AWS Networking Services Portfolio
AWS Networking Services
From VPC and DNS to hybrid connectivity, traffic distribution, edge, network security, and observability. Each service gets one page covering its key concepts, main features, reference architectures, and cost components.
Network Security
Application Networking
Edge Networking
Hybrid Networking
Foundation
Network Observability
Select a service to open its details page. Dashed items are coming soon.
Application Networking
Application Networking
Load balancing and service-to-service connectivity
Application Load Balancer
Routes HTTP, HTTPS, and gRPC requests by path, host, and header rules, and handles authentication and rewrites at the listener.
listener ruleOIDC · JWTLambdaLearn moreL4 load balancingNetwork Load Balancer
Accepts TCP, UDP, TLS, and QUIC on a static IP per AZ and distributes it with ultra-low latency. Also fronts PrivateLink services.
static IPTLS · QUICPrivateLinkLearn moreAppliance insertionGateway Load Balancer
Transparently inserts firewall and IDS appliances into the traffic path with GENEVE and scales them out.
GENEVE 6081GWLB endpointflow stickinessLearn moreService-to-serviceVPC Lattice
Connects services across accounts and VPCs and controls access per request.
service networkauth policyLearn moreAPI managementAPI Gateway
Runs REST, HTTP, and WebSocket APIs with authorization and throttling.
RESTHTTPWebSocketLearn moreEdge Networking
Edge Networking
Deliver content and accelerate traffic close to users
Hybrid Networking
Hybrid Networking
Connectivity between VPCs, Regions, on-premises sites, and remote users
Transit Gateway
Attaches VPCs, VPNs, and Direct Connect to one hub and segments the network with route tables.
attachmentroute tablepeeringLearn moreGlobal WANCloud WAN
Declares a multi-Region network in a single policy and operates it by segment.
core networksegmentpolicyLearn morePrivate service accessPrivateLink
Brings only the services you need into your VPC on private IPs, with no internet exposure.
interface endpointendpoint serviceLearn moreDedicated connectionDirect Connect
Connects your data center to AWS over a dedicated physical link for consistent bandwidth and latency.
dedicatedVIFBGPLearn morePrivate cloud-to-cloudAWS Interconnect – multicloud
Links AWS directly to Google Cloud, OCI, and Azure (preview) with managed dedicated bandwidth.
Google CloudOCIMACsecLearn moreManaged last mileAWS Interconnect – last mile
Connects data centers and branch offices to AWS over carrier circuits as a managed service.
Lumen1–100 Gbps99.99% SLALearn moreIPsec VPNSite-to-Site VPN
Connects sites with two IPsec tunnels over the internet or Direct Connect.
IPsecBGPAccelerated VPNLearn moreRemote user accessClient VPN
Securely connects user devices to your VPC with certificate, AD, or SAML authentication.
OpenVPNSAMLsplit tunnelLearn moreFoundation
Foundation
The starting point: build a private network and resolve names
Network Security
Network Security
Inspect and protect traffic at the network and application layers
Network Firewall
Performs stateful inspection of VPC traffic with Suricata-compatible rules.
statefulTLS inspectionLearn moreWeb application firewallAWS WAF
Inspects HTTP requests to CloudFront, ALB, and API Gateway against rules.
web ACLmanaged rulesrate-basedLearn moreDDoS protectionAWS Shield
L3/L4 DDoS protection applies by default; Advanced adds L7 mitigation and SRT support.
StandardAdvancedSRTLearn moreCentral policy managementAWS Firewall Manager
Applies and audits firewall, WAF, and security group policies across your entire organization in Organizations.
Organizationsauto remediationcomplianceLearn moreNetwork Observability
Network Observability
Traffic logging, path analysis, workload performance, and network-wide monitoring
VPC Flow Logs
Records metadata for IP traffic through VPCs, subnets, ENIs, and transit gateways.
ACCEPT/REJECTS3 ParquetLogs InsightsLearn moreConnectivity diagnosticsReachability Analyzer
Analyzes configuration without sending packets to find where a path is blocked and why.
hop-by-hopNetwork Access AnalyzerLearn moreGlobal network operationsNetwork Manager
Views transit gateways, Cloud WAN, and on-premises sites as one global network.
topologyroute analysislatencyLearn moreWorkload TCP performanceCloudWatch Network Flow Monitor
Collects retransmissions, timeouts, and RTT from real TCP flows and determines whether degradation is caused by the AWS network.
eBPF agentNHIEC2 · EKSLearn moreService finder
Which service for which need
For common requirements, this table lists the service to start with, why, and related services or alternatives to evaluate. Real designs combine several services.
| If you need | Start with | Why this service | Also consider |
|---|---|---|---|
| Foundation | |||
| Multi-AZ subnets with internet and NAT egress | Amazon VPC | Place public and private subnets in each AZ and send outbound traffic through a NAT gateway (zonal or regional mode). | IPAM for CIDR planning, Network Firewall for egress inspection |
| DNS resolution between on-premises and VPCs | Route 53 Resolver | The endpoint depends on query direction: on-premises → AWS uses an inbound endpoint; AWS → on-premises uses an outbound endpoint and forwarding rules. | Transport over Direct Connect · VPN |
| Domain-level traffic distribution and Regional failover | Route 53 | Latency, weighted, and failover routing policies with health checks choose which endpoint answers. | Global Accelerator for fast failover independent of DNS caching |
| Hybrid Networking | |||
| Routing many VPCs and accounts within a Region | Transit Gateway | Attach VPCs, VPNs, and DX to one hub and segment with route tables. No peering mesh as the number of VPCs grows. | VPC peering for just a few VPCs |
| A policy-driven global WAN across Regions and branches | Cloud WAN | Declares segments and inter-Region routing in a single JSON policy. The more Regions and segments, the bigger the payoff. | TGW peering for few Regions, Network Manager for operational visibility |
| Dedicated connectivity to a data center with consistent bandwidth and latency | Direct Connect | A dedicated link that bypasses the internet handles bulk transfer reliably at a lower DTO rate. Supports MACsec encryption. | Site-to-Site VPN as a backup path |
| Encrypted site-to-site connectivity, fast | Site-to-Site VPN | Brings up two IPsec tunnels over the internet right away and exchanges routes with BGP. | Private IP VPN over DX for encryption on a dedicated link |
| Private dedicated connectivity to another cloud | Interconnect – multicloud | Connects to Google Cloud and OCI (Azure in preview) by choosing a bandwidth, with no circuits or routers to configure. On the AWS side it attaches to a Direct Connect gateway. | Direct Connect or VPN to build it yourself |
| Connecting data centers and branches to AWS over carrier circuits | Interconnect – last mile | A managed last mile where the carrier (such as Lumen) handles the circuit through to the DX port. Choose a bandwidth from 1–100 Gbps. | Direct Connect if you procure circuits yourself |
| VPC access for remote and external users | Client VPN | Users connect with an OpenVPN-based client and authenticate with AD, SAML, or certificates. Authorization rules narrow what they can reach. | Site-to-Site VPN for branch-level connectivity |
| Sharing services across accounts with overlapping CIDRs | PrivateLink | Exposes a single service as an interface endpoint in the consumer VPC. It is unidirectional, so IP ranges can overlap. | VPC Lattice to group many services under policy |
| Application Networking | |||
| Connecting microservices spread across accounts with per-request authorization | VPC Lattice | Groups services in a service network without VPC-to-VPC connectivity, and controls access per request with IAM auth policies. | PrivateLink to expose a single service |
| L7 distribution of web and API traffic | Application Load Balancer | Handles path-, host-, and header-based routing, OIDC authentication, JWT verification, and URL rewrites in listener rules. Containers and Lambda can be targets. | API Gateway for external API management |
| TCP and UDP services that need static IPs | Network Load Balancer | Provides a static IP per AZ (Elastic IPs can be assigned) and distributes per connection with low latency. Preserves client IPs. | Global Accelerator for global anycast IPs |
| Inserting third-party firewalls into the traffic path | Gateway Load Balancer | Set a GWLB endpoint as the next hop in a route table and the appliance fleet receives and inspects traffic over GENEVE. | Network Firewall as the managed alternative |
| Publishing APIs externally with authentication and throttling | API Gateway | Runs REST, HTTP, and WebSocket APIs with authorizers, usage plans, and throttling. | AWS WAF for request filtering |
| Edge Networking | |||
| Fast global delivery of static and dynamic content | CloudFront | Edge caching reduces origin load and latency, and OAC keeps S3 origins private. | AWS WAF · Shield for edge protection |
| Static IPs and acceleration for TCP/UDP gaming and IoT traffic | Global Accelerator | Static anycast IPs take users in at the nearest edge and carry traffic over the AWS backbone; health checks switch endpoints quickly. | CloudFront for HTTP content caching |
| Network Security | |||
| Inspecting traffic in, out of, and between VPCs | Network Firewall | Provides managed Suricata-compatible stateful rules, domain and URL filtering, and TLS inspection. Can attach directly to a TGW. | GWLB for third-party appliances |
| Blocking SQL injection, bots, and excessive requests | AWS WAF | Evaluates HTTP requests in front of CloudFront, ALB, and API Gateway with managed rules, rate-based rules, and Bot Control. | Anti-DDoS rule group · Shield Advanced for L7 DDoS |
| Large-scale DDoS response and cost protection | Shield Advanced | Adds Shield Response Team support and cost protection on top of automatic L3/L4 mitigation. | Place CloudFront · Route 53 in front |
| Applying the same firewall and WAF policies across many accounts | Firewall Manager | Declares security policies across your organization, applies them automatically to new accounts and resources, and checks compliance. | Target services Network Firewall · WAF |
| Network Observability | |||
| Finding why a security group blocked traffic, and auditing traffic | VPC Flow Logs | Records ACCEPT and REJECT entries for ENIs, subnets, and TGWs, queryable with Athena or Logs Insights. | Reachability Analyzer to diagnose configuration causes |
| Diagnosing why two resources can't communicate | Reachability Analyzer | Analyzes configuration without sending packets and pinpoints the component blocking the path and why. | Network Access Analyzer to detect unintended access |
| Operating topology and routes for multi-Region TGW and Cloud WAN | Network Manager | Shows topology, route analysis, events, and AWS backbone latency in one global network. | Flow Logs for traffic records |
| Determining whether latency or packet loss between workloads is caused by the AWS network | Network Flow Monitor | Delivers retransmissions, timeouts, and RTT of real TCP flows, plus whether AWS is the cause (NHI), as CloudWatch metrics and alarms. | Network Synthetic Monitor for on-premises paths, Flow Logs for flow records |