk production web protection: web ACL, rule evaluation, managed rules, rate-based rules, Bot Control, CAPTCHA/Challenge, labels, logging, rollout, false positive handling, and architecture patterns.

AWS Shield and DDoS Resilience

Deep dive AWS Shield and DDoS resilience: Shield Standard vs Advanced, L3/L4/L7 DDoS, edge-first architecture, CloudFront, Route 53, Global Accelerator, ELB, Elastic IP, health checks, response process, cost protection, and production runbooks.

AWS Network Firewall Deep Dive

Deep dive AWS Network Firewall untuk centralized inspection, egress filtering, east-west controls, Suricata-compatible rules, routing symmetry, observability, dan production runbook.

Firewall Manager and Policy Governance

Deep dive AWS Firewall Manager untuk policy governance multi-account, WAF/Shield/Network Firewall/DNS Firewall/Security Group/NACL management, compliance, rollout strategy, dan operational model.

Network Observability and Reachability

25 min

Deep dive network observability dan reachability di AWS: Reachability Analyzer, Network Access Analyzer, Flow Logs, Traffic Mirroring, TGW Flow Logs, CloudWatch Internet Monitor, Network Manager, signal design, dan production debugging runbook.

Production Debugging, Cost, and Final Architecture