Category: Advanced (300)

AWS Cloud WAN Flow Logs capture flow-level traffic across your global network. Learn how to create flow logs at the core network, edge, and attachment scopes, publish them to Amazon CloudWatch Logs, Amazon S3, or Amazon Data Firehose, and query them with Amazon Athena and CloudWatch Logs Insights to analyze cross-segment and cross-Region traffic and drops.

External gRPC clients carry JWTs, but Amazon VPC Lattice trusts SigV4 signatures. This post shows how to build an ingress layer where an Application Load Balancer validates JWTs and an Amazon ECS proxy translates that identity into SigV4, enforcing per-service authorization with VPC Lattice auth policies while preserving gRPC over HTTP/2 end-to-end.

AWS Client VPN now offers device posture assessment: make device health a condition of tunnel access. Register a device trust provider (CrowdStrike, Jamf, or JumpCloud), write a Cedar policy, and Client VPN evaluates every connection at connect time and throughout the session. Use shadow mode and connection logs to test a policy before you enforce it.

Tunnel endpoints are a new VPC endpoint type, powered by AWS PrivateLink, that gives an application in one VPC private access to an entire range of IP addresses in another VPC. The network owner shares a CIDR block once, and every resource inside it becomes reachable, including resources created later.

Learn how to architect end-to-end mutual TLS (mTLS) authentication over QUIC using AWS Network Load Balancer passthrough mode. This post shows how to route QUIC traffic to quic-go server pods on Amazon EKS through the AWS Load Balancer Controller, with per-device certificate authentication for latency-sensitive fleet workloads such as autonomous drones.

Design an AWS Cloud WAN network that keeps regional traffic in-region for data residency while running centralized security inspection across geographies. This deployable four-segment, multi-Region reference architecture combines geo-restricted segments with Network Function Groups, covering dual-hop versus single-hop trade-offs and the key NFG constraints.

VPC Lattice now supports private domain-name targets, so you can point a resource configuration at a name that resolves only in a Route 53 private hosted zone or on an on-premises DNS server. This post explains how to choose a DNS resolution type and source, then walks through two deployment patterns for sharing a private service across accounts.

The AWS MCP Server, a managed remote server for the Model Context Protocol (MCP), runs in production behind Amazon CloudFront. Hundreds of thousands of AWS accounts call it, and it handles millions of tool calls every month. Every request enters one of CloudFront’s more than 750 Points of Presence (PoPs), the edge locations nearest the […]

Multicloud is no longer an edge case. Workloads end up spanning AWS and Google Cloud, Microsoft Azure, or Oracle Cloud Infrastructure after an acquisition, through a footprint that predates any consolidation decision, or because a key vendor operates on the other cloud. Sooner or later a network engineer gets the task: connect two environments privately […]

AWS WAF gives you a practical way to secure and observe Model Context Protocol (MCP) endpoints at the edge. MCP has quickly become the standard way AI agents communicate to tools and data. Originally, it was a stateful protocol built around long-running sessions, persistent connections, and client-to-server-instance binding. The 2026-07-28 MCP revision redesigned MCP as […]