Lesson 1: Every AWS Networking Service on One Page

Why start with a map?

Ask five engineers which AWS service connects two VPCs and you'll get five answers: peering, Transit Gateway, Cloud WAN, PrivateLink and VPC Lattice. All of them work, but each does a different job. Most bad network designs aren't caused by bad configuration. They come from picking a service built for some other job, or one AWS has already moved on from.

So in this level you get no deep dives. You get a map: every AWS networking service on one page, sorted by the job it does, with its old names and the ones you should no longer build on. Think of it as the floor plan of a building before you start opening doors.

The eight jobs, and the services that do them

Gotcha: some services do more than one job. Route 53 Resolver DNS Firewall is both DNS and security. A NAT gateway is part of VPC, but it is also a big line on the bill. File each service under its main job and note the rest.

Names that changed

Old names live on in blog posts, Terraform modules and job ads, so learn to translate them:

• AWS Transit Gateway Network Manager (2019) became AWS Network Manager. It now manages Cloud WAN as well as Transit Gateway global networks.
• CloudWatch Network Monitor is now Network Synthetic Monitor. It and Internet Monitor sit together under CloudWatch Network Monitoring, next to the newer Network Flow Monitor.
• In AWS WAF, the July 2025 console renamed web ACLs to protection packs. The API, the ARNs and the CLI still say webacl, so your IaC code does not change.
• Elastic Load Balancing at first meant just one load balancer. That one is now called the Classic Load Balancer, and AWS's own docs call it previous generation.

Retired, closed or previous generation

AWS Shield's network security director is still in preview as I write this. Look at it, but don't build a design that depends on it yet.

Walkthrough: audit an account for legacy networking

Once you have the map, the first useful job is finding legacy pieces in a real account. Two CLI checks do most of it:

# 1. Classic Load Balancers use the OLD 'elb' API namespace.
#    Any output here is a previous-generation load balancer to plan a migration for.
aws elb describe-load-balancers \
  --query 'LoadBalancerDescriptions[].LoadBalancerName' --output table

# 2. Current-generation load balancers use 'elbv2'. Type shows application | network | gateway.
aws elbv2 describe-load-balancers \
  --query 'LoadBalancers[].[LoadBalancerName,Type]' --output table

Example output from check 1:

-------------------------
|DescribeLoadBalancers  |
+-----------------------+
|  legacy-web-2016      |   <- Classic LB: move to ALB (HTTP) or NLB (TCP)
+-----------------------+

Next, look through your infrastructure code for the retired services:

# Terraform: WAF Classic resources start with aws_waf_ or aws_wafregional_;
# the current service uses aws_wafv2_. App Mesh resources start with aws_appmesh_.
grep -rnE 'aws_(waf|wafregional|appmesh)_' ./infra
# CloudFormation equivalents: AWS::WAF::*, AWS::WAFRegional::*, AWS::AppMesh::*
# (current WAF is AWS::WAFv2::*)

Best practice: run checks 1 and 2 in every Region you use, since load balancers are regional. For a whole organisation, wrap them in a loop over accounts. Do this before any design review so legacy items come up early, not in the middle of a migration.

How to use this page

When a requirement arrives, say "partners must reach one API in our VPC, and nothing else", first name the job: private access. Then pick from that row: PrivateLink or VPC Lattice. The table does not make the choice for you. Later lessons cover limits, costs and trade-offs. What it does is stop you choosing from the wrong row, such as peering whole networks just to share one service.

Key takeaways

• AWS networking sorts into eight jobs: virtual networks, connectivity between networks, hybrid links, load balancing and delivery, DNS, private access, network security, and monitoring.
• Name the job before you name the service.
• Translate old names: Transit Gateway Network Manager → AWS Network Manager; CloudWatch Network Monitor → Network Synthetic Monitor; WAF web ACLs → protection packs (console only).
• Don't build new designs on App Mesh (ended 30 Sep 2026), WAF Classic (retired 30 Sep 2025), EC2-Classic, or the previous-generation Classic Load Balancer.
• AWS's replacements: ECS Service Connect or VPC Lattice for App Mesh, AWS WAF (wafv2) for WAF Classic, ALB or NLB for the Classic Load Balancer.
• The elb vs elbv2 CLI namespaces are a quick way to find legacy load balancers.