Category: *Post Types

Your most sensitive data—patient records, financial data, classified documents—lives in a private Amazon Virtual Private Cloud (Amazon VPC) with no internet access, and for good reason. That network isolation is a deliberate security posture, not an oversight. The problem is that your AI agents need to reason over that data, and traditional networking approaches force […]

Customers adopting AWS Network Firewall at scale have shared two consistent pieces of feedback. First, managing inspection for centralized deployments adds operational complexity. Second, deploying separate firewalls for each VPC in distributed deployments becomes costly and difficult to manage as the number of VPCs increases. In this post, we explore the architectural patterns for two […]

At re:Invent 2025 we launched AWS Network Firewall proxy in preview to gather feedback from customers before making it generally available. That feedback was clear and consistent: customers want the flexibility to use their Network Firewall, with all its existing capabilities, as an explicit proxy. Rather than managing a separate proxy product with its own security policy model, customers told us they would prefer […]

Centralized VPC inspection with Amazon VPC Route Server and AWS Transit Gateway helps you route traffic from multiple virtual private clouds (VPCs) through a shared firewall for security enforcement. Spoke VPCs send traffic through AWS Transit Gateway to a dedicated inspection VPC, where firewall appliances examine it before forwarding. The challenge is making this inspection […]

Domain governance in Amazon Route 53 can mean the difference between a routine account decommissioning and an unplanned outage. Picture this situation: your organization closes an Amazon Web Services (AWS) account, and five days later a customer-facing website becomes unreachable, email stops flowing, and SSL certificate validation fails. A domain that this account had registered […]

Selecting the right AWS private connectivity option is harder than it used to be. The choices now span AWS Direct Connect, AWS Direct Connect SiteLink, and AWS Interconnect (last mile and multicloud). Picking the wrong option can lead to over-provisioning, slow time to market, or rework. In this post, we present a decision framework for […]

Magnite, the largest independent sell-side advertising company, runs an engineering team that processes more than a trillion ad requests each day across Amazon Web Services (AWS) and its own data centers. In Magnite’s hybrid-cloud environment, network behavior is not background infrastructure. It’s part of the application. The team needs deterministic traffic steering, fast failover, and […]

Migrating your AWS Load Balancer Controller (LBC) Ingress resources to the Gateway API by hand is tedious and error prone. You need to rewrite annotations, path rules, and TLS configuration, and a mistake can disrupt the production traffic. The Ingress-to-Gateway API migration toolkit for LBC removes that risk by giving you a guided, validated path […]

When building extranet connections between external partners and your AWS infrastructure, an integration project can become a task that requires additional work hours, additional costs, and communication inconsistencies. This post describes a secure, scalable and resilient architecture pattern for a modern extranet architecture on AWS, that minimizes commonly issues faced by usual designs: overlapping address […]

Unintended traffic leaks are a real risk when you rely on remote connectivity to access cloud resources, so maintaining VPN routing integrity on connected devices is essential. When a device connects through a VPN, the administrator-defined routes instruct the operating system to direct specific traffic through the encrypted tunnel. However, those routes can be altered […]