AWS Cloud Architecture Track

AWS Cloud Architecture & Security Lab

Deep dive into production-grade AWS Cloud Networking, IAM security policy simulation, S3 encryption compliance, EC2/ECS/EKS compute selection, and Serverless + CDN execution flows.

✓ Multi-AZ Subnets✓ IAM Evaluator✓ S3 Shield

Module 01 / Cloud Infrastructure

☁️ AWS VPC Subnetting & CIDR Block Planning

RFC 1918 Private IPv4 Ranges

In Amazon Web Services, a Virtual Private Cloud (VPC) spans an entire AWS Region. Subnets are strictly bound to a single Availability Zone (AZ). AWS automatically reserves 5 IP addresses per subnet for network routing, DNS, and broadcast emulation.

VPC CIDR Block Range

Availability Zone Multi-AZ Redundancy

Subnet Mask Size

⚠️ AWS 5 Reserved IPs Rule (Per Subnet)Example for Subnet 10.0.1.0/24

10.0.1.0Network Address

10.0.1.1VPC Router / Gateway

10.0.1.2Amazon DNS Server

10.0.1.3Reserved for Future Use

10.0.1.255Network Broadcast

🗺️ Multi-AZ Subnet Topology (9 Total Subnets)

Subnet Name	Type & Isolation	Availability Zone	CIDR Block	Total IPs	Usable Host IPs	Target Egress Route
Public Subnet 1A	Public Subnet (IGW)	us-east-1a	10.0.1.0/24	256	251 IPs	Internet Gateway (IGW)
Private App Subnet 1A	Private App (NAT)	us-east-1a	10.0.20.0/24	256	251 IPs	NAT Gateway (us-east-1a)
Isolated DB Subnet 1A	Isolated DB (No Egress)	us-east-1a	10.0.60.0/24	256	251 IPs	Isolated (No Egress)
Public Subnet 1B	Public Subnet (IGW)	us-east-1b	10.0.4.0/24	256	251 IPs	Internet Gateway (IGW)
Private App Subnet 1B	Private App (NAT)	us-east-1b	10.0.50.0/24	256	251 IPs	NAT Gateway (us-east-1b)
Isolated DB Subnet 1B	Isolated DB (No Egress)	us-east-1b	10.0.120.0/24	256	251 IPs	Isolated (No Egress)
Public Subnet 1C	Public Subnet (IGW)	us-east-1c	10.0.7.0/24	256	251 IPs	Internet Gateway (IGW)
Private App Subnet 1C	Private App (NAT)	us-east-1c	10.0.80.0/24	256	251 IPs	NAT Gateway (us-east-1c)
Isolated DB Subnet 1C	Isolated DB (No Egress)	us-east-1c	10.0.180.0/24	256	251 IPs	Isolated (No Egress)

Generated Infrastructure as Code (IaC)

# Terraform VPC & Multi-AZ Subnets
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = { Name = "enterprise-production-vpc" }
}

resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.main.id
}

resource "aws_subnet" "subnet_1" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-east-1a"
  map_public_ip_on_launch = true
  tags = { Name = "Public Subnet 1A" }
}

resource "aws_subnet" "subnet_2" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.20.0/24"
  availability_zone = "us-east-1a"
  map_public_ip_on_launch = false
  tags = { Name = "Private App Subnet 1A" }
}

resource "aws_subnet" "subnet_3" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.60.0/24"
  availability_zone = "us-east-1a"
  map_public_ip_on_launch = false
  tags = { Name = "Isolated DB Subnet 1A" }
}

Module 02 / Identity & Governance

🔑 IAM Policy JSON Simulator & Access Control

AWS IAM Evaluation Logic

AWS IAM evaluates policies using a strict hierarchy: Explicit Deny always overrides any Allow. By default, all requests are implicitly denied unless an explicit Allow matches the principal, action, resource, and context conditions.

Load Sample IAM Policy Document Presets:

IAM JSON Policy DocumentVersion: 2012-10-17

⚡ Request Context Simulator

AWS Action (API Operation)

Target Resource ARN

HTTPS Transport (TLS)

MFA Authenticated

Client Source IP

Module 03 / Data Protection

📦 Amazon S3 Security Controls & Default Encryption

Security Audit Rating:90 / 100 EXCELLENT

Amazon S3 buckets store mission-critical data. Hardening S3 requires activating Block Public Access (BPA), enforcing Default Server-Side Encryption (SSE-KMS), and blocking unencrypted HTTP transport via bucket policies.

Block Public Access (BPA)

Blocks public bucket ACLs and policies enterprise-wide.

Default Encryption

Encrypts all S3 objects at rest prior to storage.

Bucket Versioning

Protects against unintended deletes and ransomware overwrites.

Enforce TLS (aws:SecureTransport)

Denies unencrypted HTTP requests in transit.

S3 Object Lock (WORM)

Write Once Read Many compliance protection.

Hardened S3 Bucket Policy (JSON)

Enforces TLS & SSE Encryption

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EnforceTLSRequestsOnly",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::my-secure-bucket",
        "arn:aws:s3:::my-secure-bucket/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Sid": "DenyUnencryptedObjectUploads",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-secure-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    }
  ]
}

Module 04 / Compute & Orchestration

⚡ EC2 vs ECS vs EKS Container Infrastructure

AWS Compute Selector Matrix

AWS offers three primary compute paradigms: Amazon EC2 for raw virtual machines, Amazon ECS for AWS-native container management, and Amazon EKS for enterprise Kubernetes orchestration.

Select Your Target Application Workload:

🖥️IaaS / Virtual Machines

Amazon EC2

Elastic Compute Cloud

• Full root SSH & OS kernel access
• Security Groups per Instance
• EBS block storage & AMI snapshots
• High management overhead (OS patching)

🐳AWS Native Container Engine

Amazon ECS

Elastic Container Service

• Lightweight Task Definitions & Services
• Deep integration with ALB & IAM Roles
• Runs on Fargate serverless or EC2
• Low operational complexity

☸️Managed Kubernetes

Amazon EKS

Elastic Kubernetes Service

• Pure upstream Kubernetes API (kubectl)
• AWS VPC CNI for Pod IP allocation
• Helm, ArgoCD, & Istio Ecosystem
• Requires K8s expertise & control plane fee

Feature Metric	Amazon EC2	Amazon ECS	Amazon EKS
Orchestration API	Auto Scaling Groups	ECS Task Definitions	Kubernetes Manifests (kubectl)
Networking Model	ENI per EC2 Instance	awsvpc mode (ENI per Task)	AWS VPC CNI (IP per Pod)
Serverless Capacity	No (Provisioned Instances)	Yes (AWS Fargate)	Yes (EKS Fargate Profiles)
Management Overhead	High (OS, Patches, Drivers)	Low (Fully AWS Managed)	Medium-High (K8s Addons)

Module 05 / Serverless & Edge Computing

🚀 Lambda Serverless Execution Flow & CloudFront CDN

Event-Driven Architecture

AWS CloudFront caches dynamic and static assets at 600+ Edge Points of Presence (PoPs) globally. When cache misses occur, traffic routes through API Gateway to trigger AWS Lambda functions. Cold starts occur when Lambda provisions a fresh execution container environment.

Container Provisioning State

CloudFront Edge Cache State

Lambda Memory Size: 256 MB

CloudWatch Logs Stream (/aws/lambda/api-handler)

Real-time Telemetry

Click "Execute End-to-End API Request Flow" to simulate request invocation logs...

AWS · COST OPTIMIZATION

EC2 Pricing Calculator — On-Demand vs Reserved vs Spot

Slide the fleet size, pick a region and commitment, then watch the live monthly / annual cost comparison. Reserved Instances trade flexibility for up to 52% savings (3-yr All Upfront); Spot adds another discount layer but instances can be reclaimed at any time.

Pricing Controls

Fleet Configuration — m5.large (2 vCPU / 8 GiB)

10 × us-east-1

Instance Count10

150100

Regionus-east-1

us-east-1us-west-2eu-west-1

Commitment Term1-Year

1 Year3 Years

Reserved Payment Option

All Upfront = 100% of term billed now · Partial Upfront = 40% now, 60% spread across the term · No Upfront = fully billed monthly.

Live Comparison

Monthly Spend — 10 × m5.large @ us-east-1

On-DemandPay per second, no commitment

$701/mo

Reserved Instance1-year · All Upfront

$463/mo−34%

Spot InstanceFault-tolerant / flexible workloads

$210/mo−70%

🏆

Best pick: Spot Instance saves 70% vs On-Demand

Spot pricing is ideal for stateless, fault-tolerant or batch workloads that tolerate interruptions.

Est. monthly

$210

Reserved — Monthly / Annual

$463

$5,550/yr

SAVES 34% vs ON-DEMAND

Spot — Monthly / Annual

$210

$2,523/yr

SAVES 70% vs ON-DEMAND

On-Demand Baseline

$701

$8,410/yr

NO COMMITMENT

Term Projection

1-Year Total Cost of Ownership — 10 × m5.large

Upfront Payment (All Upfront)

$5,550

100% of term billed today

Monthly Bill During Term

Covered by upfront payment

Effective Hourly / Instance

$0.063

vs $0.096 On-Demand

Model	Per-Instance Hourly	Per-Instance Monthly	1-Year Total (Fleet)	Savings vs On-Demand
On-Demand	$0.096	$70.080	$8,410	—
Reserved (1yr · All Upfront)	$0.063	$46.253	$5,550	−34%
Spot	$0.029	$21.024	$2,523	−70%

🕐 On-Demand

Short-term spikes, dev/test environments, unknown or elastic workloads. Highest flexibility, highest price.

🔒 Reserved Instances

Predictable, always-on production fleets (24×7 baselines). Upfront payment = bigger discount; 3-yr beats 1-yr; savings continue across the entire term.

⚡ Spot Instances

Batch jobs, CI runners, stateless web tiers that survive interruptions. AWS can reclaim capacity with 2-minute notice — never run your only database on Spot.

Prices approximate public m5.large rates for educational comparison; Spot factors are representative discounts, not live market bids. Regional On-Demand: us-east-1 $0.096/hr · us-west-2 $0.096/hr · eu-west-1 $0.108/hr.

AWS Disaster Recovery Track

Disaster Recovery & Multi-Region Architecture

Set your Recovery Time Objective (RTO) and Recovery Point Objective (RPO), then see which of the four canonical AWS strategies can hit them — what the recovery timeline looks like and what it actually costs. The business asks for numbers; this planner turns RPO/RTO into a strategy.

RTO / RPO Planner4 DR StrategiesRecovery TimelineCost Tradeoff

Module 01 / Recovery Objectives

RTO & RPO Sliders

Range: 1 min – 24 hr

RTO (Recovery Time Objective) is the maximum downtime you can tolerate — how fast service must be back. RPO (Recovery Point Objective) is the maximum acceptable data loss, i.e. how far back in time your last good copy may be. Together they set the severity of the disaster: Total Downtime = RPO + RTO

Recovery Time Objective (RTO)15m

1m — max failover24h — restore from backup

Recovery Point Objective (RPO)3m

1m — sychronous replication24h — daily snapshots

Strategy Feasibility CheckBest case must be ≤ your target

Backup & RestoreTOO SLOW

RTO 12h / RPO 12h

Pilot LightTOO SLOW

RTO 30m / RPO 15m

Warm StandbyFITS

RTO 5m / RPO 1m

Multi-Site Active-ActiveFITS

RTO 0m / RPO 0m

Best fit for your targets: Warm Standby ($$$/mo) — the cheapest viable strategy given RTO 15m / RPO 3m.

Module 02 / Strategy Selection

Pick a DR Strategy

Selecting a strategy sets typical RTO/RPO targets

Warm StandbyWarm model

Target: RTO 15m / RPO 3m — this strategy fits

A complete copy of the production environment runs in the DR region at reduced scale. Aurora Global Database and DynamoDB Global Tables keep data nearly synchronous across regions. Recovery is a scale-up plus DNS flip — RTO in minutes, RPO near zero.

Key AWS Services

Aurora Global DatabaseAuto ScalingRoute 53S3 CRRElastiCache

Failover

Scale up the DR Auto Scaling group, promote the Aurora global secondary, and switch Route 53 failover routing.

Data recovery

Aurora Global Database and DynamoDB Global Tables replicate continuously; catch-up lag is seconds, so no restore step is needed.

Module 03 / Visualized Timeline

Recovery Timeline

RTO 15m / RPO 3m

RPO 3m+RTO 15m=Total downtime: 18m

DATA LOSS (3m)

RECOVERY (15m)

T+0 disaster

Recovery point (T – 3m)

Restored at T+15m

STEP 01

Detect

Route 53 health checks and CloudWatch alarms detect the impaired region and trigger the runbook.

STEP 02

Failover

Scale up the DR Auto Scaling group, promote the Aurora global secondary, and switch Route 53 failover routing.

STEP 03

Recover data

Aurora Global Database and DynamoDB Global Tables replicate continuously; catch-up lag is seconds, so no restore step is needed.

STEP 04

Verify & reroute

App endpoints pass health checks, routing flips, and the warm standby is confirmed serving full traffic.

Module 04 / Economic Analysis

Cost vs Recovery Time Tradeoff

Plot: typical RTO against monthly cost

Meets your RTO Exceeds your RTO Selected strategy

Estimated Monthly Cost — Warm Standby

$5,200

Compute & availability (RTO-driven)$3,200 (62%)

Data replication (RPO-driven)$800 (15%)

Storage & backups$1,200 (23%)

Annual TCO projection$62,400/yr

Model: replication cost scales with freshness (typical RPO 3m ÷ your RPO 3m, clamped 0.5–4×) and compute cost +15% when your RTO target 15m is below the strategy's typical 15m. Faster recovery is always the expensive direction — the slope steepens hard below the 1-hour mark.

Strategy Comparison Matrix

Strategy	Best-case RTO	Best-case RPO	Cost tier	Data replication approach
Backup & Restore	12h – 24h	12h – 24h	$/mo · 0.8k	Back up data to another region; rebuild and restore on demand.
Pilot Light	30m – 4h	15m – 1h	$$/mo · 2.4k	A pilot light stays lit: core data + tiny fleet always run.
Warm StandbySELECTED	5m – 30m	1m – 5m	$$$/mo · 5.2k	Full environment, scaled down, ready to absorb traffic.
Multi-Site Active-Active	0m – 5m	0m – 1m	$$$$/mo · 9.8k	Both regions serve production traffic with seamless failover.

AWS · Security Hub & Compliance

AWS Security Hub & Compliance Framework

Toggle regulatory frameworks in scope, audit each control, and watch the compliance score and domain radar update in real time.

🤝

SOC 2

AICPA TSC

Trust Services Criteria covering security, availability, and confidentiality of customer data.

IN SCOPE6/8 passed

🏥

HIPAA

45 CFR §164

Security & Privacy Rule safeguards for protected health information (PHI) stored or processed in AWS.

IN SCOPE6/8 passed

💳

PCI-DSS

v4.0

Payment Card Industry Data Security Standard for cardholder data environments (CDE).

IN SCOPE6/8 passed

🛡️

CIS Benchmark

AWS Foundations v2.0

Center for Internet Security foundational checks enforced via Security Hub controls.

IN SCOPE6/7 passed

🏛️

NIST 800-53

Rev 5 / CSF

National Institute of Standards control families mapped to AWS security services.

IN SCOPE7/8 passed

📡 Security Domain Coverage

Share of passed controls per domain across in-scope frameworks.

IdentityEncryptionDataOpsLoggingNetwork

Identity & Access Control88%

Encryption & Key Mgmt100%

Data Protection83%

Operations & Response38%

Logging & Monitoring100%

Network Security67%

🧮 Compliance Score Calculator

Passed controls ÷ total controls across in-scope frameworks.

79%OVERALL

STATUS: REVIEW

PASSED

FAILED

TOTAL

🤝 SOC 26/8 · 75%

🏥 HIPAA6/8 · 75%

💳 PCI-DSS6/8 · 75%

🛡️ CIS Benchmark6/7 · 86%

Workflow:5 states · 6 itemsVALID ASL

Amazon Step Functions builds state machines in the Amazon States Language (ASL) to orchestrate Lambda functions and AWS services. States transition via Next pointers, fan out with Parallel, branch on data with Choice, and recover from failures with Retry / Catch — build a workflow below, read the generated ASL JSON, then watch it execute step by step.

State Machine

A directed graph of states defined in ASL. Every state declares a Next transition or ends the machine.

Standard vs Express

Standard: up to 1 year, exactly-once, auditable. Express: up to 5 minutes, at-least-once, high throughput.

Retry & Catch

Retry applies backoff policies for transient errors. Catch routes failures to a fallback state instead of failing.

Event-Driven Triggers

Start executions from EventBridge rules, API Gateway, S3 events, SQS, or the StartExecution SDK call.

🧱 Step Palette

📋 Workflow EditorNext/End transitions mirror ASL

#1⚙️ Task

Resource

Function name

#2🔀 Choice

Variable

Operator

Value

Match → jump to

#3⚙️ Task

Resource

Function name

#4🛟 CatchRetry

Max attempts

Interval (s)

Backoff rate

Catch → fallback

#5⚙️ Task

Resource

Function name

#6⚙️ Task

Resource

Function name

🗺️ Workflow Diagram

Live view — arrows follow each state's Next transition

success running error

START

Validate Order

AWS Lambda (invoke)

ƒ validate-order-handler

if $.amount >= 100 → Manual Review

else → Process Payment

Process Payment

AWS Lambda (invoke)

ƒ charge-card-handler

⚠ simulator injects failure here

Ship OrderEND

AWS Lambda (invoke)

ƒ ship-order-handler

Manual ReviewEND

AWS Lambda (invoke)

ƒ manual-review-handler

📄 State Machine JSON (Amazon States Language)

{
  "Comment": "Amazon States Language state machine — generated by SubnetLab Step Functions studio",
  "StartAt": "Validate_Order",
  "States": {
    "Validate_Order": {
      "Type": "Task",
      "Resource": "arn:aws:states:::lambda:invoke",
      "Parameters": {
        "FunctionName": "validate-order-handler",
        "Payload.$": "$"
      },
      "Next": "Check_Inventory"
    },
    "Check_Inventory": {
      "Type": "Choice",
      "Choices": [
        {
          "Variable": "$.amount",
          "NumericGreaterThanEquals": 100,
          "Next": "Manual_Review"
        }
      ],
      "Default": "Process_Payment"
    },
    "Process_Payment": {
      "Type": "Task",
      "Resource": "arn:aws:states:::lambda:invoke",
      "Parameters": {
        "FunctionName": "charge-card-handler",
        "Payload.$": "$"
      },
      "Retry": [
        {
          "ErrorEquals": [
            "States.ALL"
          ],
          "IntervalSeconds": 1,
          "MaxAttempts": 3,
          "BackoffRate": 2
        }
      ],
      "Catch": [
        {
          "ErrorEquals": [
            "States.ALL"
          ],
          "Next": "Manual_Review"
        }
      ],
      "Next": "Ship_Order"
    },
    "Ship_Order": {
      "Type": "Task",
      "Resource": "arn:aws:states:::lambda:invoke",
      "Parameters": {
        "FunctionName": "ship-order-handler",
        "Payload.$": "$"
      },
      "End": true
    },
    "Manual_Review": {
      "Type": "Task",
      "Resource": "arn:aws:states:::lambda:invoke",
      "Parameters": {
        "FunctionName": "manual-review-handler",
        "Payload.$": "$"
      },
      "End": true
    }
  }
}

▶ Execution Simulator

Simulated input to StartExecution: { "amount": 42, "itemType": "books" }

$.amount (number)

$.itemType (string)

// press Run Execution to trace the state machine step by step

Tip: set a Task's simulator toggle to inject a failure, then re-run to watch Retry backoff and Catch routing. Set $.itemType to poster in the Image Thumbnail template to see a Choice loop back.

AWS API Gateway & Microservices Patterns Track

API Gateway & Microservices Patterns

Design production-grade serverless APIs: choose between REST and HTTP APIs, build routes with method-level authorizers, tune throttling and caching, and export a deploy-ready OpenAPI specification.

✓ REST vs HTTP✓ Route Builder✓ Authorizers✓ Throttle & Cache✓ OpenAPI Export

Module 01 / API Styles

⚖️ REST API vs HTTP API — Choosing Your Gateway

Amazon API Gateway · 2 Flavors

Both API types sit in front of your backend and share the same Lambda/HTTP/private integrations — but REST APIs carry the full feature set (usage plans, caching, models, canary deployments) while HTTP APIs trade those features for lower cost and lower latency. The right choice depends on which capabilities your API actually needs.

Capability	REST API	HTTP API
Pricing	$3.50 per 1M requests	$1.00 per 1M requests
Latency	Higher (payload transforms, validation)	~10–30% lower (minimal processing)
WebSocket support	✅ Yes (chat, streaming)	❌ No
Usage plans & API keys	✅ Yes	❌ No
Per-route throttling & quotas	✅ Yes	❌ Account-level throttling only
Stage-level caching	✅ Yes (0.5–237 GB)	❌ No native cache (use CloudFront)
Request validation (models)	✅ Yes (JSON schemas)	⚠️ Basic only
Authorizers	IAM, Lambda, Cognito, JWT	IAM, Lambda, JWT / OIDC
Canary releases / traffic shifting	✅ Yes	❌ No
Custom domains	✅ Yes	✅ Yes (free ACM certs)
WAF integration	✅ Yes	✅ Yes
Private endpoints (VPC)	✅ Yes	✅ Yes (VPC Link)
Endpoint types	Edge-optimized · Regional · Private	Regional only
OpenAPI import / export	✅ Full (swagger + OpenAPI 3)	✅ OpenAPI 3 subset
Service integrations (SQS, Kinesis, Step Functions)	✅ Yes	✅ Yes

🎯 Use-Case Recommender

Pick a workload — the recommender highlights which API flavor fits and why.

→ HTTP APIServerless CRUD (Lambda + DynamoDB)

HTTP APIs are cheaper and faster for straightforward Lambda/DynamoDB proxy integrations, with native JWT/OIDC authorizers when you need them.

💰 Cost Snapshot (monthly)

Monthly Requests

REST API

$35.00

HTTP API

$10.00

You Save

$25.00 / mo

$300.00 / yr

Request pricing is region-dependent (us-east-1 reference) · Cache adds $70.08/mo when enabled (1.6 GB × ~$0.06/GB/hr × 730h).

Module 02 / Route Designer

🛣️ Interactive Route Builder

agmtgqi9me.execute-api.us-east-1.amazonaws.com

Compose your API surface route by route. Each route pairs an HTTP method and path (with {pathParams}) with an integration target, an authorizer, and optional caching and request validation. The generated OpenAPI spec in Module 05 mirrors exactly what you build here.

Resource Path

HTTP Method

Integration

Authorizer

Flags

CacheValidate

🗂️ Deployed Routes (3) — 3 protected · 1 cached · 2 validated

Method	Path	Integration	Authorizer	Flags
GET	/pets	Lambda (AWS_PROXY)	IAM (SigV4)	CACHEVALIDATE
POST	/pets	Lambda (AWS_PROXY)	Cognito User Pools	VALIDATE
DELETE	/pets/{petId}	Lambda (AWS_PROXY)	Lambda Token

Sample Invocation URLs

GET https://agmtgqi9me.execute-api.us-east-1.amazonaws.com/prod/pets

POST https://agmtgqi9me.execute-api.us-east-1.amazonaws.com/prod/pets

DELETE https://agmtgqi9me.execute-api.us-east-1.amazonaws.com/prod/pets/{petId}

Module 03 / Authorization

🔐 Authorizer Configuration

IAM · Lambda · Cognito

An authorizer runs before a route's integration and decides whether a caller may invoke it. API Gateway supports IAM (SigV4) for machine-to-machine access, Lambda token authorizers for custom logic (OAuth2 introspection, API keys, custom headers), and Cognito User Pools for JWT-based user authentication.

Cognito User Pools Settings

User Pool ID

App Client ID

Token Source

Require scopes

Required Scopes

JWT Verification

Issuer: https://cognito-idp.us-east-1.amazonaws.com/us-east-1_Xk9fQ2mP

Audience: 7q3mz9l4k2b1c8d0

API Gateway validates signature, expiry & audience automatically.

Token Types

Access Token

Used by default · contains scopes · ~1h expiry

Scopes checked: pets/read, pets/write

ID Token

Identity claims (sub, email, name) · useful for user-specific routes

Request Flow

Client

JWT access token

→

API Gateway

Verify JWT signature, expiry & audience

→

Backend Integration

Lambda / HTTP / DynamoDB

Module 04 / Traffic & Caching

🚦 Throttling, Caching & Validation

Rate Limits · Stage Cache · Validators

⏱️ Throttling (Account + Route Level)

Steady-State Rate10,000 req/s

Burst Capacity5,000 req

Daily Capacity

864,000,000

requests / day at steady state

Excess Requests

HTTP 429

TooManyRequestsException

REST APIs also support per-route usage-plan throttling; HTTP APIs are limited to account-level throttling. Burst capacity is a token bucket: short spikes up to 5,000 requests are absorbed before 429s.

⚡ Stage-Level Cache (REST APIs)

Enable Cache

Cache TTL300s

Cache Capacity

Cache Key Parameters (comma-separated query strings)

Encrypt cache data (KMS)

Max refresh cycles/day: 288 · cached responses skip Lambda → lower cost & latency. HTTP APIs have no native cache — front them with CloudFront.

🧾 Request Validation

REST API request validators reject malformed requests before they reach your backend — a cheap first line of defense. Two modes:

validateRequestParameters

Checks required query strings, headers, and path parameters per the API model.

validateRequestBody

Validates the JSON body against a model schema (types, required fields, enums).

Routes marked VALIDATE in Module 02 are exported with a "full" validator — 2/3 currently.

Module 05 / Export

📜 OpenAPI Spec Generator

OpenAPI 3.0.1 · APIGW Extensions

The spec below is generated live from your routes, authorizers, and throttling/cache settings. It can be imported directly into API Gateway (REST or HTTP API) or shared with clients via aws apigateway import-rest-api.

API Name

94 lines · 3,054 chars

openapi.yaml — PetStore API

openapi: "3.0.1"
info:
  title: "PetStore Microservices API"
  version: "1.0.0"
  description: "Designed with SubnetLab API Designer. 3/3 routes protected · throttling 10,000 rps / burst 5,000 · cache TTL 300s (encrypted)."
servers:
  - url: "https://agmtgqi9me.execute-api.us-east-1.amazonaws.com/prod"
paths:
  /pets:
    get:
      summary: "GET /pets"
      operationId: "getPets"
      responses:
        200:
          description: "Successful GET response"
        400:
          description: "Invalid request parameters or body"
        500:
          description: "Internal server error"
      x-amazon-apigateway-integration:
        type: "aws_proxy"
        httpMethod: "GET"
        timeoutInMillis: 29000
        uri: "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:fnpetsHandler/invocations"
        cacheKeyParameters:
          - "method.request.querystring.version"
      security:
        - sigv4_auth: []
      x-amazon-apigateway-request-validator: "full"
    post:
      summary: "POST /pets"
      operationId: "postPets"
      responses:
        200:
          description: "Successful POST response"
        400:
          description: "Invalid request parameters or body"
        500:
          description: "Internal server error"
      x-amazon-apigateway-integration:
        type: "aws_proxy"
        httpMethod: "POST"
        timeoutInMillis: 29000
        uri: "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:fnpetsHandler/invocations"
      security:
        - cognito_user_pools: []
      x-amazon-apigateway-request-validator: "full"
  /pets/{petId}:
    delete:
      summary: "DELETE /pets/{petId}"
      operationId: "deletePetspetId"
      responses:
        200:
          description: "Successful DELETE response"
        400:
          description: "Invalid request parameters or body"
        500:
          description: "Internal server error"
      x-amazon-apigateway-integration:
        type: "aws_proxy"
        httpMethod: "DELETE"
        timeoutInMillis: 29000
        uri: "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:fnpetspetIdHandler/invocations"
      security:
        - lambda_authorizer: []
components:
  securitySchemes:
    sigv4_auth:
      type: "apiKey"
      name: "Authorization"
      in: "header"
      x-amazon-apigateway-authtype: "awsSigv4"
    lambda_authorizer:
      type: "apiKey"
      name: "Authorization"
      in: "header"
      x-amazon-apigateway-authtype: "custom"
    cognito_user_pools:
      type: "apiKey"
      name: "Authorization"
      in: "header"
      x-amazon-apigateway-authtype: "cognito_user_pools"
x-amazon-apigateway-request-validators:
  full:
    validateRequestBody: true
    validateRequestParameters: true
x-apigateway-throttling:
  rateLimit: 10000
  burstLimit: 5000
x-apigateway-cache:
  enabled: true
  ttlSeconds: 300
  capacityGb: 1.6
  encrypted: true

Deploy with AWS CLI

$ aws apigatewayv2 import-api --body file://openapi.yaml --protocol-type HTTP

$ aws apigateway create-rest-api --body file://openapi.yaml

API Security Posture

Live score across your whole API design

100% of routes protected (3/3) · 2 routes validated · caching on (encrypted) · throttling 10,000 req/s

93/100Strong

Authorizer coverage (40) · Validation (20) · Cache enabled (10) · Cache encryption (10) · Throttle sane (10) · All routes protected (10)

AWS Track • Observability & Reliability Engineering

CloudWatch & Full Observability Stack

Operate the complete AWS observability loop — simulated metric streams powering CloudWatch alarms and dashboards, log group inspection with live tails, and X-Ray distributed tracing service maps with waterfall trace analysis.

Metrics · stream-drivenAlarms · severity-gatedLogs · live tailX-Ray · trace mapDashboards · build your own

Module 1 • Metrics & Streams

Simulated Metric Streams & Animated Line Charts

Select Metric Stream

Stream characteristics

sampling: 1 point / 1.3s
window: last 48 points
storage: CloudWatch Metrics → unified namespace

EC2 CPUUtilizationavg 26.2 · min 0.0 · max 54.1

Latency

Requests

Errors

Network

KEY CONCEPTS:Metrics are time-ordered data points with dimensions ·CloudWatch collects from agents (EC2 / EKS), SDKs (Lambda), and service integrations (RDS, API GW) ·Graphs support period aggregation and statistical functions (avg, p99, sum).

Module 2 • Alarm Engine

Alarm Threshold Configuration & Severity Levels

STATE: OK

1. Metric & Operator

Threshold> 80 %

0100 %

Severity Level

Notify SNS Topic

arn:aws:sns:us-east-1:123456:ops-oncall

Auto Scaling Action

Scale out fleet /api/* on breach

CloudFormation Alarm Spec

{
  "OrdersAPICpuAlarm": {
    "Type": "AWS::CloudWatch::Alarm",
    "Properties": {
      "AlarmName": "prod-cpu-SEV2",
      "Namespace": "AWS/EC2",
      "MetricName": "EC2 CPUUtilization",
      "Statistic": "Average",
      "Period": 60,
      "EvaluationPeriods": 3,
      "DatapointsToAlarm": 2,
      "Threshold": 80,
      "ComparisonOperator": "GreaterThanThreshold",
      "TreatMissingData": "notBreaching",
      "AlarmActions": [
        "arn:aws:sns:us-east-1:123456789012:ops-oncall"
      ],
      "Tags": [
        {
          "Key": "severity",
          "Value": "SEV2"
        }
      ]
    }
  }
}

Current

32.5

Threshold

Evaluations

datapoints

Severity

SEV2

HIGH

Live Comparison — EC2 CPUUtilization vs Threshold

threshold current OK breachingHeadroom: 59.4%

Alarm History / State Transitions0 events

Waiting for a state change — adjust the threshold to trigger one.

HOW ALARMS WORK:CloudWatch evaluates the selected stat over consecutive periods ·missed datapoints → INSUFFICIENT_DATA ·alarm state triggers SNS / Auto Scaling / Lambda actions ·severity routes to the right on-call tier.

Module 3 • Logs

CloudWatch Log Groups & Stream Viewer

Log Groups (region: us-east-1)

Log groups collect streams from the same source. Retention policies (1 day – 10 years) control cost; log events expire after retention.

7 lines

/aws/lambda/orders-api

logStream: awslambdaordersapi/[LATEST]8f2b…3d31

17:34:59INFO START RequestId: 8f2b…d31 Version: $LATEST

17:34:59INFO POST /api/orders 201 — 61 ms — dynamodb:PutItem

17:34:59WARN Order validation retry (attempt 2) — idempotency key reused

17:34:59ERRORDynamoDB ConditionalCheckFailed — event raced with duplicate request

17:34:59INFO GET /api/orders?status=pending 200 — 34 ms

17:34:59DEBUGX-Ray trace segment closed: orders-api:processOrder 61.2ms

17:34:59ERRORTimeoutError: SQS SendMessage timed out after 3000ms (retry scheduled)

tailing…

CLOUDWATCH LOGS INSIGHTS:query language parses JSON fields, filters like fields @timestamp ·use metric filters to turn log patterns into alarms ·streams are appended-only, ~5KB per event limit.

Module 4 • Distributed Tracing

X-Ray Service Map & Trace Waterfall

Sampling: 1 in 10 traces

Service Map — /v1/ordersedges labeled: avg latency · error %

Orders APILambda

Avg latency: 61 ms
Error rate: 1.8 %
Instances: 5 concurrent

Core checkout path. Emits custom subsegments for validation + persistence.

instrumented: AWS SDK auto-tracing active

HOW IT WORKS: X-Ray propagates a trace ID across services via headers — X-Amzn-Trace-Id. Each hop records segments / subsegments with timestamps building the service map and waterfall; sampled traces keep overhead below 5%.

Recent Traces

POST /v1/orders — 84ms totaltrace id: 1-66b3f8a1-8f2b1c12a3d44e5f6a7b8c9

api-gateway: execute

4msOKauthorizer cached

auth-service: validateJwt

31msOK2 subsegments

users-table: GetItem

9msOKRCU=4.5

orders-api: placeOrder

49msOKλ 256MB

inventory-db: UpdateItem

24msOKconditional

order-queue: SendMessage

8msOKfifo=true

email-worker: render

6msOKasync path

Module 5 • Dashboards

CloudWatch Dashboard Widget Layout Builder

Auto refresh:

Widget palette

📈 Metric Graph

CPU %

Latency

1352

Requests

Errors

699

Network

Namespace: AWS/EC2refresh 15s

🚨 Alarm Tiles

CPU % thresholdOK

API latency thresholdSEV1

DB connectionsSEV2

Queue depthSEV3

Disk utilizationSEV4

🪵 Log Tail

34:59ERROTimeoutError: SQS SendMessage timed out after 3000ms

34:59DEBUX-Ray trace segment closed: orders-api:processOrder

34:59INFOGET /api/orders?status=pending 200 — 34 ms

34:59ERRODynamoDB ConditionalCheckFailed — event raced with d

34:59WARNOrder validation retry (attempt 2) — idempotency key

Observability Loop Cheat Sheet

Metrics

Collect → aggregate (avg/p95/sum) → store with retention. Agent-based + managed service integrations.

Alarms

Threshold + operator over N evaluation periods → OK / ALARM / INSUFFICIENT_DATA → SNS, Auto Scaling, Lambda actions.

Logs

Log groups per service, retention policies, Insights queries, and log-metric filters driving alarms.

X-Ray

Trace IDs flow through segments; service maps show latency/errors per edge; sampling keeps overhead low.

AWS · Secrets Manager & Parameter StoreSECURITY TRACK

🔐 Secrets Manager & Parameter Store — Secure Secret Lifecycle

Hierarchical parameters, KMS envelope encryption, automated rotation scheduling, cross-account trust policies, IAM evaluation, and versioned rollback with staging labels.

01 · Hierarchy Visualizer 02 · Rotation Scheduler 03 · Cross-Account Trust 04 · IAM Policy Evaluator 05 · Version History

01 · SSM Parameter Store

Secrets Hierarchy Visualizer

Path hierarchy with per-type encryption semantics — SecureString is envelope-encrypted with KMS, String / StringList are plaintext.

SecureStringStringStringList

$ aws ssm get-parameters-by-path --path / --recursive9 params

/prod/api/db/passwordSecureStringAdvanced Tierv12

Last Modified

2026-08-07 21:40 UTC

KMS Key

alias/aws/ssm

Value(decrypt requires kms:Decrypt + --with-decryption)

•••••••••••••••••

How to fetch this parameter

$ aws ssm get-parameter --name /prod/api/db/password --with-decryption

SecureString values are encrypted at rest with envelope encryption: the KMS customer/aws-managed key encrypts a data key, which encrypts the value. IAM must allow both ssm:GetParameter and kms:Decrypt on the key.

02 · Secrets Rotation

Rotation Schedule Configurator

Compose a rotation cadence, pick an execution window, and preview the exact schedule EventBridge will fire.

Rotation cadence

Preferred day (window)

Hour (UTC)

Rotation strategy

Generated schedule (EventBridge rule)

cron(0 3 1 * ? *)

1st of month, 03:00 UTC · Every 30 days

Upcoming rotation runsSCHEDULE ACTIVE

2026-09-01 03:00 UTC

rotation #1 · Every 30 days

T-24d

2026-10-01 03:00 UTC

rotation #2 · Every 30 days

T-54d

2026-11-01 03:00 UTC

rotation #3 · Every 30 days

T-85d

2026-12-01 03:00 UTC

rotation #4 · Every 30 days

T-115d

2027-01-01 03:00 UTC

rotation #5 · Every 30 days

T-146d

Rotation pipeline (alternating)

1Lambda creates a new secret version staged as AWSPENDING
2Database credentials are updated with the AWSPENDING value
3New version is tested against the live application
4AWSPENDING is promoted to AWSCURRENT
5Previous AWSCURRENT is relabeled AWSPREVIOUS for instant rollback
6AWSPENDING label is removed and the Lambda function completes

Rotation rule (Secrets Manager + EventBridge)

$ aws secretsmanager rotate-secret --secret-id prod/db/credentials \
    --rotation-rules "AutomaticallyAfterDays=30,ScheduleExpression=\"cron(0 3 1 * ? *)\""

{
  "ScheduleExpression": "cron(0 3 1 * ? *)",
  "State": "ENABLED",
  "Targets": [
    {
      "Arn": "arn:aws:lambda:us-east-1:123456789012:function:rotate-prod-db",
      "Id": "rotate-prod-db"
    }
  ]
}

03 · Cross-Account Access

Cross-Account Trust Policy Builder

Attach a resource-based policy to the secret so a role in another account can read it — the secret “trusts” the foreign principal.

Owner account

Consumer account

Consumer role name

Principal: arn:aws:iam::210987654321:role/app-prod-role

Confused-deputy guard (Condition)

Binds the grant to the exact role ARN — the strictest form of cross-account trust.

Actions granted to the consumer

✓ Policy valid — resource policy is attachable.

Why this works (4 steps)

Owner 123456789012—— resource policy ——▶app-prod-role @ 210987654321

1. The consumer role assumes/uses its role in its own account — IAM “trust” is always intra-account.

2. The secret's resource policy (below) grants the foreign principal ARN access — cross-account trust.

3. The secret's KMS key policy must also allow the same principal to kms:Decrypt — two policies, both required.

4. The consumer SDK call targets the secret ARN with a cross-account role session; AWS authorizes against both policies.

Generated resource-based policy (trust policy)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCrossAccountSecretAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::210987654321:role/app-prod-role"
      },
      "Action": [
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret"
      ],
      "Resource": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db/credentials-AbC12d",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalArn": "arn:aws:iam::210987654321:role/app-prod-role"
        }
      }
    }
  ]
}

Attach with: aws secretsmanager put-resource-policy --secret-id prod/db/credentials --resource-policy '{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCrossAccountSecretAccess", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::210987654321:role/app-prod-role" }, "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Resource": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db/credentials-AbC12d", "Condition": { "StringEquals": { "aws:PrincipalArn": "arn:aws:iam::210987654321:role/app-prod-role" } } } ] }'

04 · IAM Authorization

IAM Policy Evaluator for Secrets Access

Simulate an API request against an attachable identity policy — explicit Deny always wins, a matching Allow grants access, and everything else is implicitly denied.

Identity policy preset

Requested action

Resource ARN

Request context (satisfied conditions)

Authorization decision✔ ALLOW

An explicit Allow statement matched the action and resource, and every required condition was satisfied.

Statement-by-statement analysis — Least-Privilege Read

AllowGetSecretValueAPPLIES (ALLOW)

Action and resource match; all conditions satisfied — statement applies.

action: matchresource: matchconditions: ok

Evaluation order: identity policies → resource policies → IAM boundary → SCP → session policy. Any explicit Deny anywhere wins; a missing Allow is an implicit deny. Wildcard matches like secretsmanager:* are honored.

05 · Secret Provenance

Version History Viewer

Staging labels route clients: AWSCURRENT is the live value, AWSPREVIOUS enables instant rollback. arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db/credentials-AbC12d

Rotation: ON (30d)KMS: alias/aws/secretsmanager

Version: b48f912c-9011-411a-8e3d-7c2a1f9d4e66

Created: 2026-08-08 09:12 UTC · AWS Lambda rotation (rotate-prod-db)

{
  "username": "db_admin",
  "password": "••••••••••",
  "host": "db-1.prod.internal",
  "port": 5432,
  "engine": "postgres"
}

$ aws secretsmanager get-secret-value --secret-id prod/db/credentials --version-id b48f912c --version-stage AWSCURRENT

Best practice recap: Prefer Secrets Manager for values that rotate or need audit history; use Parameter Store for config. Always scope policy statements to a single secret ARN, require TLS + MFA for access, and enable rotation with a tested Lambda so stale credentials never outlive their expiry.

Module 01 / Transit Gateway & Hybrid Networking

🌐 AWS Transit Gateway & the Hybrid Network

Gateway Type:TGW · Route 53 · DX · VPN

A Transit Gateway lets you connect VPCs, VPN tunnels, and Direct Connect virtual interfaces through one centrally-managed hub — replacing the non-transitive mesh of VPC peering connections. This module builds a live multi-VPC topology, detects CIDR overlaps, configures redundant IPsec tunnels, inspects route tables, and maps the Direct Connect path into the cloud.

🔗1:1 pairing

VPC Peering

Two VPCs, simple needs

Non-transitive · no transitive routing

🧭hub & spoke

Transit Gateway

Many VPCs, cross-account, hybrid

Costs per attachment + GB processed

🔐over the internet

VPN (IPsec)

Quick hybrid link, encrypted

~100 Mbps per tunnel, internet-dependent

⚡private line

Direct Connect

Stable, low-latency, high-bandwidth

Weeks of physical provisioning

Feature Comparison — TGW vs Peering vs VPN vs Direct Connect

Capability	VPC Peering	Transit Gateway	Site‑to‑Site VPN	Direct Connect
Transitive routing	✗ no	✓ central hub	– per tunnel	– per VIF
Cross-account / cross-region	✓ accounts (peer role)	✓ via Resource Access Manager, optional cross-region	✓ to CGW anywhere	✓ DX Gateway
Max scale (practical)	125 peering conx / VPC	hundreds of attachments	~50 Mbps/Gbps tunneled	1–100 Gbps ports
Latency	low (direct VPC path)	adds 1–2 ms hop	internet fabric + ~30 ms	single-digit ms private
Bandwidth	up to ~1.4 Gbps / peer	aggregated over SD-WAN 100 Gbps	bandwidth of each tunnel	up to 100 Gbps / 10 × VIFs
Cost model	per GB for implicitly grouped	$0.02/GW-hr per attachment + per-GB	per-hour per-tunnel	port-hour + $0.02/GB egress
Propagates routes	no (manual route tables)	✓ BGP-style propagation	✓ BGP session per tunnel	✓ BGP over VLAN (transit VIF)

Module 02 / VPC Topology Visualizer

🕸️ Drag-to-Connect Topology Builder

Pick a connection type, then drag from a colored handle on one network to another to build peering, TGW, VPN and Direct Connect links. All nodes are draggable; overlapping CIDRs on linked networks are flagged in red.

TGW attach

VPC Peering

VPN tunnel

Direct Connect

Transit Gateway-

Production VPC10.0.0.0/16

Development VPC10.1.0.0/16

Shared Services VPC10.2.0.0/16

Partner VPC (cross-account)10.0.1.0/24RAM-shared acct

On-premises DC172.16.0.0/16

Direct Connect Gateway-

TGW attachVPC PeeringVPN tunnelDirect Connect

⚠ CIDR conflict: 10.0.1.0/24 (Partner VPC (cross-account)) overlaps 10.0.0.0/16 (Production VPC) — ambiguous routes will Blackhole until resolved.

Connection type

Links (7)

TGW attach Production VPC ↔ Transit Gateway

TGW attach Development VPC ↔ Transit Gateway

TGW attach Shared Services VPC ↔ Transit Gateway

TGW attach Partner VPC (cross-account) ↔ Transit Gateway

VPC Peering Production VPC ↔ Development VPC

VPN tunnel On-premises DC ↔ Transit Gateway

Direct Connect Direct Connect Gateway ↔ Transit Gateway

VPC CIDR assignments

Production VPC

Development VPC

Shared Services VPC

Partner VPC (cross-account)

On-premises DC

Overlapping CIDRs on networks that share a path (directly or via the hub) light up red on the canvas — the TGW would Blackhole those routes.

Module 03 / IP CIDR Overlap Detector

📐 Overlap & Collision Detector

Networks that overlap cause ambiguous-routing / Blackhole behavior in both VPC route tables and on-prem routers. Add your network plan and this tool computes the exact collision range for every pair.

Network inventory

Production VPC

10.0.0.0/16 · 10.0.0.0 – 10.0.255.255 · 65,534 usable

Dev VPC

10.1.0.0/16 · 10.1.0.0 – 10.1.255.255 · 65,534 usable

Shared Services

10.2.0.0/24 · 10.2.0.0 – 10.2.0.255 · 254 usable

Partner VPC

10.0.1.0/24 · 10.0.1.0 – 10.0.1.255 · 254 usable

On-prem DC

172.16.0.0/16 · 172.16.0.0 – 172.16.255.255 · 65,534 usable

Pairwise overlap results1 COLLISION

Production VPC with Partner VPCCONTAINS

10.0.0.0/16 ∩ 10.0.1.0/24 → shared range 10.0.1.0 – 10.0.1.255

One network is fully inside the other — the larger wins on longest-prefix-match.

Tools to renumber instead of colliding: supernet the shared range, or split with more specific prefixes so the longest-prefix-match decides deterministically.

Module 04 / Site-to-Site VPN Tunnel Configurator

🔐 AWS Site-to-Site VPN Builder

Generate a production-shaped dual-tunnel VPN (tunnel A + tunnel B) with IKE/IPSec phase settings and optional BGP failover. Wrong crypto values produce a classic "Phase 1 mismatch" — so build carefully.

Customer Gateway (on-prem side)

CGW public IP

BGP ASN (CGW)

On-premises CIDR (advertised)

IKE & IPsec policies (both tunnels inherit)

Phase 1 encryption

Integrity

DH group

Phase 1 lifetime (sec)

Dead Peer Detection (20s)BGP over VPN

Tunnel endpoints

Tunnel A inside CIDR

Tunnel B inside CIDR

Active path:failover demo — routes flip on failure

Generated VPN summarydemo-only, no real secrets

=== AWS Site-to-Site VPN · Generated Device Configuration ===
Customer Gateway (CGW)
  Public IP      : 203.0.113.10
  BGP ASN        : 65000
  On-prem CIDR   : 172.16.0.0/16

Tunnel A (primary)
  Inside CIDR    : 169.254.10.0/30
  AWS side IP    : 169.254.10.1
  CGW side IP    : 169.254.10.2
  Phase 1 (IKE)  : AES256-SHA256, DH group 14, lifetime 28800s
  Phase 2 (IPsec): AES256-SHA256, DH group 14 (PFS), lifetime 3600s
  DPD            : enabled (restart)
  BGP over VPN   : enabled
  PSK (demo only): TgM_…cret

Tunnel B (redundant)
  Inside CIDR     : 169.254.11.0/30
  AWS side IP    : 169.254.11.1
  CGW side IP    : 169.254.11.2
  Same IKE/IPsec profile; independent endpoint (203.0.113.10 secondary)

Route propagation: 172.16.0.0/16 → TGW route table via VPN attachment
Status           : Tunnel A ACTIVE · Tunnel B STANDBY

Tunnel AACTIVE

169.254.10.0/30 · 169.254.10.2 peer

BGP AS 65000 ↔ 64512 · primary peer

Tunnel BSTANDBY

169.254.11.0/30 · 169.254.11.2 peer

BGP AS 65000 ↔ 64512 · backup peer

AWS terminates the tunnel on two endpoints for HA. BGP (multi-VPN) detects the down path and rewrites routes within seconds — avoid pure static routing for production.

Module 05 / Route Table Viewer

🧭 Route Table & Propagation Viewer

Inspect how routes flow through VPC main tables, the TGW hub, and VPN attachments. Toggle propagation and add static routes — conflicting prefixes with mismatched targets turn BLACKHOLE.

VPC Main Route Table

Production VPC · region us-east-1

Propagate attachments

The local VPC route is always present. Static + propagated routes decide how traffic leaves the VPC.

Destination	Target	Type	Status
10.0.0.0/16	Local	LOCAL	BLACKHOLE
10.1.0.0/16	Transit Gateway Attach — vpc-dev	PROPAGATED	ACTIVE
10.2.0.0/16	Transit Gateway Attach — shared-vpc	PROPAGATED	ACTIVE
10.0.1.0/24	Transit Gateway Attach — partner-vpc	PROPAGATED	BLACKHOLE
172.16.0.0/16	VPN Attachment (TGW)	PROPAGATED	ACTIVE

⚑ BLACKHOLE: overlapping prefixes with different targets cause the route to drop packets until the duplicate is removed (longest-prefix-match cannot pick a winner).

Add static route (this table)

Table stats

Routes

Active

Propagated

Blackhole

TGW route tables also learn cross-account prefixes from RAM-shared attachments — the partner VPC route above is one example.

Longest-prefix-match rules

More specific wins: /24 beats /16 for the same destination.

Equal prefix + different target → BLACKHOLE.

Local route always outranks TGW for the VPC's own CIDR.

Module 06 / Direct Connect Integration

⚡ Direct Connect Network Diagram

A dedicated private path bypasses the internet on the way into AWS. Configure the port, the virtual interface (VIF), and watch the BGP session light up.

Connection type

Port speed

Virtual interface

AWS region / DX location

On-premises

Customer router · AS 65000

BGP peer · VLAN 1523

→BGP

DX Location

Colocation cage + cross-connect

POP: Equinix DC2

→BGP

AWS DX Network

Virtual interface · Transit VIF

VLAN 1144 · transit VIF

→BGP

Transit Gateway

tgw-0f2a1b9c

Attach: prod/partner

→BGP

VPC attachments

prod · dev · shared

BGP: 10.0.0.0/16 + 10.0.1.0/24

10 Gbps dedicated

Port

~$1,620/mo

Port charge (approx, 2.25/hr)

2 ms

P95 latency to us-east-1

TGW

Transit VIF (up to 100 Gbps)

BGP session (Internet-facing side of the VIF)ESTABLISHED

Peer: 169.254.4.1 (AWS)

Local ASN: 65000

Advertised: 172.16.0.0/16 (on-prem)

Learned: 10.0.0.0/16, 10.1.0.0/16, 10.2.0.0/16

🔒

AWS recommends MACsec on dedicated connections for link-layer encryption, and always transport the VIF over a VPN or private network when regulatory requirements demand it — DX itself is not encrypted at L2 by default.

🔄

For mission-critical, keep a second DX connection at a different location — BGP multipath + failover keeps the route table healthy.

AWS Elasticity & Traffic Engineering Track

Auto Scaling & Load Balancer Deep Dive

Production-grade elasticity: configure ALB path-based routing, compare ALB vs NLB, simulate target group health checks, build target-tracking / step / predictive scaling policies, and watch a live Auto Scaling group react to traffic in real time.

✓ Path-Based Routing✓ Health Check Sim✓ Predictive Scaling

Module 01 / Listener Rules

🔀 ALB Path-Based Routing Configurator

Listener :443 · Rules evaluated in priority order

An Application Load Balancer evaluates incoming requests against listener rules from lowest priority number upward. The first rule whose condition matches wins and routes the request to its target group — no fall-through. Path patterns support a single trailing wildcard (/api/*).

➕ Add Listener Rule

Path Pattern

Forward To

Priority	Condition (Path Pattern)	Action → Target Group	Port / Proto
1	/api/*	API-TG	HTTP :8080
2	/admin/*	ADMIN-TG	HTTP :3000
3	/static/*	STATIC-TG	HTTPS :443
4	/ (default)	WEB-TG	HTTP :80

🧪 Live Route Tester

Incoming Request Path

4 rules evaluated in priority order

✓ Rule Matched

Request /api/users/42 matched pattern /api/*

API-TGHTTP :8080 · 4 registered

Request Flow

🌐 Client→ALB :443→Rule Engine→Target Group→EC2 / ECS / Lambda

API-TGWEB-TGSTATIC-TGADMIN-TG

Module 02 / Load Balancer Selection

⚖️ NLB vs ALB — Which One Do You Need?

Layer 4 vs Layer 7

ALB · Layer 7

Application

• HTTP / HTTPS / HTTP/2 / gRPC / WebSocket
• Routes on path, host, header, query string
• TLS termination with ACM certificates
• Targets: EC2, IP, Lambda, ECS, EKS
• Deep HTTP health checks + WAF integration
• Cookie sticky sessions, redirects, auth

NLB · Layer 4

Transport

• TCP, UDP, TLS passthrough (no content inspection)
• Static IP per AZ — ideal for allow-listing
• Extreme throughput, sub-millisecond latency
• Preserves client source IP end to end
• Scales with millions of connections (long-lived)
• Source-IP stickiness for UDP / WebSocket

Feature	Application Load Balancer (L7)	Network Load Balancer (L4)
OSI Layer	Layer 7 (Application)	Layer 4 (Transport)
Protocols	HTTP, HTTPS, HTTP/2, gRPC, WebSocket	TCP, UDP, TLS passthrough
Static IPs	No — DNS name only	Yes — one static IP per AZ
TLS termination	Yes — ACM certificates	No — passthrough (offload on targets)
Content-based routing	Path, host, header, query, method	None — flow based on IP + port
Sticky sessions	Yes — cookie-based	Yes — source IP based
Health checks	Deep HTTP/HTTPS (path, status codes)	TCP or simple HTTP probe
Target types	Instances, IPs, Lambda, containers	Instances, IPs
Best for	Microservices, K8s ingress, serverless, canaries	UDP gaming, legacy TCP, extreme throughput, VPC endpoints

🧭 Workload Advisor — what would you deploy?

Recommendation: ALB

Web storefront: HTTPS + WAF, path-based routing to microservices, cookie sticky sessions, canary deploys.

Content-based routing (path / host / query), TLS termination with ACM, cookie stickiness and WAF integration are all Layer-7 features. ALB is the right call.

Module 03 / Target Group Health

💚 Target Group Health Check Simulator

Interval · Thresholds · Timeout

The load balancer probes each registered target at the configured interval. A target is marked unhealthy only after unhealthy threshold consecutive failures — it then enters draining, finishes in-flight requests and is deregistered. A deregistered target can return to service after healthy threshold consecutive successes.

Health Path

Interval (s)

Unhealthy Threshold

Healthy Threshold

Timeout (s)

Tick #0Est. deregistration: 3 × 30s = 90s

Instance	AZ	Status
i-0a1f2b	us-east-1a	InService
i-0b3c4d	us-east-1b	InService
i-0c5e6f	us-east-1c	InService
i-0d7a8b	us-east-1a	InService

Checks Run

Pass Rate (last 12)

In Service

4/4

Probe

GET /health · 5s timeout

Module 04 / Auto Scaling Policies

📈 Scaling Policy Builder

Target Tracking · Step Scaling · Predictive

Min Instances

Max Instances

Desired Capacity

Metric

Target Value: 50%

Current Fleet Utilization: 62%

Allow scale-in (lower capacity when metric drops)

📐 Capacity Math — keep CPUUtilization at 50%

required = ⌈ 62% ÷ 50% ⌉ = 2 instances

desired capacity: 3 · range [1 – 10]

SCALE IN -1 → 2

Target tracking works like a thermostat: CloudWatch polls the metric, computes the capacity needed to bring it back to the target, and adjusts the desired count — with a warm-up window after each scale-out so new instances can finish booting before the next evaluation.

📄 Policy Summary

Policy: TargetTrackingScaling

Metric: aws/ec2 CPUUtilization · Target: 50% · Scale-in: enabled

Group: min 1 · max 10 · desired 3

Now: utilization 62% → required 2 → scale in -1

Module 05 / Auto Scaling Group

🖥️ Live Instance Count Visualization

ASG: demo-app · us-east-1

Watch an Auto Scaling group react to a synthetic load. The group scales out when load crosses 78%, scales in below 28%, and respects a 2-tick cooldown between actions. New instances boot (Launching → InService); removed instances drain before termination.

Min

Max

Desired Capacity

Desired Capacity3 / 8 max · min 2

min

Synthetic Load45%

scale in ≤ 28%scale out ≥ 78%

Fleet (3 registered)

i-0a1f2b3c

us-east-1a

InService

i-0b3c4d5e

us-east-1b

InService

i-0c5e6f7a

us-east-1c

InService

📜 Auto Scaling Activity Log

17:34:59

Auto Scaling group initialized: desired 3 · min 2 · max 8

AWS Auto Scaling & Elastic Load Balancing · ELB v2 · ASG lifecycle: Pending → InService → Draining → Terminating

AWS Well-Architected Framework Review

Well-Architected Review & Maturity Radar

Self-assess your architecture against the six AWS Well-Architected pillars. Answer each question honestly — Yes, Partial, or No — and get a weighted maturity score, a radar chart of your posture, and prioritized improvement recommendations.

✓ 6 Pillars✓ Weighted Scoring✓ Radar Analysis✓ Action Plan

Module 01 / Maturity Scorecard

📊 Weighted Pillar Scores & Radar Chart

Overall Maturity:INITIAL

0/ 100

INITIAL

Weighted across pillars (Security & Reliability weighted 1.2×)

Progress: 0 / 24 questions answered0%

0 Action Items

🏆

OUTSTANDING — NO IMPROVEMENT ITEMS DETECTED

Every question was answered Yes. Re-run the review with honest, real-world answers to uncover gaps — no architecture is perfect.