Networking & Content Delivery

AWS Client VPN now offers device posture assessment: make device health a condition of tunnel access. Register a device trust provider (CrowdStrike, Jamf, or JumpCloud), write a Cedar policy, and Client VPN evaluates every connection at connect time and throughout the session. Use shadow mode and connection logs to test a policy before you enforce it.

Tunnel endpoints are a new VPC endpoint type, powered by AWS PrivateLink, that gives an application in one VPC private access to an entire range of IP addresses in another VPC. The network owner shares a CIDR block once, and every resource inside it becomes reachable, including resources created later.

Amazon Route 53 now uses change-based throttling and has doubled its default API request rate from 5 to 10 requests per second. Learn how the new per-account model works, with separate request-rate and change-throughput limits, and best practices for automating DNS management at scale.

SaaS providers can use Bring Your Own ASN (BYOASN) on AWS Direct Connect public VIFs to assign a distinct ASN per Region, giving end customers a standard BGP AS_PATH signal to enforce data sovereignty without relying on fragile per-Region prefix lists.

Learn how to architect end-to-end mutual TLS (mTLS) authentication over QUIC using AWS Network Load Balancer passthrough mode. This post shows how to route QUIC traffic to quic-go server pods on Amazon EKS through the AWS Load Balancer Controller, with per-device certificate authentication for latency-sensitive fleet workloads such as autonomous drones.

Design an AWS Cloud WAN network that keeps regional traffic in-region for data residency while running centralized security inspection across geographies. This deployable four-segment, multi-Region reference architecture combines geo-restricted segments with Network Function Groups, covering dual-hop versus single-hop trade-offs and the key NFG constraints.

The AWS Networking and Content Delivery (CDN) team invites you to join us at re:Invent from November 30 through December 4 2026. During that time, Las Vegas, Nevada becomes the ultimate destination for cloud innovation, and there is no better time to look ahead at where cloud networking is going. Across five action-packed days you […]

VPC Lattice now supports private domain-name targets, so you can point a resource configuration at a name that resolves only in a Route 53 private hosted zone or on an on-premises DNS server. This post explains how to choose a DNS resolution type and source, then walks through two deployment patterns for sharing a private service across accounts.

The AWS MCP Server, a managed remote server for the Model Context Protocol (MCP), runs in production behind Amazon CloudFront. Hundreds of thousands of AWS accounts call it, and it handles millions of tool calls every month. Every request enters one of CloudFront’s more than 750 Points of Presence (PoPs), the edge locations nearest the […]

Modernizing a monolith into microservices may require placing each new service in its own AWS account for isolation, independent scaling, and clear ownership. During that migration you hit a hard question: how do you shift a small, precise slice of live traffic from the monolith to a new service in a different account? You need […]