AWS Certified Advanced Networking - Specialty

The service requires encryption in transit without decryption between the client and the backend. This can be achieved by using a Network Load Balancer (NLB) which operates at the transport layer (Layer 4), supporting TCP. By using a TLS listener on port 443, the traffic remains encrypted end-to-end. Mutual TLS (mTLS) can be implemented using NLB as it does not terminate the TLS connection, ensuring secure and continuous encryption. Therefore, the correct solution is to use a Network Load Balancer with a TLS listener to forward traffic to the backend service.

To meet the requirements of having highly available web servers behind an Elastic Load Balancer, routing requests based on the URL, ensuring all traffic uses HTTPS, offloading TLS processing, and having the web server recognize the user's IP address, you would deploy an Application Load Balancer with an HTTPS listener. The Application Load Balancer supports path-based routing, which allows traffic to be forwarded to the correct target group based on the URL. Additionally, the ALB can include the X-Forwarded-For request header with traffic to the targets, allowing the web server to know the user's IP address, fulfilling the security logging requirement.

To make the application accessible only through the AWS Global Accelerator and not through a direct internet connection to the ALB endpoint, the ALB must be configured in a private subnet. An internet gateway must be attached to indicate that the VPC accepts internet traffic, but no public IP addressing or routing is required at the subnet level. The security group of the ALB should only allow inbound traffic from the accelerator's IP addresses, ensuring controlled access through the accelerator.

To meet the requirements for granular security controls and scalability, creating VPC endpoint services powered by AWS PrivateLink in the central shared services VPC and creating VPC endpoints in each application VPC is the optimal solution. AWS PrivateLink allows secure and private connectivity between VPCs without traversing the internet, ensuring high levels of security by restricting access to specific services. This method also easily scales as new business units are added, as new VPC endpoints can be created in each application VPC to connect to the shared services VPC.

To address the issue of slowness due to bandwidth saturation, the network engineer should review the Amazon CloudWatch metrics for VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress to determine which virtual interface (VIF) is sending the highest throughput during the period when slowness is observed. Once the problematic VIF is identified, the correct approach is to create a new 10 Gbps dedicated connection and shift traffic from the existing 4 Gbps connection to the new connection. AWS Direct Connect does not support upgrading the port speed of an existing connection; a new connection must be created to achieve the desired increase in bandwidth.