AWS Networking & Content Delivery Blog¶

Posts from the AWS Networking & Content Delivery Blog, summarized weekly (every Friday) with a focus on recent articles. Follow each link for the original article. Most recent items appear first.

2026-07-25 · Weekly summary¶

How Amazon CloudFront Delivered Traffic for the FIFA World Cup 2026 — When Spain scored in extra time during the FIFA World Cup Final on July 19, tens of millions of streams surged simultaneously, and Amazon CloudFront handled over 117 Tbps of traffic at that moment. This case study illustrates how CloudFront's edge network absorbs massive, instantaneous traffic spikes during large-scale global events.
Centralized VPC Inspection with Amazon VPC Route Server and AWS Transit Gateway — This post presents a centralized inspection architecture where spoke VPC traffic is routed through AWS Transit Gateway to a dedicated inspection VPC, where firewall appliances examine it before forwarding. Amazon VPC Route Server simplifies dynamic route management within the inspection VPC, reducing the operational complexity of enforcing security at scale.

2026-07-23 · Weekly summary¶

Protect Amazon Route 53 Domains During Account Lifecycle Events: Best Practices for Domain Governance in Multi-Account Organizations — Failing to properly manage Amazon Route 53 registered domains during AWS account decommissioning can trigger website outages, email failures, and SSL certificate validation errors. This post outlines domain governance best practices to safeguard domains throughout the full account lifecycle in multi-account organizations.
Selecting the Right AWS Private Connectivity Options: A Decision Framework — With private connectivity choices now spanning AWS Direct Connect, AWS Direct Connect SiteLink, and AWS Interconnect, selecting the wrong option can result in over-provisioning, slow time to market, or costly rework. This post provides a structured decision framework to help identify the most suitable private connectivity option based on use case requirements.
Consolidate Dual-Stack Architectures with Listener Rules for Network Load Balancer — AWS has launched listener rules for Network Load Balancer (NLB), enabling a single dual-stack NLB to route IPv6 client traffic to IPv6 targets and IPv4 client traffic to IPv4 targets based on source IP address type. The feature requires no protocol translation and fully preserves source IP for both address families, simplifying dual-stack architectures.

2026-07-22 · Weekly summary¶

How Magnite Uses Amazon VPC Route Server and BGP to Build Dynamic Hybrid-Cloud Routing — Magnite, the largest independent sell-side advertising company, leverages Amazon VPC Route Server and BGP to enable dynamic routing between AWS and its own data centers, handling over a trillion ad requests per day. This approach delivers deterministic traffic steering and fast failover, treating network behavior as a first-class part of the application.

2026-07-21 · Weekly summary¶

Introducing the LBC Ingress-to-Gateway API Migration Toolkit — The new Ingress-to-Gateway API migration toolkit for AWS Load Balancer Controller (LBC) automates the error-prone process of rewriting annotations, path rules, and TLS configuration when moving from Ingress resources to the Gateway API. It provides a guided, validated migration path that reduces the risk of disrupting production traffic during the transition.

2026-07-18 · Weekly summary¶

Building an Extranet on AWS: Secure, Scalable Partner Connectivity — This post presents a secure, scalable, and resilient architecture pattern for modern extranet connectivity between external partners and AWS infrastructure, addressing common challenges such as overlapping IP address spaces, added costs, and communication inconsistencies. The reference architecture is designed to minimize the pitfalls typically encountered in conventional extranet designs.

2026-07-17 · Weekly summary¶

Prevent VPN Traffic Leaks with Client VPN Route Enforcement in AWS Client VPN — AWS Client VPN now supports Client VPN Route Enforcement, which prevents administrator-defined routes from being altered on connected client devices. This helps eliminate unintended traffic leaks and ensures routing integrity is maintained across remote access connections.

2026-07-16 · Weekly summary¶

Setting Up Layer 2 Networking on Amazon EC2 — This post explains how to run workloads that depend on Layer 2 network communication on Amazon EC2, even though Amazon VPC does not natively support L2 networking. It covers practical approaches for migrating L2-dependent workloads such as industrial control systems to AWS.
Fine-Grained Amazon Route 53 Access with IAM Condition Keys (Part 3) — This third installment in the series continues exploring how IAM condition keys can enable fine-grained Amazon Route 53 access control for federated users in shared environments. The approach reduces operational overhead and avoids overly broad permissions that tend to grow as organizations scale.
Private AI Agent with WebSocket Streaming over CloudFront VPC Origins and Next-Generation OpenSearch Serverless for Knowledge Retrieval — This post demonstrates how to build a private AI agent that combines WebSocket streaming via CloudFront VPC Origins with next-generation OpenSearch Serverless for knowledge retrieval, using partner contract review as a practical example. The architecture keeps sensitive documents private while enabling secure, real-time AI inference without exposing data to the public internet.

2026-07-14 · Weekly summary¶

Automating CIDR Expansion: Reducing IP Exhaustion Downtime — This post introduces a serverless automation solution that monitors Amazon VPC IP utilization and automatically adds secondary CIDRs with new subnets when exhaustion risk is detected. Built on AWS Lambda, Step Functions, and IPAM, it supports three operating modes—full IPAM management, IPAM for subnets only, or no IPAM—and can be deployed with a single SAM command.

2026-07-09 · Weekly summary¶

How United Airlines Solved IP Exhaustion with Private NAT Gateway — United Airlines faced IP address exhaustion across hundreds of AWS VPCs and resolved it by adopting Private NAT Gateway, enabling cross-VPC communication even in overlapping CIDR environments while achieving the scalability needed for real-time flight operations.

2026-07-08 · Weekly summary¶

Intelligent Failover Using AWS Lambda@Edge and Amazon DynamoDB — This post presents an intelligent failover solution that dynamically redirects users to alternate endpoints during regional disruptions. By combining Lambda@Edge with DynamoDB, it maintains persistent user-endpoint relationships while ensuring high availability across regions.

2026-07-07 · Weekly summary¶

How IAG Accelerated Service-to-Service Communication with Amazon VPC Lattice — Insurance Australia Group (IAG), the largest general insurer in Australia and New Zealand, adopted Amazon VPC Lattice to streamline microservice-to-microservice communication on its serverless digital engineering platform. The solution enabled unified networking patterns and consistent governance while simplifying and accelerating service-to-service connectivity.

2026-07-01 · Weekly summary¶

Phased AWS Transit Gateway to AWS Cloud WAN Migration with Terraform and Network MCP Server — This post outlines a six-phase Terraform approach for migrating from AWS Transit Gateway to AWS Cloud WAN across multiple Regions, using AWS Network MCP Server for validation. The structured phased method helps reduce operational risk during complex multi-Region network transitions.
Intelligent VPN Observability: Decoding AWS Site-to-Site VPN Logs — This post addresses the challenge of manually correlating BGP state transitions and IKE phase changes across hundreds of log entries when an AWS Site-to-Site VPN connection degrades. By automating log analysis to identify root causes such as prefix quota violations, AS path loops, or hold timer expiries, teams can significantly reduce recovery time.

2026-06-30 · Weekly summary¶

AWS Cloud WAN Routing Policy: Real-World Global Network Scenarios – Part 2 — This second installment builds on Part 1's introduction to AWS Cloud WAN routing policies, exploring real-world global network scenarios using the three core components—match conditions, actions, and route summarization—to fine-tune route propagation and path selection. It provides practical guidance for applying routing policies in complex multi-Region network environments.
Extending NLB Health Checks for RADIUS Using an Amazon ECS Witness — Standard Network Load Balancer health checks only verify RADIUS server reachability, not actual authentication capability, meaning a server with a failed identity store continues to receive traffic. This post presents an open-source reference solution that addresses this gap using a single Amazon ECS witness to run application-layer RADIUS probes and reconcile NLB target group membership directly.

2026-06-23 · Weekly summary¶

VPC Resource Gateways: Implementation Patterns and Use Cases — Introduces implementation patterns and use cases for VPC resource gateways when you need cross-VPC service connectivity in environments that don't fit the AWS PrivateLink provider-consumer model or that have overlapping IP address space. Covers how to solve complex networking problems that VPC peering or AWS Transit Gateway alone cannot address.
Extending SD-WAN segmentation into AWS Cloud WAN – Part 2 — Part 2 of a two-part series on extending SD-WAN segmentation into AWS Cloud WAN. Building on the GRE-based Connect attachments from Part 1, it explains how to maintain strict network segmentation in multi-tenant and regulated environments, focusing on integrating SD-WAN with AWS cloud networks while meeting security and compliance requirements.
Extending SD-WAN segmentation into AWS Cloud WAN – Part 1 — Part 1 of a two-part series showing how organizations in multi-tenant or regulated environments, or those running multiple business units, can deploy SD-WAN virtual appliances and extend network segmentation through AWS Cloud WAN. Covers an architecture that consolidates segmented environments under a single, scalable global network.
Best practices for securing your IPv6 infrastructure on AWS using VPC Block Public Access — Covers best practices and considerations for protecting private IPv6 resources on AWS while keeping connectivity models flexible. Explains how to use VPC Block Public Access to securely configure IPv6 network and application infrastructure.
Securing zero trust access with AWS Verified Access and AWS Network Firewall — Introduces a zero trust solution that combines AWS Verified Access and AWS Network Firewall to provide identity-based access control and fine-grained traffic inspection, addressing the excessive network access granted by traditional VPNs. Explains how to limit access to internal applications to the intended scope and strengthen security.
Deploying internal DNS zones for internet-facing load balancers — Covers how to configure internal DNS using private hosted zones for internet-facing Elastic Load Balancing. Explains DNS deployment patterns suited to various ELB types including Network Load Balancer, Application Load Balancer, and Gateway Load Balancer.
Extending AWS DevOps Agent network investigations with S3 logs and custom MCP on Amazon Bedrock AgentCore — Shows how, when a 502 error occurs on an AWS Application Load Balancer, to go beyond API-level investigation by connecting logs stored in Amazon S3 and a custom MCP to Amazon Bedrock AgentCore to analyze the root cause. Presents a practical approach to extending investigation scope with AI-based agents during networking incident response.