Scalable Network Architectures

Two services optimize network paths for global users, and picking between them comes down to what kind of traffic you're sending. Amazon CloudFront is a content delivery network: it caches HTTP and HTTPS content at edge locations close to users, so a repeat request for the same object never has to reach your origin at all. It's the right fit for cacheable content — static assets, video, API responses that don't change per request.

AWS Global Accelerator operates at the network layer instead, for TCP and UDP traffic generally, including traffic CloudFront can't cache — a gaming server, a VoIP application, a non-HTTP protocol. It gives you two static anycast IP addresses as a fixed entry point, routes each connection onto the AWS global network at the nearest edge location, and continuously steers traffic toward the healthiest, best-performing regional endpoint — without caching anything. The two aren't competitors: a web application often puts CloudFront in front of its cacheable HTTP surface and Global Accelerator in front of a non-HTTP or non-cacheable TCP/UDP surface behind the same architecture.

aws globalaccelerator create-accelerator \
  --name my-accelerator \
  --ip-address-type IPV4 \
  --enabled

Connecting a data center or office to AWS has two well-known paths. AWS Direct Connect is a dedicated, private physical connection from your premises to an AWS Direct Connect location — it bypasses the public internet entirely, giving consistent, predictable latency and bandwidth (1 Gbps, 10 Gbps, or higher), which matters for large, steady data transfers or latency-sensitive hybrid workloads. Setting it up takes real lead time: physical cross-connects, a partner, weeks to months.

A site-to-site VPN is the faster alternative: an encrypted tunnel over the public internet between your network and a virtual private gateway, set up in minutes rather than weeks, at a fraction of the cost — but subject to the public internet's variable latency and throughput. The two aren't mutually exclusive: a common pattern pairs a Direct Connect connection for steady-state traffic with a VPN as an automatic failover path if the dedicated connection goes down.

Inside the VPC itself, a multi-tier design places each layer in the subnet tier that matches its exposure: a public subnet for internet-facing load balancers, a private subnet for application servers, and often an isolated subnet with no route to the internet at all for databases. Load balancer choice follows the traffic: an Application Load Balancer operates at layer 7 for HTTP/HTTPS, making routing decisions on path or host; a Network Load Balancer operates at layer 4, for extreme throughput and a static IP per Availability Zone, for protocols beyond HTTP.

For resources that need to reach AWS services without touching the internet at all, a VPC interface endpoint (built on AWS PrivateLink) gives a private IP inside the VPC for the service — the same tool covered when securing workloads, now viewed through a performance lens: fewer hops, no NAT gateway bottleneck.