Content tagged with "networking"
End-to-end CLI verification of Route 53 Global Resolver covering Do53/DoH authentication, DNS filtering, and propagation timing. Provides data to evaluate whether the 20x cost premium over VPC Resolver is justified.
Hands-on verification of VPC Encryption Controls Monitor/Enforce modes. Reveals that encryption-status 2 only applies to PrivateLink, Enforce migration takes 15+ minutes asynchronously, and VPC endpoint ENI migration can silently block the transition.
Verified centralized Network Firewall Proxy architecture across VPCs. SourceVpc enables per-VPC policy control via PrivateLink endpoints, while SourceIp is NATed and unusable in cross-VPC setups.
Enabled TLS intercept on Network Firewall Proxy using ACM Private CA. Verified PreRequest phase HTTP method blocking, PostResponse Content-Type filtering, and documented PCA configuration gotchas and Preview-specific limitations.
Hands-on verification of AWS Network Firewall Proxy (Public Preview). Tested NAT Gateway integration, PreDNS domain filtering, source-based access control, and DNS spoofing resistance.
Verified ClusterNetworkPolicy and ApplicationNetworkPolicy on EKS Auto Mode. Domain name-based egress filtering enables multi-layered access control that restricts pods to specific external services only.
Hands-on verification of Lambda's new AZ metadata endpoint. Measured same-AZ vs cross-AZ latency to an ElastiCache Valkey cluster and quantified the routing benefit.
HTTP absolute-form requests expose headers to the proxy without TLS decryption. The documentation's 'only filter based on IP' statement applies to HTTPS only.
Cross-VPC access through PrivateLink endpoints NATs the source IP to the endpoint's ENI IP. Use SourceVpc or SourceVpce instead of SourceIp for cross-VPC source identification.