Networking on AWS

Networking is the plumbing every other AWS service runs on. On DOP-C02 it is never the headline topic — there are no subnetting drills — but it is the hidden requirement inside deployment, automation, and troubleshooting scenarios: the pipeline that can't pull images, the Lambda that times out, the two accounts that need to talk.

The Mental Model

Every connectivity problem decomposes into three independent layers, checked in order:

1. Route — is there a path at all? Route tables, gateways, peering, endpoints.
2. Security — is the path allowed? Security groups, NACLs, endpoint policies.
3. Resolution — does the name point to the right place? VPC DNS, private hosted zones, Resolver rules.

A fix lives in exactly one layer. Exam questions usually tell you which layer is already fine ("DNS resolves but the connection times out") so you can jump straight to the broken one.

The Cast of Characters

• VPC Peering — a private wire between exactly two VPCs
• Transit Gateway — a hub connecting many VPCs, VPNs, and Direct Connect
• PrivateLink / VPC endpoints — private doorways to a single service, no network merging required
• Route 53 Resolver — DNS inside the VPC, and the bridge to on-premises DNS
• Site-to-Site VPN / Direct Connect — the two roads back to the data center

Why It Matters for DOP-C02

Three of the six domains lean on networking: resilient architectures (Route 53 failover, multi-AZ paths), incident response (Flow Logs, Reachability Analyzer), and every "private subnet" automation scenario (SSM endpoints, private pipelines pulling from ECR). The pattern to internalize: when a "choose three" answer set has two IAM-ish options, the third is almost always the network layer.