Network path matters
Latency and throughput depend on how many hops, where TLS terminates, and whether traffic stays on the AWS backbone. Domain 3 loves questions that combine VPC design with API exposure and global users.
Amazon API Gateway
Managed front door for HTTP/WebSocket APIs:
| Type | Use |
|---|---|
| HTTP API | Lower cost/latency REST; Lambda, HTTP backends |
| REST API | Full feature set — API keys, request validation, WAF integration, caching |
| WebSocket | Real-time bidirectional |
Performance features:
- Caching (REST API) — cache GET responses at gateway; reduce backend load (TTL per stage).
- Throttling — account and per-method limits; use with usage plans for partners.
- Lambda integration — sync (wait for response) vs async; Lambda proxy passes full request.
Exam: "Reduce repeated identical API reads" → API Gateway caching + CloudFront for public edge if appropriate.
Elastic Load Balancing — performance notes
- ALB — HTTP/2, WebSocket, sticky sessions (optional), target groups by path/host.
- NLB — millions RPS, static IP per AZ, TCP/UDP, preserves client IP.
- Connection idle timeout — tune for long-lived connections.
- Cross-zone — even distribution; NLB cross-zone can add inter-AZ data charges.
Pair NLB with static IP requirements; ALB with microservices HTTP routing.
Private connectivity (performance + security)
- VPC endpoints (Gateway) — S3, DynamoDB route tables; no NAT for those services.
- Interface endpoints (PrivateLink) — ENI in subnet for AWS services (API Gateway private, SSM, etc.) and SaaS partners.
- VPC Lattice / PrivateLink patterns — service-to-service without public internet.
Less NAT traversal → lower latency and data processing cost for AWS API calls.
DNS and traffic management (performance angle)
- Route 53 latency routing — send user to Region with lowest measured latency.
- Alias records to CloudFront, ALB, S3 website — no CNAME limitation at zone apex.
- Health checks — fail away from sick endpoints quickly.
Transit and hybrid
- Transit Gateway — hub connecting VPCs and on-premises VPN/DX; simplifies mesh vs full VPC peering.
- Direct Connect + DX Gateway — private path; consistent throughput for bulk transfer to S3 (via gateway endpoint in VPC) or hybrid apps.
Exam: many VPCs need to talk — Transit Gateway beats N× peering complexity.
Acceleration stack (put it together)
| Scenario | Stack |
|---|---|
| Global static site | S3 + CloudFront + Route 53 alias |
| Global API, cacheable GETs | CloudFront → API Gateway (cache) → Lambda |
| Global TCP game server | Global Accelerator → NLB → EC2 |
| Private SaaS consumer in VPC | Interface VPC endpoint (PrivateLink) |
| Burst read API same Region | API Gateway cache or ElastiCache behind ALB |
Exam traps
- API Gateway caching only helps idempotent GET with cache key strategy — not all POST flows.
- Internet Gateway is not a performance boost — it's public internet path.
- Peering is non-transitive — VPC A↔B and B↔C does not give A↔C.
Official reference
SAA-C03 exam guide — high-performing networking.