LEARN. PRACTICE. GROW.Concept and mechanism
Peering is a relationship between VPC pairs. If A connects to B and C, this does not allow A to provide B-C transit. For a larger network set, assess a supported transit topology and the segmentation it must preserve. For Direct Connect access to Transit Gateways through a Direct Connect gateway, use the transit VIF category. Do not confuse this path with a public VIF for public services. For applications, separate the load balancer listener from the target protocol. Client HTTPS does not transform an HTTP target group into HTTPS. Each segment needs a decision and evidence matching its requirement.
Guided application
In an inspection design, GWLB forwards GENEVE-encapsulated traffic to appliances. Confirm appliance support and UDP 6081 passage; a successful health check does not establish that data path. Nor does it prove business-operation success: a local /status endpoint can remain green while the database is unavailable. For DNS distribution, weights are relative and have health rules; zero weight is not absolute isolation when the other destinations are unhealthy. DNSSEC supports origin and integrity validation for signed responses but does not encrypt queries. Plan the trust chain and key monitoring. In committee reporting, present connectivity, technical health, and functional completion separately.
The ALB responds on /status, but reconciliation fails. The gate needs an observable test of the critical function.
Common pitfalls
Transitive peering; frontend TLS as complete TLS; health checks as business success.
Related topics: Implementing hybrid routes · Resolution, endpoints, and automation
Validate the segment and function each control actually covers.
Reference: ANS-C01 domain 1 · ANS-C01