Select and troubleshoot layered controls for network edges, compute workloads, VPCs, hybrid paths, service endpoints, and workload isolation.
Apply and troubleshoot appropriate edge controls for content delivery, web applications, APIs, DNS, DDoS, and internet-facing workloads.
Protect workload identity, images, runtime, metadata, patching, vulnerability exposure, and isolation across AWS compute choices.
Design and troubleshoot routing, segmentation, inspection, private connectivity, hybrid controls, and traffic evidence.
Infrastructure questions become easier when every packet and identity path is explicit. Draw the source, destination, address family, route, translation, inspection point, authorization control, name-resolution path, return route, and evidence source before choosing a service.
At the edge, distinguish DDoS absorption, L7 request filtering, CDN behavior, API authorization, DNS protection, origin restriction, and response headers. A security group is not a web-application firewall, and WAF is not a substitute for application authorization.
For compute, protect the artifact, launch configuration, workload identity, metadata access, runtime, vulnerability lifecycle, secrets, storage, isolation, patching, and telemetry. Prefer temporary role credentials over embedded keys. Choose containment controls that do not erase the evidence needed to understand compromise.
For networks, reason about VPC and subnet boundaries, security groups, NACLs, routing, endpoints, PrivateLink, Transit Gateway, hybrid connectivity, centralized inspection, Network Firewall, DNS, flow evidence, IPv6, and asymmetric return paths. Private DNS improves name resolution; it does not by itself authorize service access.
Check DNS, route tables, gateway/endpoint state, security groups, NACLs, firewall policy, appliance routing, service policy, identity policy, and return traffic separately. Avoid changing multiple layers at once because that destroys diagnostic evidence.
Trace an HTTPS request from a private workload to an AWS service and an internet origin. Identify the control and evidence at every boundary and explain what changes under IPv6.
