SAP-C02
Deep Dive
For the SAP-C02, networking goes beyond basic VPCs. Advanced CloudFront, VPC Endpoints, Enhanced Networking and PrivateLink patterns are essential for designing high-performance, secure applications.
Contents
CloudFront is AWS's global CDN with 450+ edge locations. For the SAP-C02, the focus is on advanced features: granular caching, Lambda@Edge, CloudFront Functions, security and Origin Access Control.
Cache Behaviors — caching granularity
A CloudFront distribution can have multiple Cache Behaviors with different cache configs per path pattern.
Lambda@Edge and CloudFront Functions
Lambda@Edge
Runs Node.js or Python code at the edge locations. Modify requests/responses. Cases: A/B testing, content personalization, JWT validation, complex redirects. Higher latency than CF Functions but more powerful.
CloudFront Functions
Ultra-lightweight JavaScript running at the edge. Sub-ms latency. For: URL rewrites/redirects, header manipulation, simple auth. 10x cheaper than Lambda@Edge but with limitations (max 2ms, can't fetch).
Origin Access Control (OAC)
OAC replaces the older OAI (Origin Access Identity). It lets CloudFront access private S3 using SigV4 signing, without exposing the bucket publicly.
CloudFront Signed URLs vs Signed Cookies
Signed URLs
One URL per object, with an expiration. For distributing individual files (e.g., a downloadable video, a report PDF).
Signed Cookies
Access to multiple files within a session (e.g., a premium user sees every video in the catalog). Doesn't modify URLs — access comes from the cookie.
Origin Groups let you define a Primary and a Secondary origin. If the Primary returns errors (configurable 4xx, 5xx), CloudFront automatically fails over to the Secondary. A fundamental pattern for DR at the CDN level.
Use case: S3 static website with DR
Primary: S3 bucket in us-east-1. Secondary: replicated S3 bucket in us-west-2. If us-east-1 returns errors, CloudFront serves from us-west-2 automatically.
Use case: ALB with S3 fallback
Primary: ALB on EC2. Secondary: S3 bucket with a static version of the app. If EC2 is down, the static version is served (degraded but available).
| Type | Services | Cost | How it works |
|---|---|---|---|
| Gateway Endpoint | S3 and DynamoDB only | Free | Updates the subnet's route table to route traffic to S3/DynamoDB without leaving to the internet. Destination IP = the service prefix list. |
| Interface Endpoint (PrivateLink) | 200+ AWS and SaaS services | Paid ($0.01/h + $0.01/GB) | Creates an ENI in the subnet with a private IP. Traffic goes to that ENI → AWS backbone. Supports private DNS to override the public endpoint. |
| Gateway Load Balancer Endpoint | 3rd-party security appliances | Paid | For inserting inspection appliances into the traffic flow via GWLB and PrivateLink. |
VPC Endpoint Policies — granular control
VPC Endpoints support policies that restrict which actions and resources can be accessed through the endpoint. They complement bucket policies and SCPs.
Example: S3 endpoint only allows access to the production bucket
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "arn:aws:s3:::prod-bucket/*"
}When to use Gateway vs Interface Endpoint for S3
Gateway Endpoint (S3)
Free, works for access from the same VPC via the route table. Doesn't work cross-VPC or cross-region.
Interface Endpoint (S3)
Paid, but works from VPCs connected via TGW/Peering, from on-premises via Direct Connect, and cross-region with VPC Peering.
Enhanced Networking uses SR-IOV (Single Root I/O Virtualization) to give instances direct access to network hardware, removing hypervisor overhead. It results in higher bandwidth, lower latency and less latency variability (jitter).
ENA (Elastic Network Adapter)
Up to 100 Gbps of networking. Supported on all modern instances. Recommended for most workloads.
Max: 100 Gbps
ENA Express
An ENA extension that reduces latency to sub-100µs and jitter. For HPC and latency-sensitive applications. c6gn, p4d instances, etc.
Max: sub-100µs
Intel 82599 VF (legacy)
Up to 10 Gbps. Legacy instances (m4, c3, etc.). Replaced by ENA on modern instances.
Max: 10 Gbps
Placement Group + Enhanced Networking for HPC
For HPC (simulations, distributed ML, rendering), the optimal combination is: Cluster Placement Group (instances on the same rack) + ENA Express (sub-100µs latency) + HPC-family instances (hpc6a, p4d). This achieves near-bare-metal network performance.
ACM Public vs Private Certificates
ACM Public (free)
ACM Private CA (paid)
ACM — key exam limitations
SaaS provider pattern
An ISV exposes its service via NLB → Endpoint Service. Customers create Interface Endpoints in their VPCs. The provider approves the endpoints (allowlist by AWS account ID). The provider's and customer's CIDRs can overlap — PrivateLink is immune to CIDR overlap.
Centralized shared services
A Shared Services account exposes internal tools (Jenkins, Artifactory, monitoring) via PrivateLink. Workload accounts create endpoints without needing VPC Peering or a TGW. More secure than Peering because the consumer can't initiate connections to the provider.
Cross-region PrivateLink
PrivateLink is natively intra-region. For cross-region: create a VPC in the same region as the endpoint service, then connect that VPC to another region via VPC Peering or a TGW. The endpoint service only needs to exist in one region.
PrivateLink + on-premises
On-premises can access Interface Endpoints via Direct Connect or VPN (endpoints are ENIs in the VPC, reachable from on-premises if routes are configured). Requires enabling Private DNS from on-premises or using the endpoint DNS name directly.
Trap: "Gateway Endpoints for S3 work from on-premises via Direct Connect"
Reality: FALSE. Gateway Endpoints only work WITHIN the VPC where they're created (they update the route table). For accessing S3 from on-premises without the internet, use an Interface Endpoint (PrivateLink) for S3.
Trap: "ACM Public certificates can be installed directly on EC2"
Reality: FALSE. ACM Public certificates aren't exportable. They're only used with AWS services (ALB, CloudFront, API Gateway). For EC2, you need ACM Private CA (exportable) or to import a third-party certificate.
Trap: "Lambda@Edge and CloudFront Functions have the same capabilities"
Reality: They're different. CF Functions: simple JavaScript, sub-ms, viewer request/response only, can't make HTTP fetches or access AWS services. Lambda@Edge: Node/Python, up to a 5-30s timeout, can fetch, access DynamoDB, etc. — far more powerful but slower and more expensive.
Did you get this topic?
Test what you just learned
A company has EC2 instances in private subnets (no internet access) that need to access S3 to download objects. The security team requires that traffic to S3 never cross the public internet. What is the most cost-effective solution?
Put what you learned to the test with original SAP-C02 exam questions.
Start SAP-C02 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.