o   VPC with a Single Public Subnet
o   VPC with Public and Private Subnets
o   VPC with Public and Private Subnets and Hardware VPN Access
o   VPC with a Private Subnet Only and Hardware VPN Access

o   Allows you to connect a subnet in 1 VPC to another subnet in another VPC.
o   There peering happens through private IP address as if all are on the same private subnet.
o   Peering can happen with VPC in other AWS account.
o   Peering happens within the single region.
o   For Peering to happen, there shouldn’t be any CIDR block overlapping or matching, e.g. VPC ‘A’ with IP 10.0.0.0/16 can’t peer with VPC ‘B’ with IP 10.0.0.0/24.
o   No transitive peering, means in the below diagram B cannot talk to C, for the talk between B and C to happen either it has to be done through ‘A’ or by peering between B and C

o   Custom Network Access Control List denies everything by default while default NACL and Security Group allows everything by default.
o   NACL is stateless (means any inbound traffic rule is not allowed by default in outbound) while SG is stateful.
o   1 subnet can be associated with only 1 NACL but 1 NACL can have multiple subnets. Let's say 1 NACL has deny rule for 1 particular traffic and other NACL has allow rule for the same traffic on the same rule number, then there will be conflict if these 2 are attached to the same subnet.
o   NACL is evaluated in numerical order as defined in “Rule#”, so if Rule# 99 has HTTP(8) with deny from my PC IP and Rule# 100 has HTTP(8) with allow from all then access to the associated subnet wouldn’t be allowed while if Rule# 101 has HTTP(8) with deny from my PC IP and Rule# 100 has HTTP(8) with allow from all then access to the associated subnet would be allowed.

o   With VPC, you can create public facing subnet and have your EC2 instances deployed, which has got the web application and at the same time, you can define a private subnet, where you can deploy your DB.
o   Any subnet created will be private by default.
o   Whenever we create the subnet, it gives 5 less than the expected CIDR IP machines.

o   It captures the information about the IP traffic going to and from N/W interfaces in your VPC.
o   It can be viewed in Cloud Watch logs.
o   It can be created in the 3 following levels:
 VPC
 Subnet
 N/W Interface
o   Flow logs for the VPC, which is peered to another VPC, can be enabled if both the VPC are in the same AWS A/C.
o   After the flow log is created, the configuration like IAM Role, Group etc can’t be changed.
o   Following traffic is not monitored:
 Traffic to and from 169.254.169.254 (For instance meta data)
 Traffic to the reserved IP address for the default VPC router.
 DHCP traffic
 Traffic generated by windows instance for Amazon Windows license Activation.
 Traffic generated by instances when they contact Amazon DNS server.

o   While creating NAT instances, disable source/destinations checks on the instances.
o   It must be on the public subnet.
o   There must be a route of the private subnet to the NAT instances, in order for this to work.
o   The amount of traffic NAT instances can support, depends upon the instance size.
o   NAT instance in a public subnet in your VPC to enable instances in the private subnet to initiate outbound IPv4 traffic to the Internet or other AWS services, but prevent the instances from receiving inbound traffic initiated by someone on the Internet.

o   Amazon S3 buckets
o   HTTP or web servers hosted in EC2 or in your private web servers

o   Web Distribution: websites
o   RTMP: Media Streaming

o   Name of the server that supplied the data
o   TTL for domain name to ip address list.

o   When you type address (e.g vikash.com), it looks for the IP address.
o   If ISP didn’t cache the IP address, it goes to .com.
o   On querying to .com, it provides following information:
 URL: Vikash.com
 TTL
 NS (Name Server): ns.awsdns.com
o   The NS provides “A” (Address) record.
 “A” record is used by computer to translate domain name to IP address.

o   “A” Record
o   CNAME (Canonical Name) is a mapping of one domain name to another domain name. E.g. m.vikash.com <=>  mobile.vikash.com
o   Alias Record: it’s used to map domain names to ELB, Cloud Front Distribution or S3 buckets.
o   CNAME is not applicable for naked domain name (e.g. vikash.com), it’s applicable for (m.vikash.com), while Alias record is applicable for naked domain name.

o   NS
o   SOA
o   A
o   CNAMES
o   MX Records
o   PTR Records

o   Simple Routing Policy
 A domain name can be assigned with multiple IP address (e.g. EC2 public IP address)
 In the runtime, it can pick any of the IP addresses (EC2 instance) randomly.
 It comes under ‘A’ record.
 Only one ‘A’ record can exist (but mapped to multiple IP addresses)
o   Weighted Routing Policy
 You can assign the weightage (%) to the record.
 It gets created as ‘A’ record.
 One record will have only 1 IP address and weightage.
 You can have multiple ‘A’ records.
o   Latency Routing Policy
 Based on the user geographic location, it picks the IP addresses.
 Each of the entry is meant for one Region.
 If there are multiple IPs (multiple EC2 instances), you can have multiple IP addresses in one record set.
 There can be more than 1 ‘A’ record set.
o   Failover Routing Policy
 There will be one primary, which will be configured as part of “Health Checks” under Route53.
 Then a passive entry will be configured.
 Here there will multiple ‘A’ records and each of ‘A’ record will have single IP.
 If the primary goes down, then passive will come into action.
o   Geolocation Routing Policy
 It selects server based on the geographic location of the user and these servers may have the local language of that geographic location based customers.
 Here there will multiple ‘A’ records.
 Here we select the location not the region while creating ‘A’ record sets.
o   Multi Value Routing
 It's very similar to Simple Routing Policy
 Here it has multiple records and each record has one IP