<map version="1.0.0"><node Text="Mind Map"><node ID="D120C290-B46F-4458-A6DB-44947742EDD1" BACKGROUND_COLOR="#000000" TEXT="AWS Certified Advanced Networking Specialty ANS-C00 neckercube.com" COLOR="#FFFFFF" POSITION="right" STYLE="bubble"><edge COLOR="#7F7F7F" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="5A51B8B6-E6FF-4D3B-8CB1-098701D50846" TEXT="VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C3AD2CD5-AA9E-489B-BA05-FB38683F8534" TEXT="Mapping service" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="D2F61177-4C30-4F1B-8F93-5635DE115F3D" TEXT="AWS uses a mapping service to abstract your VPC from the underlying AWS infrastructure (such as the physical servers your workloads are operating on)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3D2C071B-969B-4777-B4CC-636566C5C5BC" TEXT="Example: EC2 instance A sends ARP for instance B. The underlying hypervisor intercepts A&#39;s ARP, queries the mapping server for B&#39;s MAC, then the hypervisor returns a synthetic ARP back to A containing B&#39;s MAC." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="300674E1-8D06-41CA-8A1B-6DB795C0C04A" TEXT="Packet delivery includes an encap/decap process (similar in concept to other overlay technologies) where the mapping service is consulted again for src/dst physical server IP addresses in relation to the logical EC2 instances." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="E217D756-B13D-4177-96F5-E924205BFA43" TEXT="AWS accounts have a default VPC in each region with a default subnet 172.31.0.0/16 in each AZ, with IPv6 disabled" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="D7F8DBBC-884D-4F7E-A7B4-9E9CC77CCF69" TEXT="Default VPCs contain one public /20 subnet in every AZ within a region" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="83906D5E-6895-48D5-886F-BE7E8F00EAE6" TEXT="1 subnet = 1 AZ" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="AE397362-4C64-4FE5-A517-4A6C226320D0" TEXT="1st 4 + last IP in every subnet reserved" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="90015E33-97A8-4BDC-B074-2D00A5A4781E" TEXT="No broadcast/multicast so subnet size does not impact performance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="C32083A3-AEEC-4481-9E97-FC129A543D82" TEXT="IPv6: Each VPC = /56, each subnet = /64" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="5A775736-EA98-4254-B78B-7C644B29EB01" TEXT="AWS assigns the public /56, you control the low-order 8 bits for the /64" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="9C02E2A8-7E01-408F-A950-15C48795C3A6" TEXT="The distinction between a public and private subnet in a VPC is whether or not an Internet Gateway is attached" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="03BEE2D4-65F9-404C-BC02-A8D8B026E0CD" TEXT="VPC IPv4 subnets are always private from an Internet standpoint, even if you use a public CIDR block. AWS does not announce VPC IPv4 addresses to the Internet." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="41CDA927-9485-49AC-9D07-A27A13CF40D2" TEXT="Route Tables" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="EE81D5B2-881B-4347-863D-4B28F37F1721" TEXT="Each subnet is associated with a route table" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="0FF859ED-0D18-44DD-97CD-ECFDC6EB27A7" TEXT="Subnet belongs to main route table unless custom is specified" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="1DCA94F5-889C-4FB0-9A3C-C0D44AF76866" TEXT="Custom route table can replace main so new subnets are automatically associated" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="EE228BE8-54A7-45AA-94C3-CDAB3ED30FA1" TEXT="Routes specify destination CIDR and target (local, IGW, VGW, etc)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="2784CE20-3B5A-41A7-96B4-BA2DAE7D4AD8" TEXT="Route Priority" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C4766CA0-0024-4F11-87A5-89DCF9CBE192" TEXT="Local route (even if more specific route exists) - CIDR block assigned to VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="1E19B3EA-8FB6-4F86-9E4F-90E48EA0B020" TEXT="Most-specific (longest-prefix match)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="949468E6-589D-42D2-89DC-6115365881A1" TEXT="Static" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="855A6F77-2269-44FB-B5C8-1D888221590C" TEXT="Dynamic from Direct Connect" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7F33D81A-C806-4756-9E2D-08905E897887" TEXT="Static from VGW" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B19415F5-5D97-4837-B223-CC63EE37BBC8" TEXT="Dynamic from a VPN" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="AF835FDE-53DA-45B4-A038-795086C5A99C" TEXT="IP addressing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8A2ACBDB-5B21-4BEF-9331-5DBCDAB920F0" TEXT="EC2 instances receive a private IP from the residing subnet at launch." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="02182B5A-0040-4AF5-998C-86F984FB2018" TEXT="You can specify the private IP if it is within the subnet and unused" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="497D74B8-24C7-4FDB-8A86-9E72F0753BED" TEXT="EC2 instances may receive public IPv4 addresses either at launch or later" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="9CE8DA77-AB5B-427A-9A53-21BD11DCBD74" TEXT="You cannot manually disassociate the public IPv4 address after launch" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="53895B73-D0B3-4962-9773-7AB09AEACE4E" TEXT="The public IPv4 address is released back into the AWS pool when you stop or terminate the instance, and you cannot re-use the IP later" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="43419DD3-8216-4311-BF40-950FF46081A8" TEXT="Elastic IP addresses allow you to keep the same static public IPv4 address" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="0ACCA699-43EA-40F9-BA18-EA1DFCF49463" TEXT="Elastic IPv4 addresses must be allocated first, then assigned to an EC2 instance to be used." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="56042CAB-07E6-44F3-BF8F-6C93963684CA" TEXT="Elastic IPs are region-specific" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E480A720-3E51-42DD-94D9-DD821FD561E2" TEXT="You are not charged for the first Elastic IP assigned to an instance as long as that instance is running. Additional IPs and stopped instances incur hourly charges." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="81755080-84CA-40E6-9183-610CA9617948" TEXT="All interfaces with IPv6 addresses have a link-local address using modified EUI-64 addressing based on the interface MAC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="3438416F-3ECD-4125-9F09-C9D847E8898E" TEXT="Security Groups" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="6AB60591-C303-4257-B5B5-649A5F4D360D" TEXT="Default allow alll outbound, implict deny others" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="16E22598-2C8D-41FD-A729-939E2EF97C90" TEXT="Default rules can be changed, but default group cannot be deleted" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="63E87C98-D5AF-4DBB-82AE-5B6E3E0861DA" TEXT="If you change the default rules and later add IPv6, you must create the IPv6 rules manually" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="90F8242E-4746-4C5F-AE18-BF040F72446C" TEXT="Peered VPCs can refer to security groups from their peers" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D824CE8E-0C4B-46A9-8767-9A44555F51D7" TEXT="500 security groups per VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="1E79093D-18DA-4ECC-A462-B4E9E7C0E86B" TEXT="50 inbound / 50 outbound rules per group" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="02B59D8C-1594-465A-B4AB-FA4DF61270A3" TEXT="5 groups per network interface" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="6474BE36-6310-4326-861A-D2925DBA4B11" TEXT="SGs only specify ALLOW, not deny (unlike NACLs)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="757E803A-8704-4F3E-93EC-CCC1E946AB9F" TEXT="This allows multiple groups to be applied and all rules are processed together (not top down like NACLs)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="72421C67-67C0-42A8-85BF-E74F45BF528B" TEXT="SGs are stateful (unlike NACLs)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="0F3F618C-3FA1-4DAC-B88A-7EC9E537AEC4" TEXT="Network ACLs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E42199D4-B587-498E-9B6C-97A496947619" TEXT="Stateless, act on entire subnet" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="ABEDDACA-AAE9-4553-A41C-2CC5769691DD" TEXT="Top-down rule processing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="898F177D-9344-4512-A431-9CF769E66D32" TEXT="Default allow all inbound/outbound" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="3BA92F74-1999-4FF3-B443-06D6FC0F20B5" TEXT="If you change the default rules and later add IPv6, you must create the IPv6 rules manually" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="CB11EBC6-50EB-4AA7-8EEE-5F278DBA9090" TEXT="Internet Gateway" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="48DC0EC7-B1D3-4EFC-BF2A-550983AEB3C7" TEXT="Maintains 1:1 NAT mappings for public:private IPv4 addresses on EC2 instances" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="03437B68-3466-49AF-8FC6-EB2B999D6593" TEXT="VPC must contain route to IGW, but can be scoped (does not have to be 0.0.0.0/0)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="37FC0817-5D39-40D7-B7AD-381EA0E1FF46" TEXT="NAT Gateway / Instance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="948E8948-749E-434F-9352-7118A58A7D83" TEXT="NAT Gateway is managed and more scalable" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="43C35129-39BC-417C-89BA-A805EF89641A" TEXT="Create a NGW in each AZ and configure route tables to use the NGW in the same AZ in order to have an AZ-independent architecture" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="8BE92E82-C2E1-48BD-8C91-68B12D550714" TEXT="NAT Instance uses Security Groups" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="0008EB81-FEC2-4029-ABD6-51A33C2D4C5C" TEXT="NAT Gateways and NAT Instances allow EC2 instances in private subnets to gain outbound Internet access" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="50717BF7-2ED8-46ED-97AF-0F248DD7CD78" TEXT="This configuration allows private subnets to send outbound traffic and prevents inbound traffic initiated from the Internet" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="024FA774-F4B9-4672-B193-07501A39D349" TEXT="Private IPv6 subnets can use Egress-only IGW which is stateful" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5162AC2B-6527-48B2-903D-6D0FE4909C56" TEXT="NAT Instance configuration:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="24DD34C6-AF5C-4CB9-A831-7369990280EB" TEXT="Create SG for NAT Instance that specify needed Internet resources (IP, protocol, port)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="0556ABCC-4927-49B0-AD7A-4BFB22695C78" TEXT="Launch NAT AMI in public subnet and associate the SG" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="09F89D3A-706A-423E-830C-7004F527FE99" TEXT="Disable src/dst check on NAT instance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3623F0F5-28B3-409C-8049-21FDCED861A8" TEXT="Configure route table in private subnet to direct Internet-bound traffic to NAT instance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="7651871F-405C-4061-83D3-DC05B866C009" TEXT="NAT Gateway configuration:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FA3E568C-DE6B-4DBC-BF65-F9F47CBE52CF" TEXT="Create NGW in public subnet" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="405E796E-EDC3-4CE4-8E46-0CD3B9472A1B" TEXT="Allocate/associate IPv4 Elastic IP with NGW" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="C0B40A33-FE58-406C-A465-948EB6385372" TEXT="Configure route table in private subnet to direct Internet-bound traffic to NGW" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="B487DC3D-77BF-425F-8130-A85957369171" TEXT="VPN" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C6456DB2-B180-4DF4-8821-DAB0FEA5F1BD" TEXT="Virtual Private Gateway is the AWS-managed edge device" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E614F963-8116-45CF-AB01-29F746D81BEC" TEXT="Customer gateway is the customer-side device" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8DE51146-196C-431B-9FD1-9F4B7B8463BF" TEXT="Customer gateway must initiate the IPsec connection" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="0C7FB6EC-A6B6-4B80-A19B-16A0A6A3C626" TEXT="BGP or static routing is used" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="2CC57C8E-DE8B-4DD7-9321-2270B54952D7" TEXT="VGW uses two IPsec tunnels for HA" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="2A75B01A-BECA-4CFF-A516-41E744D1EBC2" TEXT="VPC Endpoints" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="36961FDC-0295-409B-8BAB-5EB76B0D3962" TEXT="Connect your VPC to supported AWS services using internal private AWS backbone" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="60D95DCC-0CC2-430F-B138-A42434C92EAA" TEXT="IPv4 only" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4B3AC707-A17A-4A3F-8935-CA44BB47CC21" TEXT="Interface endpoint" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8587D2DE-A6A0-4002-B753-856C847BE59A" TEXT="AWS PrivateLink" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="6B445177-4F1B-4E43-986E-7F68C8BA536A" TEXT="Uses Elastic Network Interface inside VPC with private IP for traffic destined to supported services" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="EA4C4A75-FC93-4434-B753-8E7FAA654BBC" TEXT="Gateway endpoint" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E15F4A54-6F70-4A97-9A54-01DBF060FA84" TEXT="Uses route table target for supported services" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="568C71FA-D03D-48CC-B58F-EB3DF777360E" TEXT="VPC Peering" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A09E9FB0-078E-475F-8184-3CC30616FF09" TEXT="Same or different AWS accounts allowed" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="C0A98ABE-7E04-459E-AB7F-347807BA9E32" TEXT="Peering between regions within same AWS partition. Partitions are general AWS, China, US GovCloud" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5768156D-C5DE-4C84-9094-6863ACDF3E99" TEXT="Cannot have same/overlapping CIDR" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="76A222EC-1EB6-42EC-B3F1-3FC061C1FEDC" TEXT="Non-transitive" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D6ED6E98-3743-41F4-8DCD-D764DAA8FA93" TEXT="Peering in same region can use hostname resolution to receive private IPv4 addresses" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="EADD73DD-945C-49DA-9012-53F0B85882F2" TEXT="Traffic between regions is encrypted by AWS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="ADE32FBC-B6EA-4D7F-AB87-3DD750D4C239" TEXT="Placement Groups" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="83D87C55-10F3-417E-A99B-54A0567AAF62" TEXT="Single AZ" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="C0F0D8FE-61B3-4F15-BC4D-CCA553589D62" TEXT="Launch instances at the same time to have a better chance of colocation" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="A3FC4CB5-0536-4ACE-8849-C7ABC2807B7C" TEXT="Elastic Network Interfaces" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B85257F5-5316-4DA8-BAFA-7A08E7DDBD29" TEXT="ENIs are associated with a subnet in a VPC upon creation" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BFDC45DB-96F6-4D24-8B78-AFCF2EA02172" TEXT="Multiple ENIs can attach to an EC2 instance to have presence in multiple subnets" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="38B02DCD-AD09-4991-9286-74832F4E536B" TEXT="Cannot be used for NIC teaming" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="BE84D088-27CE-4A5D-992B-185473E073F1" TEXT="ENIs can be moved to different instances while preserving the IP and MAC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="AA73BEF0-C664-4A6F-B723-F9547DA9FFD6" TEXT="Number of ENIs per instance depends on instance type" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="D8C3380A-9CAB-4F35-94D7-795513033EC6" TEXT="DHCP Option Sets" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="5701C412-9569-4158-8872-919B2129FDDC" TEXT="domain-name-servers" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C4C7F18F-40A8-435F-B729-82CB945C2C78" TEXT="Default AmazonProvidedDNS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BDDB9F5E-FBDE-4A3A-94DE-6927764E396B" TEXT="Up to 4 custom IPs separated by commas" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="95EDC276-ABD1-4ED0-8E9F-991BA14C99F7" TEXT="domain-name" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="15654A99-F960-488C-8E12-367B07C668B6" TEXT="Default internal AWS domain name for the region" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="742CA1B1-10EC-4F99-A8C2-23BAD10FA602" TEXT="ntp-servers" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="15B52660-D480-4F9D-BEDF-2758AFF4ED60" TEXT="Up to 4" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="6AE39743-09CB-4A94-81EB-6B21D410F65D" TEXT="netbios-name-servers" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="97604632-7767-4DFF-9952-0D09665E82C9" TEXT="Up to 4" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="8EA358BA-027E-4045-A4F0-5168FB493846" TEXT="netbios-node-type" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="0DE10BFA-8F70-4CBF-A38E-133D90E3CABD" TEXT="Set to 2" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="74D2285D-F452-42C5-BA04-74A15E1545EB" TEXT="Each VPC can have only 1 option set assigned" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="047C7F83-F8B4-4B0B-A5C9-B43B37EDCFAB" TEXT="AWS DNS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C53777E8-B135-4EEB-98EE-9DF4DB6865FA" TEXT="Built-in DNS resolver, not Route 53" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="3FF62EF5-C187-475C-A31A-94888F3F60DE" TEXT="Can integrate with Route 53 private hosted zones and AWS Directory Service" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="F0FB68BD-E34A-4481-B691-79C0898F6D33" TEXT="Base CIDR + 2 IP" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="71CA3E2C-5100-46A1-B733-5CAACC12F477" TEXT="Also 169.254.169.253" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="12C860B3-B031-46B9-9EFD-62D9352FB64D" TEXT="Flow Logs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B349C6F6-8BA9-4CC5-B524-5EC3A41664FD" TEXT="Similar to NetFlow" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A4DE0ECC-D004-4772-84BE-EB57E83337DF" TEXT="Published every 10 mins" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00D9AB" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="1C06DD46-D2AF-4F7B-9E7A-F9098A62D427" TEXT="Advanced VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="795AC605-AF8C-48BA-9BE2-88F1AF3B9672" TEXT="VPC Endpoints" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="DA141788-0C53-4E65-BA24-3337518541B4" TEXT="Allows private connection from VPC to AWS services without IGW, VGW, NAT, or public IP addresses" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B3CC66A0-B65F-4627-B724-449F8464B761" TEXT="No need for Direct Connect public VIF if all AWS services you need to access can be exposed through VPC Endpoints" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="47C13041-5DB8-4712-A8ED-FC3C8556FE17" TEXT="Some services like S3 can be limited to VPC endpoints via bucket and endpoint policies" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="2DEEBC0C-D117-4900-A61B-E1F74CC11E4B" TEXT="Endpoint Policy is an IAM policy for controlling access from the endpoint to a specified service, but does not override/replace IAM user policies or service-specific policies" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7B5AC9DD-5EA6-4162-A691-767CC583DE23" TEXT="Default policy = full access" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="A0B0CAA4-39CE-418D-8A15-6D6614F5B554" TEXT="Gateway VPC Endpoint" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="77A609EB-9F0E-4742-B5FB-C95B4F479CFA" TEXT="Serves as target for VPC routing table" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F466F099-19FE-4E23-9BB7-BE2B6359BBBC" TEXT="S3 and DynamoDB can be accessed. A prefix-list is added is added for subnet routing tables and security groups" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="BF9960AD-2E77-4CDF-A963-11FC578E9A05" TEXT="Interface VPC Endpoint " COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="543D2955-4595-4464-885A-1AD0A9C8FB1A" TEXT="aka PrivateLink" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4ACE41DA-95E6-40CE-BF9C-84E607A7036E" TEXT="Appear as ENI inside VPC with local IP" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F87B4289-429D-41B3-BB36-A44CC245BA7D" TEXT="Accessible from Direct Connect, but not from managed VPN or VPC peering" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="0414381A-3510-4236-B9C3-FB17575829B1" TEXT="Supports 1 interface endpoint per cloud service per AZ inside a VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="79708F9E-D891-4D28-ACBD-799FACD502D6" TEXT="Each endpoint supports 10 Gbps per AZ" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="FF257A01-B3D4-4CB8-9EE8-9252F8075A39" TEXT="IPv4 only" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="9917D469-CFCE-4DE1-A662-2E7F423BCF55" TEXT="AWS services cannot initiate requests to resources in the VPC through the endpoint" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="06BB5AF5-21A8-4A08-B9E9-AEBDEC2CCBE5" TEXT="Can be used for shared services across VPCs and accounts -- service provider / service consumer scenarios" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E029F5E2-25D8-4047-B6D9-E0EC1E475879" TEXT="PrivateLink vs VPC Peering:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="0C16D372-9921-479C-8FA6-67D008A57388" TEXT="VPC peering should be used when there are many resources in both VPCs to be accessed (and security/trust levels are similar)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F8D52098-A05A-4BAA-9CA5-44F1A0F96761" TEXT="VPC can peer with up to 125 VPCs, but PrivateLink can scale to thousands" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="CEA4E123-E4D6-4F07-B76D-90B280A675A0" TEXT="PrivateLink reduces complexity when only one application in the VPC needs to be shared" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="223FD1CD-CC11-4835-A80E-BDCE580EF871" TEXT="VPC peers require non-overlapping CIDR blocks to communicate, PrivateLink uses SNAT on the consumer side" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="401C8F7D-DBE9-4374-B0A3-6BF8491D7D49" TEXT="SNAT in this case does not preserve source consumer IP address" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="78A29DE1-966B-4B52-8CE3-44B18D5E4270" TEXT="PrvateLink only allows consumer to initiate connections to provider -- endpoint needed on both sides for bidirectional communications" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D52235DF-D27A-481C-9F98-373974202E4E" TEXT="PrivateLink is load balanced and has same considerations as NLB such as requiring TCP" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="534A0B1B-19AA-4BF5-8D84-9303101D8096" TEXT="Provider side configuration:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="CFD6F41C-BACE-413D-A071-F24275F514A5" TEXT="Associate NLB and AZ with the service to expose a single address per AZ and perform SNAT on incoming connections" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4B6360AB-8D88-417E-894D-86C085944027" TEXT="Create endpoint" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="FD1C2592-58E5-4250-BCDC-2F06705D6697" TEXT="Allow access to endpoint" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="C13D2F3F-6C2D-47C3-94A9-15CA2DB39BED" TEXT="Transitive Routing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="1D9AD367-EB6D-4823-AF49-5D63A1F6D540" TEXT="Either the source or the destination of a packet must be an interface local to the VPC or the traffic will be dropped" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="07FBFB88-7509-4B2F-B43B-BF14319A9749" TEXT="Purpose is security by preventing spoofing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="988BE341-6B73-44AE-BC02-3862F6E4BD5C" TEXT="Exception is VGW / CloudHub" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="1A241F22-5844-4D45-B87F-9EE80AC0BF35" TEXT="When using proxies, routers, and NAT, disable src/dst check" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="265B0B27-388E-468A-8C56-D8BBC421F9D5" TEXT="IP Addressing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="F2ADCB66-767E-4F3D-8644-CEAC691940C1" TEXT="VPC resizing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="196DA599-5C8C-45F6-9607-EE63301D348F" TEXT="Add up to 5 additional CIDR blocks to a VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="61C45DF6-50DD-446E-A3D3-7E735E5ECCA3" TEXT="New CIDR blocks cannot overlap with existing or of any connected VPC peer" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="C3579D24-284B-425D-A466-559620AE4E5F" TEXT="Only new subnets can use the new CIDR blocks" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="749F8A3D-B25D-4C0B-ABD6-6E8A1EAF0A97" TEXT="If an Elastic IP address is accidentally released, you can try to reclaim it through the AWS CLI but there is no guarantee" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="DBCE0860-E47D-40B4-BC09-6D421372465B" TEXT="Cross-Account Network Interfaces" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="336808C2-0C02-4F82-9E1D-FCE31C498608" TEXT="Allows an ENI to be attached to instances in another VPC or account" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="84FB9443-B586-45C5-BAA8-5A172F13973B" TEXT="No HA / fault tolerance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="861D09E8-F1EB-476A-8240-3CCA917A08E7" TEXT="Must be in same AZ" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5B046B4E-7379-416C-87FB-E8C7B2D07E4D" TEXT="ENIs limited per instance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00DA00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="1DF8C898-E0A5-4121-98DF-338DBF66B3C3" TEXT="VPN" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="AAE07BE2-3973-4427-B028-52CB3BF86BAB" TEXT="Site-to-Site" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="9AA94C4B-3745-4359-8F30-F0F36076B079" TEXT="Virtual Private Gateway" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="00BA0B77-B61F-4DF0-A345-DA3F5043E1E3" TEXT="Attaches to VPC, only 1 per VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="51DFEF2D-223E-4BFE-8EE2-E434938BF36E" TEXT="VGW has two IPs (each in different AZs) for two VPN tunnels for HA" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7578C7F9-5EA0-4718-9934-E1B07315ADC7" TEXT="IPsec ESP mode only" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="9CD51E69-7559-42F0-9A30-971F5D8F6BDA" TEXT="Each tunnel is a separate IKE SA, IPsec SA, and BGP peering" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="152555CA-ECB2-4934-86E8-8B9574FA5705" TEXT="Only two SAs (inbound/outbound) permitted per tunnel. Some policy-based VPNs attempt to use multiple SAs which won&#39;t work" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="77EB0719-5816-43A7-A9F2-25E13A80D835" TEXT="Optionally define private BGP ASN (16- or 32-bit) upon creation. Cannot be changed later." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="62209AEA-C6F5-48DE-8D83-BCC65A62BDB2" TEXT="Up to 100 propagated routes per VPC subnet route table" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="37BC0A2A-1295-4888-984B-915DBA64E317" TEXT="Supports AS prepending and MED" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="2A6A2F30-8753-463A-AE51-57F60F3A0C87" TEXT="Recommend using tunnels as active/standby via BGP prepending or MED" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="B85EE855-199C-4A0A-A670-E1EE155CCD78" TEXT="Supports NAT-T" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7CBC388B-5A54-4B0E-97D6-9CCE3C75A881" TEXT="VGW CloudHub functionality acts as a site-to-site VPN concentrator and BGP RR" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="3F448999-B5B2-4823-842A-BBB893323FF5" TEXT="Spoke sites can send/receive to other sites through the VGW. BGP ASNs can be same or different." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="8554B430-03A7-4832-88BE-9EC314C65234" TEXT="VPN creation specification:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="75856E9F-5589-4E39-A391-2C1BA26DF6DF" TEXT="Target VGW" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4E5D418D-1AE0-433D-9604-BD8E1284B691" TEXT="Customer gateway IP" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="8FBE9966-8507-4290-89D3-850C9DEABC3C" TEXT="Routing method: static or dynamic via BGP" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="70868E80-0F97-476A-BAEB-611D12490D32" TEXT="Tunnel configurations:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="CB8D4E38-9301-48EF-A1FB-320B3177797B" TEXT="Default" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="8977DE9A-06FC-499F-9AAB-97E9E06F4F8A" TEXT="Custom" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="43E7C34B-6EFA-474C-8C63-E112D9E453C0" TEXT="Specify tunnel inside IPv4 2x/30 from 169.254.0.0/16" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4BDD308D-CCB2-4CC5-A7D9-A30C933DFE09" TEXT="Specify PSK" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="9982B351-0668-4296-AEBA-94C469E8677D" TEXT="IPsec parameters cannot be changed after creation" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3C77D981-41B5-497D-9777-70B2E42C6AC4" TEXT="AWS Management Console can generate configs for devices like Cisco and Juniper" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="943AD359-3EEC-4DEC-8453-FB97E34D930C" TEXT="Client-side must initiate VPN connection" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="46FD473B-9B53-4DDE-949D-C6D27CD7223E" TEXT="DPD 10 seconds" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="22FD90A6-0A45-4FAF-B254-16B2C5490BA3" TEXT="CloudWatch monitoring: Tunnel State, Data In, Data Out" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="D16CB241-75C9-4E8D-AE70-F851A7C184A5" TEXT="EC2 Instance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="BB07897E-24F2-4E69-B3C7-D60374EC3B16" TEXT="Use cases" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="13586B65-03A4-4D12-AC59-5304B0F86AA5" TEXT="Special features needed (e.g. Advanced Threat Protection)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="64D8E17A-AB94-462F-9C33-7CB96CB085E4" TEXT="Non-IPsec protocols" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="8DBA6BC8-B430-4CA5-B1FF-6F1011AC64D0" TEXT="Complex networking (multicast, transitive routing, etc)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="40467DC3-81AA-49A6-B829-E435E7B4FC32" TEXT="HA considerations" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7015EF44-E52E-4392-94CD-5931919414E8" TEXT="Only a single instance can be used at a time for a destination prefix in a VPC subnet because routing tables can only have a single next-hop per-prefix" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4360910E-4B41-4FC5-989E-20A8129DCCE1" TEXT="To provide HA with multiple instances for a VPC subnet, a monitoring script must watch tunnel status and re-program the route table upon tunnel failure" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="159E76E6-4D05-45D2-90EB-21257E023749" TEXT="Be careful with instance auto-recovery and Elastic IP addresses" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="EEF007D3-EE51-4BA0-9CF1-286B91C831C1" TEXT="Some AWS Marketplace solutions take care of these considerations for you" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="A6DC1409-2B39-4457-A16A-0AB122EF237B" TEXT="Deployment options" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8D7FA5A1-A173-4DF8-A0BE-F3A8621426D6" TEXT="AWS Marketplace" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E1918B4F-3579-4C8F-BDDB-C2516F79A416" TEXT="DIY" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8E625864-F1CF-4AA8-9D47-34512C4CB8AD" TEXT="Adjust ports in security groups if the other end is to initiate the VPN session. If the EC2 instance initiates the connection, the stateful SG allows the return traffic automatically" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="52E3123C-1AE4-4047-B207-BEB431F5894A" TEXT="Disable src/dst checks and enable forwarding at the EC2 instance OS level" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="18098645-1F1D-4717-A8D6-E6602A610B94" TEXT="Monitoring is based on EC2 metrics. Custom metrics can be pushed to CloudWatch via API" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F49C8147-9364-4C6B-B447-EB9003F30FBF" TEXT="Performance depends on EC2 instance type and placement groups. Performance within a placement group can be up to 25 Gbps, and up to 5 Gbps outside placement group" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="3C3AD88D-047A-44B9-BDEF-09215D8E7AA5" TEXT="Performance due to vertical scaling will reach a throughput threshold where larger instances won&#8217;t make much of a difference" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="093F9F34-BDD8-4377-8A2B-D1DD1FF08496" TEXT="Vertical scaling" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="80A3325B-ECDF-420C-83D7-E4AFBC6B98EF" TEXT="Within AZ, option to terminate VPN tunnels on multiple EC2 instances, then use an unencrypted intermediary instance to perform the final routing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="44FC0088-1192-49FB-A7DC-AB752FA0F126" TEXT="Return traffic does not flow through intermediary instance unless NAT is used" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="6E0F2613-0202-4A62-BB90-9E84D6794812" TEXT="Multi-AZ deployment option could terminate the VPN tunnels on instances in separate AZs, and then communicate to the intermediary instance with GRE or other tunneling mechanism" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="DDF40134-2CD2-4E23-BB43-6E5F9F2917EE" TEXT="Horizontal scaling" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8FB720F0-0404-48CB-94DC-174AA433D2D6" TEXT="One option is to have an EC2 instance per VPC subnet to terminate/route VPN tunnels" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="14B30736-57C5-4695-9D74-F4F62538FA3D" TEXT="Another option is to have multiple EC2 instances in a VPC subnet and split the destination network. For example, if the corporate datacenter network has the destination 192.168.0.0/16, have one instance route for 192.168.0.0/17 and the other instance route for 192.168.128.0/17." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="B9B65C58-C2E9-4110-A45E-0E57515F8015" TEXT="Customer Gateway" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="412E0D87-10E9-490C-A944-8CF30A0CC098" TEXT="AWS term for customer premises" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="05327A49-D032-4AF7-B88E-FCE1FBEBD2B2" TEXT="Can also be EC2 instance in AWS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="FB913DBB-F7F4-4C34-831C-69ED550918B5" TEXT="Any device that supports the IPsec requirements should work with VGW" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="75A10CF4-77E0-4F4C-A917-D347733562E9" TEXT="EC2 VPN instances can use any mutual protocols" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="7B217D70-4397-4A8E-9CFE-4D34DE2CAF4D" TEXT="Client-to-Site" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="78C45A38-4EE3-43E5-B89A-B2EAF0131EC1" TEXT="aka remote access VPN" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A2ACC25C-BC87-42DF-AF23-83775F3B89BE" TEXT="AWS does not have a managed remote access VPN. Use EC2 instances, which have the same tunnel termination / routing implications as the site-to-site VPNs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="F3D1010A-8A30-4423-9AF1-0745C5F9ED73" TEXT="Likewise, there is no AWS managed VPN client" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="AA4F8ACC-23FA-4CDC-B811-8F0284A16935" TEXT="Design Patterns" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A937157A-E96D-4102-B778-AF754206FBD7" TEXT="Connecting on-premises network to AWS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="190EA7DE-756A-4043-9781-940C65A3D972" TEXT="VGW recommended" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="735EADD1-05B4-4070-9669-8F2AF44B10CD" TEXT="Connecting with high-throughput requirement" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B2024ACD-78F4-49CA-900D-44BCC2670A95" TEXT="DirectConnect recommended for up to 10 Gbps" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="655AB53E-A0F5-4752-800E-D0A34FB30226" TEXT="Higher-throughput architectures with Internet transit are possible with EC2 instances" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="AC1D05E6-8A7A-45AC-A674-1E369D61F929" TEXT="Connect to a VPC with advanced threat protection" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A021A63C-5AD8-485E-97F9-DFA4A4CA1384" TEXT="Custom EC2 instance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="3EDFF662-963A-46E8-BAEE-7AC392DB6DEF" TEXT="L3 encryption between EC2 instances" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A70A66EB-E530-48D8-BECD-4F6FF691FE16" TEXT="For security/compliance requirements, even though traffic within a VPC is private" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="F1564A71-A55E-4B00-AB16-C8C883799B0C" TEXT="Enabling multicast within a VPC via GRE" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="9535D9A4-0575-4601-8D57-CD85DA69F399" TEXT="L3 encryption over DirectConnect" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="5E89EE03-F27D-4CBC-A557-8B5A66037CB9" TEXT="DX link not encrypted because it is a private connection between you and AWS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="F39568D5-CBCD-4300-8C86-361696336D4D" TEXT="Transitive routing via overlay VPN" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#D1D500" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="4FA53382-B7F9-4B9E-952C-0EE286930C9D" TEXT="Direct Connect" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="24950524-E381-4B21-903B-42B70FD1EC2B" TEXT="Basics" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="06BF1C9B-C95C-4DB7-A89F-D2CE636204E5" TEXT="1G/10G private connectivity" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="330FB0D1-801E-43A4-9E83-686F6FAC6A4F" TEXT="Sub-1G through partners" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="52FAA529-6B60-4367-8734-23D5742407AC" TEXT="802.1Q and BGP required, BFD optional" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="B138F70D-D01D-4262-8844-43997FA46842" TEXT="Physical Connectivity" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7764B603-70A8-4850-85CE-9F9CC2B0C88A" TEXT="DX locations" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="810A24DD-306D-4CC7-98C1-5060C01D03CE" TEXT="via carrier hotels" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="47A37B43-1703-465C-8A3A-B2F8DC3E7B1E" TEXT="Diverse connectivity to all AWS locations except China" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="B0A4340B-9584-43BE-80B0-0FD45CE04BE2" TEXT="Dedicated connections" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="3A7E57D0-6EE5-494F-9EAB-A1A25761E6AA" TEXT="SMF 1310nm" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B5EA0634-6BAF-4333-A8CA-E7428925318F" TEXT="1000BASE-LX" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3CC03593-E52E-4724-948B-2ABA5969FD31" TEXT="10GBASE-LR" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="F0AD1313-AE86-47D9-9767-BB77D86AA1DE" TEXT="Provisioning process" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="9956F74C-055B-4F93-ADA5-514973633D2F" TEXT="Request connection through AWS MC, CLI, API" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B234FE30-5A7E-4EA0-97FC-4DC6B5440C5C" TEXT="AWS provisions the physical port within 72 hrs and provides a downloadable Letter of Authorization (LOA)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="572F35D0-0FE3-4824-933F-54D5497202F0" TEXT="Establish cross-connect (partner/facility may take care of this for you)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="74254770-79AB-4949-8D03-A7B72084A408" TEXT="1/10G LAG up to 4 links, all terminating on the same AWS device" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A35213F1-CA4F-4FE5-BB32-57EE02E96F33" TEXT="You can set the number of links that must be active in order for the LAG to be active. Useful so that a downed link doesn&#8217;t overwhelm the LAG." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="FBAC340B-FC50-487E-B03E-54E9D137C563" TEXT="DX partners" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C8A005B0-B462-455D-A763-53AED409AFFA" TEXT="Members of AWS Partner Network (APN)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="01ABBB5C-BB95-4A75-B4E7-A5CFC6502F0C" TEXT="Hosted connections via partners provide sub 1/10G connectivity options" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BBAE6D41-FD82-49E1-8870-1AE4C5A77547" TEXT="Frequently used to connect AWS to existing MPLS L3VPNs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D1B017BC-EAC6-41B2-B22A-CA09720C04C0" TEXT="After method of delivery from partner is agreed upon, you provide the 12-digit AWS account number so they can provision the interconnect." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="2C5AED32-5226-4A5A-8E59-F8F6B0A0C642" TEXT="After accepting the connection in AWS, you are then billed for the port hours in addition to any fees from the partner" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="5AAFA65F-96CF-4B85-9DD5-A8492DCF0D2F" TEXT="Logical Connectivity: Virtual Interfaces" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B25F6174-22E8-4C77-B91E-9D925F643EFE" TEXT="Configuration Options" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="3B280827-C883-4E41-BDC2-2B1C5429C102" TEXT="VIF is an 802.1Q tag and BGP parameters" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="88F0050C-6888-47A2-BB89-95726AAFC9B9" TEXT="Type (public/private)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="FAE5DEAB-9ECA-45B1-84AE-49C19277B760" TEXT="VIF name" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="62D6DA71-AFC6-47A8-BE1F-270C921BC158" TEXT="VIF owner (account)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="EFA0F70A-807B-49BF-8897-9E940FAAD322" TEXT="VLAN (must be unique across VIFs)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3B94A3A5-9FA1-4436-AE27-C98A9B94247F" TEXT="IPv4 or IPv6 primary peering (other AF can be added as a second peering)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="2446298B-761C-49F1-97A3-91EA9B0CFD44" TEXT="BGP ASN (private ASN or your own verifiable public ASN)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="01691CFB-DA77-4A1A-85A6-52F5ACC2D98F" TEXT="BGP MD5 key" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5EF65A69-081F-46F4-875F-F1798F0C99BF" TEXT="Each VIF is associated with a single VGW (attached to a single VPC or DX gateway)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5ACA79F5-F151-4263-A8C3-F6CC4794FBF7" TEXT="DX supports up to 1500 IP MTU (1522 L2)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="B4C95F47-45A9-4885-A193-C228908F15F5" TEXT="Public VIF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="EA4A3E5E-82D3-49E0-A3F8-31FD870AC996" TEXT="Reach all public AWS IPs (except China)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5FE5B2AB-65F6-4E3D-8A65-3B8211AD5EBD" TEXT="Uses public IP address that you own" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="944DC439-0D91-4D3B-9FB2-516D730D716C" TEXT="You must contact AWS support if you do not own your public IP address" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="096FF88A-C8EE-413E-A920-AF9F0683DF8A" TEXT="Used to enable direct access to AWS services that are not reachable via private IP in VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="2C07C593-2B04-455C-AC49-B4759751040B" TEXT="You must specify the prefixes you will announce over the connection (up to 1000)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="C98F5465-A915-4E45-BA94-F7ECEDEFD8AA" TEXT="Private VIF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="424760FC-53F0-4BFF-BC4F-CBD16B8058D5" TEXT="Access private IPs in your VPCs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="529646D5-3B50-4B70-8322-0D4020D3F786" TEXT="Uses private IP address" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="AF69CA15-0345-4C7E-9AE0-94CA4AAEBFE6" TEXT="You can announce up to 100 prefixes (including a default)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="AAE6AF31-E28A-4261-BBDC-6C47098472E9" TEXT="If you need more than 100, create summaries and then use more specific routes within each VPC route table" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="62732411-33BA-4E46-B55C-7532D572BFE1" TEXT="DX Gateway" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="5AF78829-DF04-47EB-9092-4E3C37F6EEFC" TEXT="Enables you to associate a private VIF with multiple VGWs in either local or remote regions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A44E12F1-AC09-45CE-9C99-E394BC36DF52" TEXT="Customer router has peers with DX gateway and receives prefixes from all associated VPCs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="CDC3ECA0-F405-497C-935E-EA41612D1B4C" TEXT="Hosted VIF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C728C370-479E-4C18-BD44-6D918CECC6EB" TEXT="If a different account is specified upon VIF creation, it is a hosted VIF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="1A3BEBD4-BB86-4628-8F9E-4BAB8601A6E2" TEXT="DX account owner gets charged port hours" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F7634532-2700-484E-8B2E-9C8B701A79A7" TEXT="Account specified for hosted VIF gets charged data transfer fees" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="4A19639E-51F0-4161-8489-852086D69782" TEXT="Resilient Connectivity" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="081B8D56-1F97-4D87-BEA0-9C1449228CA8" TEXT="Single connection" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="BB6C2492-6741-4A71-8B5A-021C8EF83FC6" TEXT="No physical resiliency, use VPN for backup" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="9E7C93A5-C73D-4445-BE02-4063E729D68E" TEXT="Dual connections single location" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="3FEC3245-5C32-4143-9C24-E2A3056C0A4B" TEXT="LAG still shares hardware fate" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D24AAD9D-1454-4FD8-B1B9-FBBB5395A7C8" TEXT="Dual independent connections (non-LAG) has reduced risk" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7E1F431B-95D2-4B9D-9314-2FD1DBF122D7" TEXT="VPN backup still recommended" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="4A7268DF-4262-4D6A-8A8D-535D4C187F03" TEXT="Single connection dual locations" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3C70840B-EF3F-415D-89BF-BB3AF87C8DD7" TEXT="Dual connection dual locations" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E6B31690-1FB4-439B-8240-C54269E62EC9" TEXT="Highest level of resilience" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="76C5A69A-8BCB-4FB5-A18E-AF3864DA28C6" TEXT="Backup VPN still recommended" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="EDD961DB-F4B2-4AE9-8133-DBBB9B5B2B6D" TEXT="If designed for 25% utilization, this design has the highest number of supported failure scenarios" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="02FF513E-065B-4D31-9D10-500BF456F628" TEXT="VIF configuration" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="6AACC067-1BB2-41BB-8DF2-0E41BFCB2BA8" TEXT="Public VIF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FF4D62ED-A090-43B6-BB49-C96AAC2E4653" TEXT="Each has a unique public IP, but announces the same prefixes." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E3526427-7187-4ED6-AB0F-EEE8E9E0E8CB" TEXT="Traffic engineering possible with longest-match routing and BGP AS_PATH prepending" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="BED64D5A-97AB-42E1-838D-45C2C24E4D62" TEXT="Private VIF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="CA77BE8A-0899-4109-98C0-4D04AE5FC422" TEXT="Similar to public, but associated with a VGW" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="47C681F8-653F-4E48-86D9-2E4C5EBE5093" TEXT="TE is also similar, but you can use ECMP from AWS via BGP if the same prefix is seen with multiple identical paths to the same location" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B9D54925-28A5-455A-BB7B-9AE7CB11A6F2" TEXT="Traffic is hashed per-flow" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="5564F63D-BC87-48D5-9322-2291E32386E5" TEXT="BFD" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="34657B94-44FE-49A0-A798-5C4ED535F04C" TEXT="Asynchronous BFD is automatically configured on the AWS side 300ms x3" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="B090964E-DB2B-49A3-B4B0-18BD2BD41954" TEXT="VPN with DX" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="798B44D0-A175-4C56-B974-7D3EBB78EE0F" TEXT="Backup VPN" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FBA379BB-7957-4DF6-9085-5718B84FF68A" TEXT="DX and VPN both terminate on VPC VGW" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="26B8D6DF-A52B-4774-BB35-EB47A5964053" TEXT="From VGW, outbound traffic prefers DX before VPN for prefixes advertised on both connections" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="507CBC9C-1B06-46E5-A162-E2714F59CA7A" TEXT="Longest-match routing still applies" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="FB9752A5-002C-4149-A0E4-783819262586" TEXT="VPN over DX" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E6415422-A9B7-4009-96EB-AE079DDD6336" TEXT="Layer 4 TLS is preferred method" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A31360D1-A58A-4CD0-B756-3E8C30516667" TEXT="Layer 3 combine public VIF with managed VPN" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A875703B-1F41-493A-8710-CCA02BE9E818" TEXT="The VPN endpoint you create will be reachable over the DX link since it is an AWS public IP" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="FB13D2B6-2800-4427-A83F-C8C31F8EB0FB" TEXT="Transit VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="05BB1DE3-507F-4151-9ECF-1BDDCCAD3AD7" TEXT="VGW is not attached to a VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="74FEE3E0-349C-4F06-888E-2D30655ECC67" TEXT="VGW acts as hub / route reflector" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F054F553-74DF-44D2-A2AA-7C6FEE84439F" TEXT="Attach private VIFs to the same VGW" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="F6D21D1B-3EE2-4AA6-BB2B-BE234735EEA2" TEXT="Billing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="38E0EBE2-7751-478B-8C5A-83B436FF20D7" TEXT="Port hours" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="67AEF060-E272-4FCB-91AA-194986F7B44A" TEXT="Starts as soon as the port shows &#8220;available&#8221;" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="57B56D12-9F71-485D-8FEF-C2514744579F" TEXT="90-day window for partner / cross-connect" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="90FE10C7-ECA1-4D22-8230-911D9E8F276B" TEXT="Billing stops when the DX is deleted from the account, not when the status is &#8220;down&#8221;" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="97E367E8-5602-4E25-BFBE-0DF33F8AF675" TEXT="Port hours always billed to owning AWS account" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="4C86FEBE-FA94-4F41-A83E-7088DEF02A53" TEXT="Data transfer" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="297E4F28-C3ED-4DB7-8A30-EA29487195E4" TEXT="Charged outbound from AWS only" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B0FB520D-F0E6-4462-A050-BB7A1B042AAC" TEXT="Transfer charges for DX are less than Internet" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="8DD91CF4-7A9C-410B-A278-6E9054A64B78" TEXT="Data transfer charged to hosted VIF account owner" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A41964E0-6250-4EC7-98C5-569AD3AB0150" TEXT="Data transfer to/from AWS resource not owned by you over public VIF is not charged" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="6EE41434-15B9-471A-AC2E-B6DE82C08B51" TEXT="Example 3rd-party hosting website in AWS -- if the site is accessed by you through the public VIF, you will not be charged data transfer fees, the site owner will be." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0081BE" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
</node>
<node ID="2F8CD838-907C-4602-9B00-3FCE364426B3" TEXT="DNS / LB" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="351F2634-7957-46A1-8948-D706B7CCDCE3" TEXT="DNS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="4BD89FC3-1AD1-4F82-B406-7F774FAADB3A" TEXT="EC2 DNS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="09A83D8D-4A00-4781-88C1-ABEF23CBA97A" TEXT="VPC options:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="62364CB6-C042-4532-9836-2DBA65E21CC3" TEXT="enableDnsSupport" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="12AD36FD-866F-4651-A06B-1F2C221C4651" TEXT="True = 169.254.169.253 and CIDR + 2" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="CFCB22BA-34C2-48E3-8961-0607C3317AEF" TEXT="False = No AWS resolution" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="C934898D-DC0C-4429-9A45-04EE472E1054" TEXT="enableDnsHostnames" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FE7739CC-8DBD-4C2B-8A77-AED792827F61" TEXT="EC2 instance with public IP also receives public hostname (if enableDnsSupport = True)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="2FAAC52F-B8B4-471E-9B86-61309E9AB77C" TEXT="DNS customization options are limited. Use Route 53 for full control" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="1E3D8D3D-D2BF-4792-90C7-F4036B2953B2" TEXT="DNS on VPC peering if both VPCs enabled for DNS and &#8220;Allow DNS from Accepter VPC&#8221; is set to Private IP" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D47E4694-30A5-456D-AD01-124EB076A29B" TEXT="Option to run your own DNS resolver in an EC2 instance. This enables hybrid architectures whereby public DNS requests are forwarded to the Internet and DNS requests for AWS resources are forwarded to AWS DNS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="B0A482C6-E854-4458-8EB4-4750C345CBDA" TEXT="Route 53" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A629C3A6-E447-48FA-B1AE-E014979CE8C7" TEXT="Domain registrar" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="F646ED08-F8C9-4E87-8DB6-53C493929D2C" TEXT="You can use Route 53 whether or not your domain name is registered through AWS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="175CFA0E-2208-4616-A3BB-8D7BF07CECD1" TEXT="AWS can also be your registrar while your DNS zone is hosted elsewhere" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="76CF82B8-0F3B-4317-8620-6E30C566398E" TEXT="DNS service" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B738E232-E59C-4DFD-85C1-3855F4710083" TEXT="Hosted zone created automatically when registering a domain name through AWS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="DA75CFFB-C054-488A-A337-2BA1A923B5C4" TEXT="Monthly charge per hosted zone + DNS queries" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="79110235-3977-49C3-943E-B04B6DCA3850" TEXT="Hosted zones can be public (Internet-facing) or private (VPC-facing)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="0D26058C-7269-44E4-843A-8C4D1EFB6E4D" TEXT="CNAME records point to another hostname, whereas Alias records get resolved in Route 53 and the final resolved IP address is returned to the client" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="8A6F4AD5-78F9-45A1-A85E-909A8EF84627" TEXT="Routing policies:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="19424EBA-5194-4AB7-843D-A14C8BCB806B" TEXT="Simple" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="4963D106-CFF1-414F-A799-184696A97A87" TEXT="Single logical resource for a given function (e.g. load balancer)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="18B4E76A-63E0-4ECC-A154-108EDD699BE6" TEXT="Weighted" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="15AEB35D-934E-47B6-923C-2EAC8F060AB0" TEXT="Multiple resources perform the same function with proportioned distribution" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="78CBC628-6276-4C24-BDB8-9A7D0F8D3ACE" TEXT="Set weight to 0 to disable resource" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="7175F693-F9AC-4647-B5D8-DC79E8E2E3D5" TEXT="Latency-based" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7A67A3AF-B347-4546-A02F-9F4FA89EEE11" TEXT="When a resource is available in multiple regions, Route 53 can use the client&#8217;s latency measurement to respond from the region or AZ with the lowest latency toward the client" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="B5ED14AE-8916-47A9-887B-1F7B86DDB6DC" TEXT="Failover" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="F70E3656-213F-4AC8-BD9E-0832A90A18FC" TEXT="Active/Passive" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4918CDEC-F19A-4397-B3D5-D7D487F56A6B" TEXT="Only available for public zones" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="0F9B5FC7-0BF4-4AC1-9DE9-5E81521A17C5" TEXT="Useful for production / disaster recovery" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="A42027A4-A7D7-49CB-90B3-09F32CB114C6" TEXT="Geolocation" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="4C4C6F19-30C2-400F-874A-4F543329E06D" TEXT="Public zones" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5572DC95-1467-4D84-9C8F-6A2499DDB902" TEXT="Ensure you create default resource records for cases where the location cannot be identified by IP address, otherwise the client will receive a &#8220;no answer&#34;" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="611BD9F9-1DBB-445D-8BBA-84AC9186DFA6" TEXT="Multivalue answer" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="31C32BA8-009C-4FE9-8F91-E4820FC7E613" TEXT="Can be tied to health checks where only healthy values are returned to the client" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="9DD6D8FA-B114-4E46-8B82-ECAF78C42087" TEXT="Traffic flow" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="D2F3070C-0D24-4413-ACD7-6A38F25E96A1" TEXT="Graphical editor to create DNS decision trees" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="C8DB2D4D-5B45-4907-8BF0-C68AA60347F2" TEXT="Geoproximity" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="CD7722DA-076F-4CDB-A420-56F9ABD2D41A" TEXT="Biased records based on latitude and longitude" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="C259002F-88FB-400D-A980-7EA65DB3ACC6" TEXT="Health checking" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7AB4EA35-3CB3-4D0F-9491-59465E682995" TEXT="You can specify resource, protocol, timers, notification method, and actions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
</node>
</node>
<node ID="C0993DE1-4CCF-419B-9F5F-8791E5BA9F59" TEXT="ELB" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B5BFA413-9ACD-4B63-AFB6-96D92784662D" TEXT="Types" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="75AEBA26-7EF1-472F-AA67-50387B690B64" TEXT="Classic" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="157CE25E-572C-472A-A34D-945AC4B09002" TEXT="Predates ALB and NLB" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="44486B69-0AC9-440B-AA67-7540D089CEDA" TEXT="Required for LB with EC2-classic targets" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B7A208FB-E270-460C-AA81-F45D9F6B640F" TEXT="IPv6 support" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="DE8CF723-2BE6-449E-AA20-D995E45C01B4" TEXT="SSL offload" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="F43B1E19-782C-4840-AA80-39C087E57CD2" TEXT="Application" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="699B3A98-F52A-4BBB-9677-47BA4480E129" TEXT="Useful for path-based routing based on HTTP URL" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="6EF0091C-D606-428B-BBB9-E23CD7B5CEC9" TEXT="Route requests to multiple services on a single EC2 instance based on port" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="0755CBDC-A79D-4018-905A-92AC145CCB44" TEXT="IPv6 support" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="EE3A7240-D41A-4A15-BF07-A81614E2FE3B" TEXT="SSL offload" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="2298E8C7-9AF0-43C0-A1F6-D900B9B25DC3" TEXT="Network" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="EDA974AD-BA07-491E-820A-A5AE4D9BAC4C" TEXT="TCP only, IPv4 only" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B97C8E44-723C-48B4-A018-888F18379285" TEXT="Supports static IPs for the LB" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="230F6F7E-3380-48A7-BC00-DABFA444BA7A" TEXT="Can register targets by IP address, including those outside the VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A30670FE-9D40-47F7-898F-542E2E543699" TEXT="Flow hashing is 5-tuple + TCP seq number" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="7B576985-46C1-430B-BF9D-0C06D4EE5DA5" TEXT="Concepts" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="9EECBFB3-C180-48FE-A174-B8467031A8CE" TEXT="Listeners" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="4842B2E3-B905-4D5B-9FE9-6F017C4248F4" TEXT="Process on LB waiting for client request" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="C1EFCCE8-708E-4D78-A7E8-F8A8F2EA201D" TEXT="Listener Rules" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8CCC71DC-20C4-447A-BCB3-7CE180241572" TEXT="For ALB" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F5475E27-9F04-4999-AC60-7E3EA8C9D6ED" TEXT="Rule priority: lowest to highest" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="C5C1D81F-8736-4CF6-A98F-4B41C3611284" TEXT="Rule action: type (forward) + target group" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="51567002-ACBD-47C9-BCF6-7CC0D3BA0E38" TEXT="Rule condition: host, path" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="C0BAEEC2-7323-4636-B722-602A16930D69" TEXT="Targets" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="77C05F18-B7FC-4C06-8A99-5E8576A20E4F" TEXT="EC2 instance (by instance ID)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="4F0B1899-7C32-40E4-8F04-1157E4808C17" TEXT="Allows for Auto Scaling groups" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="D8ACCA92-6DB7-499A-AFE9-FF4C51F86283" TEXT="IP address" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="7170AB50-AB0F-44E2-8A67-883BB98A2329" TEXT="Target Groups" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="6CF34C49-2DD4-4C57-B698-C54CEDC1D5D9" TEXT="e.g. collection of EC2 instances" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="853F8317-5ECA-440E-B263-11BFD2B4F929" TEXT="Actions (and health checks) can be performed on the entire group" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="4F7871F3-E352-4C83-8E04-6D5AFA6A338F" TEXT="Configuration" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="60BE50A5-F24F-4A84-986A-64B54514E3F3" TEXT="Idle connection timeout" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A7F291B6-6CE8-45FB-87F5-F92794A36AAC" TEXT="ALB / CLB" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="87F68BBE-12E9-4C76-B1E2-63E19AA163CE" TEXT="Both front-end and back-end connections" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="111F1D78-D978-4825-825A-742E79870BF4" TEXT="60s default" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3C650BAA-0749-4555-BCE7-32355AB1DAE0" TEXT="Adjust for lengthy connections like large file uploads" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="37ED6F51-73E9-446C-B611-59313FAEC739" TEXT="Cross-zone LB" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="EC2D2E42-D833-4753-87C6-8AC7E1C63FD1" TEXT="ALB / CLB" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B15215E2-B656-4E08-92D7-72E2073C39BC" TEXT="Utilizes all back-end instances regardless of AZ location" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="8E13DC97-4533-4AD7-89C2-F1C9E7B18817" TEXT="Connection draining" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8E0CFC8C-1CF4-4C65-800F-D7469B7D265F" TEXT="Timeout 1 - 3600s, default 300s" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="95C26CB1-BD47-4756-9837-9A6241EF876E" TEXT="Proxy protocol" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="0FAD1988-A405-46DD-9ECC-8A4F33DEE59E" TEXT="CLB only" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="DF9F2344-10C2-42EE-B42F-9B4ECDC760B5" TEXT="Injects source IP, destination IP, port numbers into request sent to back-end instance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="1E179FEA-BDE7-41A1-9491-86A5FA853AAD" TEXT="Don&#8217;t use if LB is already behind proxy that is using proxy protocol" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="AD619CBA-544F-4156-AA24-E8554BE91679" TEXT="ALB uses HTTP X-Forwarded-For header instead" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="4130A013-2007-4951-B950-6CE4DF1B9F40" TEXT="Sticky sessions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="33E47465-BFFB-4760-ABA6-6FE5450A9920" TEXT="ALB / CLB" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="6B49E206-4398-4140-AA1C-62B86F1F91C3" TEXT="aka session affinity" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5A3BD6A1-C393-4295-AF95-7F51AB79933F" TEXT="ELB can create a session cookie to specify the duration" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="052298EC-4FE3-45EE-B9A1-51BDE646B13F" TEXT="Health checks" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="0FDCDFFE-48F5-44AC-B656-9BE003AC4E90" TEXT="CLB uses simple InService / OutOfService health checks" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="89A262FC-C85D-43A7-A17E-CDFF8CA52D5C" TEXT="ALB / NLB require registration with target groups" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="9EB71AD8-C3C3-42A7-AB1F-F48665E49AB0" TEXT="Target check states:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A1BEA3A4-8380-4D39-9DFA-5E00A45503BB" TEXT="Initial" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B7C728A0-FAD2-4163-A426-B15CA274FF80" TEXT="Healthy" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="DABC1FF6-3CBC-44B3-8E7F-9842022FD0FE" TEXT="Unhealthy" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="C1C6A3FA-3B6A-428E-90AE-E67CA4AE7091" TEXT="Unused" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E42CF859-D9DB-46EE-B080-0EB5118B2C28" TEXT="Draining" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="CF32A813-8AB5-424C-96BF-1C3D24945E8C" TEXT="ELB Sandwich" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="53C88CA3-68B4-4CA7-BE7C-E9AE8002B68F" TEXT="ELB used in addition to virtual appliances like F5 BigIP, HAproxy, nginx, etc" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="AC180B8F-7C7A-4114-9E42-38228DFC9EA5" TEXT="ELB serves front-end users, appliance is used behind the ELB for additional features like enhanced rule processing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00BF91" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="CFA2BCCB-9F83-456A-B05B-FDC0B0018B5C" TEXT="CloudFront" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="79D82F77-ED79-41AE-A68A-107448A2EFF6" TEXT="Client is routed to nearest AWS edge based on latency" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="67084A1C-7052-402A-ABF6-7AD691120F54" TEXT="If requested content is not present in the cache, it is retrieved from the origin server, then cached" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="C34AD51A-07C2-4562-85CA-5B9DB08D1789" TEXT="Supports all content that can be served over HTTP/S" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="DC9D85C7-3126-4EDC-9C67-A4A6483F9FC6" TEXT="CF also supports RTMP for media files stored in S3" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="6FF666CE-8612-4C59-BD84-1C406832B417" TEXT="CF is enabled by creating a distribution which is identified by DNS name" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="DF07D437-FAED-45B2-859B-B1D98C5B328F" TEXT="Must specify DNS name of origin (S3 bucket, web server, load balancer)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D27456DD-B5D0-47DB-A9F7-8033E05F80D5" TEXT="S3 bucket can remain private while distributed with CF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="CF13D522-C98B-46F5-BF24-AB4DC621ECA9" TEXT="RTMP streaming requires a web distribution to serve the media player, and an RTMP distribution to serve the media files" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="931993F5-608F-4CCB-BCAD-8EC7C9C1F170" TEXT="Streaming can also be done with the Wowza Streaming Engine which stores the media files in smaller chunks at the edges" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="044F5E94-0EC0-4677-AECD-082138EFFEE9" TEXT="Default cache TTL is 24 hours, can be adjusted" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7C3DD019-4E0D-487B-90B0-530FCA056D79" TEXT="Invalidations cause the objects to be re-cached upon next client request" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="5C50CD40-502F-4C77-9E43-591B43095C99" TEXT="Regional edge caches are larger than edge caches and act as an automatic intermediate caching tier" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5A2D9408-BC29-4199-8A1A-3F7C58D7A33B" TEXT="Cache Behaviors allow custom caching based on content" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="02D525CC-A829-4B8E-B79A-CF40A4DC0F6F" TEXT="For example, images sourced from S3 while php files are sourced from an EC2 instance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="11F17084-5ED4-45FF-A243-5ED6F2866B7A" TEXT="CF has a potential performance benefit even for uncached content in that it can potentially re-use existing TCP connections between CF and the origin, whereas clients going direct to the origin will need to establish a new connection each time." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="399F2D5B-EB7B-48FE-A252-7A75507F260A" TEXT="CF can also deliver content via HTTP/2 even if the origin server doesn&#8217;t" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="EC8AFFF6-1468-4C62-9FFD-14F7F42474D1" TEXT="You can use your own domain with CF, including wildcards, but wildcards cannot be partial. Example *.domain.com, but not w*.domain.com" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4E3853EC-7A2A-428D-89D4-33EF245F1EE3" TEXT="For HTTPS, you cannot use a self-signed cert between CF and your origin" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B9138BD8-D2B0-47BA-8BB2-21580E563538" TEXT="HTTP 502 is returned if cert is not valid" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="9621F790-8B45-440E-AD2A-B1074C33690E" TEXT="ACM (AWS Certificate Manager) simplifies CA operations" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="584C7D1B-FFE0-46F1-9B1B-1B50860DDACE" TEXT="ACM certs must be imported in the US East (N Virginia) region to use with CF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="C4C2C740-B7AD-4112-AFF0-8955B6EFBEB8" TEXT="Object invalidation: first 1000 invalidations each month are free" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="DD76F50D-C123-4210-A545-D1D53F00F00A" TEXT="CF can create access logs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BFB8B61E-D397-416F-A89A-F3E572E4C5E7" TEXT="CF can be used with Lambda@Edge to run Lambda functions closer to the user" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="25F81959-70C2-4584-B246-ED7BBBB0D015" TEXT="CF field-level encryption encrypts data before being sent to the origin server" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="94946880-7DE0-4F7F-A1F8-ADFF674ECC80" TEXT="Data is encrypted with your public key" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00C000" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="D0EDD9CE-E509-4C5B-868A-2B1E7BAB72D5" TEXT="Network Security" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="6198E268-9C74-4573-8206-9DEF04705060" TEXT="Governance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B623DBEF-1AEA-4673-BB5F-59F577286439" TEXT="AWS Organizations" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E056EA13-752C-4995-93B5-517E7F837A7D" TEXT="Centralized management for multiple AWS accounts, consolidated billing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="66D6F2FC-A3AC-4CFA-8766-F2CCE7B0F64F" TEXT="Service Control Policy lets the designated primary account define policies to restrict what secondary accounts can do" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B3C60031-A283-433D-A552-03B1F867DFAE" TEXT="AWS Organizations support programmatic account creation" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="EB44F00D-B921-4E57-BDA0-583AC8570B37" TEXT="AWS CloudFormation" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="52429B83-C941-48EB-BF58-CF1A28EC51C5" TEXT="IaC via JSON or YAML" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="8D9C7C26-869F-460A-9070-99C7DF296DF7" TEXT="Resources are managed in a &#34;stack&#34; which is the target of create/update/delete actions from a template" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="F15D6C1D-A019-44AE-B2B0-7A7A51538831" TEXT="AWS Service Catalog" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="03858FED-1FD9-4644-B33D-9F06529BAAEB" TEXT="Provides deployment consistency and governance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="8C881A8C-85B0-475C-8E25-EFD8AB439A79" TEXT="Combines IAM roles (launch constraints) and CF templates" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="84877F67-7C41-4889-AB4B-B710AC46BC9D" TEXT="Data flow security" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="DCDA457B-0BA5-4041-85BF-30E7DDF1A46A" TEXT="Edge locations" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="EAB482CB-71EE-47E8-A0EC-65A6F5048172" TEXT="Route 53" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="339AA572-D46B-4178-B6A3-D78775E39560" TEXT="Only AWS service with claimed 100% reliability" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="355990C8-C21E-47CF-A756-29E0D0CA0D8B" TEXT="Uses &#34;shuffle sharding&#34; to randomly assign hosted zones to the underlying infrastructure to prevent correlated failures. Example Customer 1 and 2 shards hosted on the same server, Customer 2 gets a DDoS which affects Customer 1. Shuffle sharding guards against this." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="93A2D026-A210-42F8-AA0C-B1A9F936CC63" TEXT="Anycast striping is used, along with resolution via major TLDs in case any of them become unavailable" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="9B0CE2EB-BCDE-428A-8028-E15F67C7045B" TEXT="CloudFront" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="AF066F5B-3162-4EB6-B1EB-21DFF6A2E4CE" TEXT="Ensure your origins are accessible only by CF for better DDoS protection" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8BABF8F5-B0C4-4360-BF78-5F5C3C366B79" TEXT="Use Origin Access Identity with S3" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="61FA13F6-6CE0-4322-B6B0-EBBFD32DC142" TEXT="Custom headers" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="E8264DA3-90A2-42D2-9660-CB32F67F79F7" TEXT="Field-Level Encryption encrypts data in HTTPS forms with field-specific encryption keys" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="2F572260-5E1D-4DF7-97A0-7A23E6A5CB59" TEXT="Lambda@Edge" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E8198313-2C93-4C41-8173-486F6E992C11" TEXT="Execute lambda functions within CF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="859E8DAC-94D1-42DD-9365-50062A3216CC" TEXT="Edge locations and Regions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="BDA776C4-8648-4BBE-9F74-BA7E73895AA2" TEXT="AWS Certificate Manager" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="1DA1AB76-6F47-451F-AC8E-DE6019FEB876" TEXT="Certs are region-specific" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="964255E8-1CCE-4634-9DC6-2D68CCBD8A80" TEXT="Certs used with CF must be specified in the US East N Virginia region" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="595785C4-1332-4187-A89C-E24FFFDE9F04" TEXT="AWS CM-generated certs are free and you cannot download the private key" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="BBB4058A-5146-4693-A0E3-651D53B737FD" TEXT="AWS WAF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="54ACF7DC-8F7A-42D2-B5F3-79A5155CA67E" TEXT="Uses Web ACLs consisting of rules and conditions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="D13A6F25-4151-40A2-B7B1-79518E529805" TEXT="Rules can be regular or rate-based" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="876B9597-3A1D-441D-88DA-39E6C82BCB3A" TEXT="Regular rules allow, block, or count" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="FEB2EE43-90A0-4218-9971-BA45AF265C1B" TEXT="No conditions on a rate-based rule means to rate-limit all incoming IPs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="09086F8C-4C10-4B7E-992F-C79DDB74AB7D" TEXT="Condition 1: XSS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="43B9D1EF-76C5-463C-82C6-E71AC2AF9B81" TEXT="Match requests containing scripts" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="DF69C38B-E45A-4CFE-A3C2-77CFA740EBA6" TEXT="Condition 2: IP addresses" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="245F45F0-E3AF-46AB-9E51-48AC3EBC3106" TEXT="IPv4: /8 /16 /24 /32" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="9CD93B7D-3F1D-4B7B-87DE-D9D8CD301E7B" TEXT="IPv6: /24 /32 /48 /56 /64 /128" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="145D64CF-610C-47F6-B60F-534971BB23BB" TEXT="Condition 3: Size constraints" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B506603D-C221-4D75-B282-342F666F9C3D" TEXT="Condition 4: SQL injection" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="2DF8B316-917A-40A1-BE48-6EAA2C85AE4D" TEXT="Condition 5: Geographic matching" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="42902614-42CD-4174-BB25-AB056314BD7A" TEXT="Condition 6: String matching" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="9BC6458E-0B66-401F-B4AA-767406B732A2" TEXT="Match value can be text or base64" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F1BF50DB-1016-402C-B471-E29C3B63C9C9" TEXT="Regex supported" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="8768B284-64A1-419F-AB7B-C2C5BF63003E" TEXT="AWS Shield" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="2E251E17-1B6A-4307-BDF9-849B4EE28476" TEXT="Protection against DDoS attacks" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E4AEC143-46AF-4B7A-9B7F-893A4AD43A83" TEXT="Standard is free, always-on, protects against most common attacks" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="CCE3C1A3-3FF7-4076-AD31-F3C5A76223FA" TEXT="Advanced protects Layer 2 and includes 24x7 DDoS Response Team support" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="EE4F7E1A-2904-413F-AB52-49DBB6974571" TEXT="EDoS Economic Denial of Sustainability -- your service may not go down, but your cost to absorb the DDoS might be more than you can afford" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="15AF4DDD-8CC6-45E5-AD15-2119F34028F7" TEXT="Absorbs some of the usage costs for some AWS services as part of Advanced fee" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="E218EBA3-9ADA-4A3C-B8F5-DC9ED5BC4E0F" TEXT="Regions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="5ED0EC5B-CB7B-486B-865A-55BF91B3CA96" TEXT="ELB" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="4279F9A8-8DAE-4C4D-A216-723EE68F8660" TEXT="Minimizes attack surface by only accepting connections on defined listeners" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3105385A-F831-4559-911B-62EE1D7BB18A" TEXT="Common attacks like SYN floods do not go past the load balancer" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="1D115B41-09D4-47E2-A3DC-A269C750F02D" TEXT="Subnets and route tables" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C1399CD3-F453-400C-8732-2863291A4B99" TEXT="Use tools to keep your traffic private such as VPNs, DirectConnect, PrivateLink and VPC Endpoints" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="3D05DFD9-7C35-4C26-A4B1-569171EAAE5C" TEXT="SGs and NACLs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FC7AC821-D0E9-4096-BE06-B6D4D549F28D" TEXT="Some services allow you to reference a SG so you don&#39;t have to specify individual IP addresses" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="96BF448D-97BF-4E8F-9C31-285E504C9A39" TEXT="Plan your subnets carefully around intended function. Keep aggregation in mind." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="8BEFA38A-4179-4C37-9AA9-FD649FAA4D19" TEXT="EC2" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="72DA5176-BE3C-484E-A848-A33E702EB819" TEXT="Customer responsibility to secure EC2 instances just like VMs in a private datacenter" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="1D0323ED-CD0D-41CA-9604-3433F29D6E85" TEXT="Regional services" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="157925D0-45DD-432F-9C80-CE7E8BD9D75E" TEXT="AWS services residing outside your VPC. Use techniques like encryption and account-level restrictions to secure" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="3809C0CD-3B58-4399-8C02-7A365A70E9CE" TEXT="AWS security services" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FB6CF7BD-5DB5-4FDD-AC32-110A2EB8E2FC" TEXT="GuardDuty" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="52064106-A34A-4D01-852E-DA968FE9617B" TEXT="Threat detection for AWS accounts and workloads" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="1AAABF2C-61AE-48CF-8829-07750EA21148" TEXT="Analyzes events from CloudTrail, VPC flow logs, DNS logs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4BB274E5-9BC9-45F7-8F65-8AE4C23B3655" TEXT="Designed to identify active threats in your environment" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="ED72551C-7228-467E-AAB7-0097C1F14277" TEXT="Inspector" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="19884B18-6D32-404B-8B29-ECC14AE9BC5F" TEXT="Analyzes VPC environment to identify potential issues" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="8B773221-2B8B-4E22-BCFE-AA8971D1E831" TEXT="Assessment is run against EC2 instances" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="20218B63-ED89-4736-B28B-F93B9AA96760" TEXT="Macie" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="3188F9BC-0CAA-4A03-A6E0-125CEAF45DAE" TEXT="Uses ML to identify potential threats" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="C8734CE6-0E6E-4E31-A418-4C9BF97E22E2" TEXT="Can discover, classify and protect sensitive data automatically" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="41FE9A65-0FC0-4C2A-AAD5-A64028DE7816" TEXT="Automatically learns jargon and internal product names and estimates associated business value for objects within S3 buckets" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="7DE3D070-4DEC-47CE-8256-D4B690FF4B36" TEXT="Detection and response" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B5919C97-D996-4E1B-B93C-498FBB8F2EB1" TEXT="Failed SSH login example" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C96039AB-B0A7-4A8E-8735-914E585FF0EC" TEXT="Different AWS services can come together to detect, log, alert, and potentially remediate several failed SSH login attempts" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="04EE7729-DFCD-4B8F-B8A2-D5989EC1C718" TEXT="Network traffic analysis example" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="27A8498B-61C6-4425-8878-841EC433D7CA" TEXT="Different AWS services used together for anomalous traffic patterns" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="A649C4D1-4C77-4351-8940-5B3066E530D3" TEXT="IP reputation example" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="9E45B8CB-5BD4-467D-B591-951EE96A3834" TEXT="Automate WAF web ACLs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#B7BC00" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="DAE667C0-548C-4DDC-8867-9B0D53259441" TEXT="Network Performance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="4EC0E9A1-0732-4247-9990-2F636DCA5FA9" TEXT="Basics" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="219F3CEE-8E7A-44B3-91F0-D49200F5F8EA" TEXT="Bandwidth" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="2225BF54-1BAB-4002-AA3A-40E46A63C655" TEXT="Latency" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="042236E7-BF72-4F3A-9E18-F5D17499C4D8" TEXT="Jitter" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="746B0E28-466B-4DC0-A9E0-694FA38D194D" TEXT="Throughput" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="66FDE65C-8D76-4497-9855-ADEA1F9B1BBB" TEXT="Packet loss" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="EB68574C-A707-40A3-AE5E-C31928BEF7CA" TEXT="PPS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E6351418-2F21-412F-9081-8D8C3C3E4728" TEXT="You can monitor PPS on DirectConnect links with CloudWatch" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="AA0EA8CC-43D1-401C-A11D-592C09E407B0" TEXT="MTU" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="0DD06AF4-4D39-4C60-B000-17EA689807FC" TEXT="Up to 9001 within a VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="00233089-AE88-4271-9C2F-581EF34A7A61" TEXT="Standard 1500 outside VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="7B1DFB46-2585-45BC-A68C-02A4723EEDE6" TEXT="EC2 networking features" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="9E308076-0D58-4D2F-B9A8-74B28AB70C04" TEXT="Instance Networking" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="78584F92-BAA0-4968-9305-9D743C798224" TEXT="Placement groups" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="1BDE60BE-3440-4AD3-B948-69A596FDFEF0" TEXT="EBS-optimized instance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="3FF539AF-23B9-496E-9157-C83071C61C50" TEXT="Dedicated throughput" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="63C86B7F-9FC3-4A62-BE92-EAE6952F498C" TEXT="Maximize IOPS with larger volumes and block sizes" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="97CC7426-642F-4752-BC56-3D8477E2DBAE" TEXT="NAT gateways" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="7EB1BF6A-6690-42FA-97B5-E486D4816A01" TEXT="Enhanced Networking (SR-IOV and PCI passthrough)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="24E3FA0C-1712-45CA-9809-B15D3C612073" TEXT="Drivers" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="69CEEAAD-C007-4DB0-86C0-24AA3654B31B" TEXT="Intel 82599 VF interface" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="AAEE09A5-D64C-48E4-A65D-81A8B5362628" TEXT="Amazon Elastic Network Adapter (ENA)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="FFEEB6BA-87B5-4FD9-B059-991AF803A26C" TEXT="Enabling" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E9D6C77F-BD84-4711-AF5E-83BDDB7925C4" TEXT="Enhanced attribute set on AMI" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="E733C1B2-BC8C-4ED9-9B63-EF0D45887A75" TEXT="OS support" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="4DD42217-1DFA-4327-B1CF-E444F3D7E255" TEXT="Windows, Linux, FreeBSD" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="AC35FFAD-7C15-4A31-8032-B1A4F7063121" TEXT="Tuning" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="2FC6ABDF-EBF7-4AB8-A6FD-695D8DBC413F" TEXT="DPDK libraries" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="E58176DE-1A5A-4782-BA4A-D03B7F65ADB1" TEXT="Optimizing performance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="55E9A9D2-DF18-4393-958F-E1B8ED9AADFC" TEXT="Enable Enhanced networking" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="19FE4E40-E770-4215-92AC-7151AE2B24C7" TEXT="Jumbo frames" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="97918B8B-67DA-4D68-9A6F-C6EF45CDA67C" TEXT="Enable in VPC and OS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="6E7D1473-1A01-48CF-805E-902A0833FA2D" TEXT="Network credits" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="87F1F5C4-4D94-4FF9-899C-C0BB4D8DBCB6" TEXT="Some instance families can use credits to burst traffic" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4E11A818-36E1-45DA-9E6F-366C8C9BF9F3" TEXT="When baseline testing, take burst credits into account" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="20887A60-594A-43B2-8EF7-9B0385D2AFCD" TEXT="Instance bandwidth" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="6A1B3EDA-5377-4A25-A0CF-64948B95687F" TEXT="Determined by instance type and network driver" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="A67CA784-3EF5-4FF1-8A0A-450A73CCAB58" TEXT="Flow performance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="70C0854C-DFDF-4B6C-963D-555F06F311BC" TEXT="Single flow 10 Gbps inside placement group" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BE8605D7-7622-44E8-86B7-E1555A446813" TEXT="Single flow 5 Gbps outside placement group" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="D2FD136F-5B95-4616-945E-F9631CE6E701" TEXT="Load balancer performance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="898C0A52-8545-403F-AFAE-C78229190E14" TEXT="Use NLB instead of ALB if you do not need Layer 7 inspection" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="2282C4B8-7E80-4485-BF5D-A232141DE87D" TEXT="VPN performance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="0D638940-42F3-4DEB-9E65-941368960B83" TEXT="VGW 1.25 Gbps per tunnel" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="2C483428-8A94-41F1-AA7E-912CBA8A0BD3" TEXT="DirectConnect performance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B30C600D-9A06-4BBF-936E-FAA4D2343BC1" TEXT="10 - 40 Gbps (LAG)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="CF70DF4B-1FD5-4C42-B0FC-C3DA88230EFA" TEXT="QoS in a VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="AF2B33FD-A90D-4BF1-A85D-07D68E647FD4" TEXT="QoS is not acted upon inside a VPC, but the DSCP values remain" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="C7B694E8-36CC-450A-A129-2B8AE5FAA283" TEXT="With DX and a SP that honors QoS, you can have QoS from your datacenter up to the AWS edge" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="CB5E49FE-8E1F-4934-A44D-5F5F3186D739" TEXT="Example applications" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A134710F-1756-429A-99B6-8586B3EAD14B" TEXT="HPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FCE3F0B2-0EF5-4AD2-B0F5-4E44D6310A04" TEXT="Use placement groups and EBS-optimized volumes" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="235A721A-90C3-4F3D-A6F2-73A463AA1DD6" TEXT="Real-time media" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="32507EE7-FA84-492A-8BFE-C3A4E0910580" TEXT="Use enhanced networking and DX for lowest latency and jitter" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="775E5508-C9D2-4628-8499-F7C5293CA334" TEXT="Data processing, ingestion, backup" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E93CF643-4131-4CC9-81A8-A006252D7EBF" TEXT="On-premises data transfer" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="807EBD50-6903-4F6F-83FE-0069C802247B" TEXT="Network appliances" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="EBA331A8-169C-4774-845C-DAC0B8436CA8" TEXT="Performance testing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="25B4A983-B4D3-465C-AC22-8000B12B5034" TEXT="CloudWatch metrics" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E990492F-8871-42B2-BC5F-A8464DF9E840" TEXT="5-minute metrics default" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A3F645BA-977C-46AA-B3B2-5F37DEEBC43B" TEXT="1-minute available for extra cost" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="33668A65-38EC-452E-9622-E0F284364676" TEXT="Networking: bytes and packets in and out" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="0209E66F-90EC-4BB4-8866-6628E3F0353D" TEXT="VPN: tunnel state, bytes in and out" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="AAA96896-4235-479E-B1E1-60EC230FFD8E" TEXT="DirectConnect: Connection state, bps/pps in/out, CRC errors, light levels" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="7C668EB6-6F40-4513-9344-A7721F070827" TEXT="Testing methodology" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="832B0B34-B90B-4A4F-B6D4-20D7C4420020" TEXT="Throughput testing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="783B15B1-F66E-44A7-8BC2-BD6D550A2C0F" TEXT="Enable enhanced networking for optimal performance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4991BC72-B8FD-44FD-BD0D-E184081BAB6F" TEXT="Test the target application type flows" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="F6B68782-C152-46AB-9CD0-554B13B5BE8E" TEXT="Solution testing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="061646D2-283E-4055-A916-652E617B79F0" TEXT="Use CloudWatch reports to determine bottlenecks" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3C36DDDF-CA64-4A97-B7E8-31238EF219B0" TEXT="Use automated load testing tools" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="8B8CB8BE-5654-4BFB-A9AD-C7EF04E88BDB" TEXT="Use packet captures on the instances" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#4400A6" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
</node>
<node ID="EB4FEFBE-323F-4239-BEFC-7AE7BADED574" TEXT="Automation" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="0BB39D64-E25B-4322-BC84-489680EC06F2" TEXT="IaC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="34FA9C88-A233-47A4-BB22-0A4F8ED24407" TEXT="Templates and Stacks" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="938418A7-7331-4AEF-83B9-B15CFAB13F30" TEXT="Template contains AWSTemplateFormatVersion: &#34;2010-09-09&#34;, description, and resources" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B23852DF-7E97-4910-B152-573ED3D0773A" TEXT="Create CloudFormation Stack by referencing JSON or YAML file" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B8C184C5-AC14-461C-A584-FC20773175C6" TEXT="aws cloudformation create-stack --stack-name MyNetworkStack --template-body file://my-network-template.yaml" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="2" /><font NAME="AndaleMono" SIZE="14" /></node>
<node ID="6DB13A80-3690-4288-AD19-2B678B9E32BB" TEXT="aws cloudformation describe-stack --stack-name MyNetworkStack" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="2" /><font NAME="AndaleMono" SIZE="14" /></node>
</node>
<node ID="E8C91099-109F-4D4B-ADF6-BA34112FA051" TEXT="Update existing stack" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="5CAFA3DB-9398-42E7-B9E0-E0C3AA368630" TEXT="aws cloudformation update-stack --stack-name MyNetworkStack --template-body file://my-network-template.yaml" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="2" /><font NAME="AndaleMono" SIZE="14" /></node>
</node>
</node>
<node ID="7CC87FB1-3F35-4052-ABB7-8521D7541A6C" TEXT="Stack dependencies" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8CAE0CCC-617F-4265-ADFF-C6F205310814" TEXT="CloudFormation recognizes the dependencies and creates objects in the correct order" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7C22F54D-F2FD-4F63-B182-FF0CF6342C0F" TEXT="Use &#39;DependsOn: Variable&#39; to ensure a particular object is created first" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="3D5BE909-EC89-49F9-A169-8091C315AF77" TEXT="Example creating a subnet which requires the VPC ID which has not yet been created" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B59361AA-FA7F-4D15-8FB1-DCC156BA9DCF" TEXT="You can refer to the necessary value with &#39;!Ref Variable&#34; in YAML or { function: variable} in JSON" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="9EF3B093-9C31-4DD5-8B66-150FD6CDF20A" TEXT="Resources:
  # VPC definition omitted
  MySubnet2c:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: us-west-2c
      CidrBlock: &#34;10.17.1.0/24&#34;
      Tags:
        - Key: Name
          Value: MySubnet2c
      VpcId: !Ref MyVPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="2" /><font NAME="AndaleMono" SIZE="14" /></node>
</node>
</node>
<node ID="B770702A-E66B-41EA-B89C-9C8F62E2B801" TEXT="Errors and rollbacks" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="221AA672-5372-49D9-B086-25162755CB85" TEXT="Notification of validation errors occur immediately upon creation or updating a stack" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F4315E00-F019-41B7-B353-697D2A5A8D0D" TEXT="Semantic errors are not detected until attempting to create or update a stack" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="62B0F2CC-0BFD-4C2E-921B-82D978956ED3" TEXT="Example CF tries to invoke an API call but the API returns an error" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B3F2D12B-DD08-4776-9BED-DF8FC032FD98" TEXT="Rollback to previous state is automatically attempted by default" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="0EC08CDE-64E7-483C-B10E-6D1D736AA4BD" TEXT="Template parameters" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="396E286E-21F9-4AFD-AB5D-ADD0AFEDE164" TEXT="The Parameters block within a template allows aspects to be specified upon stack creation/update instead of being hardcoded" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="1D1DE5D2-6442-405A-98CF-FBD0518E7D2D" TEXT="Parameters include AWS type (e.g. VPC), value type (e.g. string), default value, input validation (including regex), description" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="A3D0D39C-6D3F-48A0-9BC9-A023C203B9DD" TEXT="Verifying changes with Change Sets" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="292BF0C2-2B77-4A1B-9261-944622578BF5" TEXT="CS lets you visualize and approve/validate the changes before they occur" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D7825ABC-7C51-42D7-B069-7929E3C0556B" TEXT="CS is created from a current stack" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7C13DFBD-C606-4ED5-8C19-A44A63C1452E" TEXT="Once the CS is approved, you can Execute the stack, otherwise you can Delete the CS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="88427273-4C33-4A3A-8D48-B45FDDA3C576" TEXT="Retaining resources" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="D7626628-09DF-46BE-AC2A-4B487BAAE56B" TEXT="When a stack is deleted, all associated resources are automatically removed also" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="570D5CAC-8ECF-4E8A-92E5-981A9D9EF316" TEXT="Add &#39;DeletionPolicy: Retain&#39; to any resources that should remain if the stack is deleted" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="23369BB6-FE34-4FBC-A75D-D060F19E79C0" TEXT="Example, stack to create network resources, but once they are created, the stack definition is no longer necessary" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="3DDD228E-C403-406A-B71B-AD7AF53CEBA5" TEXT="Configuring non-AWS resources" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="D8C812AF-710A-483D-896C-7A057A0430CE" TEXT="AWS::CloudFormation::CustomResource or Custom::ResourceType can send SNS notifications or trigger customer Lambda functions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="04249185-D2FA-4083-8B6D-11BA906968DC" TEXT="Example, configure customer VPN router through a script via SSH" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="3F6E4260-CDDD-4A49-A0F9-3414EC6AD033" TEXT="Security best practices" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="0FC621CD-FE59-4075-AF31-3502B4044E60" TEXT="CF uses your credentials/permissions to create a temporary session when creating/updating a stack" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="DC28A407-CD05-48F7-BE53-D67FDD5AC441" TEXT="Best to create IAM service role to specify minimum permissions needed for stack to limit what calls CF can make. This also allows a user to perform actions via a stack that their user account might not have permissions to do" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="569547D1-F202-4C68-B25B-1A9BB34CFB0B" TEXT="Within a stack, you can specify that certain resources are protected so they cannot be deleted or modified via stack policy" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="29585BF6-3D69-4ABC-8D6C-D68E76D7D972" TEXT="Configuration management" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="F5487AA8-731A-4F81-B2D5-1CAA1568845A" TEXT="AWS CodeCommit git service" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="153EA5DC-088F-439C-BCA5-8B20AE0B84A2" TEXT="Continuous delivery" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FDBD5A41-5175-4A85-B92A-D3E8799370B0" TEXT="Pipeline stages, actions, artifacts" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="CDFEC5E4-CF9F-4590-AD4C-68F85D66AAF0" TEXT="Pipeline is a set of stages, each stage operates on a single revision and performs actions (sequentially or in parallel). Stage is complete when all actions successfully complete. Artifacts are the output produced by an action, which can be used as input to the next stage." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="931BD70F-F77C-4725-BFC3-B4D45845638A" TEXT="Actions:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="801A8CDF-ED21-4DA2-941A-B3718FAAA565" TEXT="Source" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7E69BED0-E22A-4476-813D-E36700BD9308" TEXT="AWS CodePipeline monitors for new revisions and initiates remaining stages in pipeline" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="6A55098C-9132-4080-8FE8-B484942851ED" TEXT="Build" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A3D92D41-3BE0-4F93-A966-152FEB69F66B" TEXT="Approval" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7C8C9724-0E5B-4B01-A315-54FFF65F448B" TEXT="Sent to SNS topic and waits for response before continuing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="ABF268BC-387C-453B-BBF3-8F5D494879BB" TEXT="Deploy" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="DA64EDE4-AF9A-47FF-A8C5-EB9484CFA922" TEXT="Deployment providers (e.g. CloudFormation)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="3DCBC3A7-C925-4DD4-922E-1327EE552EE6" TEXT="Invoke" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="1C8C7D47-7534-4C1A-90F0-BB695DF2678E" TEXT="Lambda functions for custom actions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="F0718F90-D778-4330-82BF-CC099CDCBE7C" TEXT="Test" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="CE9A69E3-B658-4D95-9174-D6DE8B3394BB" TEXT="Approvals" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C2554359-5070-4903-BAFF-42069AF90450" TEXT="Sent to SNS topic" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E7CD73EC-8811-41AF-83B7-AB89AD29FD4B" TEXT="Can be acted upon programmatically" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="397731B9-6162-4E01-9347-6EF03A5F4A0E" TEXT="Network monitoring tools" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="D69D88C0-9FB5-44AB-817A-0D0E18856603" TEXT="Network health metrics" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="1048CB4C-42F2-4376-97CA-AAFACAFDEFB8" TEXT="Many metrics collected in CloudWatch automatically" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="55C60CA3-1C09-4CAD-9FDF-5563C6711E97" TEXT="Custom metrics can be created, organized by namespace and dimensions (up to 10 k/v pairs)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="FA5358FA-F373-48B2-B610-91AE1B4B6AB2" TEXT="You can create dashboards to have unified views" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="8A75C170-B5D7-41C5-B070-C43F84714890" TEXT="Creating alarms for unusual events" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A0DB4C36-B216-4320-8143-CE4FE3B9E7AC" TEXT="CW can send alerts to SNS topics based on metrics" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="D20173B2-186E-4A22-8219-67024A0D7A86" TEXT="Collecting text logs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="AE285071-A0F1-45AB-839F-0D8C65AD3041" TEXT="CW Logs acts as central repository" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="50B79B9F-1FDF-4D1B-98CA-9B634CBE0AF8" TEXT="Log event is the record of activity" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="2EB61ED8-7FDD-48F3-930C-1EE04AB57D27" TEXT="Log stream is the sequence of events from the same source" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="73D9B99E-1104-4C9F-B537-57ABA435CC02" TEXT="Log group contains log streams and defines retention, monitoring, and access control" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="948ED4F7-7BD7-47C9-A95C-FB3C98F21DF3" TEXT="Converting logs to metrics" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="BEA00F6B-9B67-47AE-A89D-3518A8214A6C" TEXT="CW Logs can be sent to other services for storage/processing: CW metrics, Lambda, Kinesis streams, Elasticsearch" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#0068A4" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="01C48BE0-79A6-46FB-BB3E-FD10384944EC" TEXT="Service Requirements" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="6E426A4B-7CD2-4B6A-AB80-DD64E7B99B82" TEXT="WorkSpaces" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="CEA52C41-4F35-4CFC-979F-7CE037846A64" TEXT="Desktop as a Service" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="AA3B5840-8B03-4B28-AE36-2F8AA1D08B3F" TEXT="2x network interfaces - one managed by AWS, one in your VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="76668E70-15B9-42D9-A2FA-8291210B9435" TEXT="Required supported client device or PCoIP client" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="6303482B-637F-4292-BD07-98171EC22164" TEXT="Requires AWS Directory Service or MS AD" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="29C13E1F-5B22-43E4-9A82-44AA2DC795E2" TEXT="AppStream 2.0" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C33B33D5-0275-42E2-AB68-01C6EACAB9B8" TEXT="Stream desktop applications to an HTML5 browser" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="559A3999-63F8-4C69-984D-10B52A038221" TEXT="Each AppStream instance is dedicated to a single user" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="104FCFDD-D9B7-4E36-A18C-61D614B379E8" TEXT="2x network interfaces - one managed by AWS, one in your VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="234E4064-4FE4-49C7-9254-86769ACA24B8" TEXT="Lambda (within a VPC)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FA7A2E2E-2712-4808-8A39-F0200D7EABAF" TEXT="Enough IP addresses in the CIDR block to support the number of on-demand instances (soft limit of 1000)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A821938F-48F8-4C40-B127-C30DEEAE7FD9" TEXT="NAT required for Internet connectivity. Lambda functions cannot receive public IPs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="A58876EE-920F-4D11-954F-8CDBD506FC8D" TEXT="EC2 Container Service" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="5931C210-909D-43E7-A83E-2646B5445BFB" TEXT="ECS on managed EC2 instances uses CloudFormation to create clusters and EC2 instances" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="64038F4A-918F-4E16-A921-71050B82A6CD" TEXT="AWS Fargate is a managed container infrastructure" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E907626C-EF84-4935-8B27-7A33B763CEC5" TEXT="Container connectivity modes:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C0CE44E6-B440-4012-B6FA-20F8AE1D786F" TEXT="Bridge" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="0C9598C1-82B4-4F3A-8AB7-6835CC855878" TEXT="Default, bridges container&#39;s internal network to common Docker network" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="C9DEB4C8-7BCA-4C96-AF1D-F1C892AC6ADA" TEXT="Host" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="0E29FCCD-49ED-446E-AF37-E1EE6378AE60" TEXT="Containers directly mapped to host network" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="71430629-4267-4D0A-9303-3DF58778F324" TEXT="AWSvpc" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="338F57A0-BA06-4A53-B402-3DD84E195F57" TEXT="Attach ENIs directly to container (only option for Fargate)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="B01C7BA1-6BB2-4C23-BF27-09E99E2046A1" TEXT="None" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="52F3FB75-2EC5-43F0-972A-7559847E7FB9" TEXT="Requires access to Internet to reach ECS service endpoint (either through public IP, NAT or proxy)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="A93D8686-1B5B-418D-AFB0-557B9E894C1E" TEXT="EMR" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7D8BEEE5-A65D-465B-8698-688427FA14DC" TEXT="EMR cluster launched in single AZ to optimize performance and cost" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="074F535D-835B-4222-AC9E-7B496F13E98B" TEXT="Requires DNS hostnames enabled in the VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E82C1D91-ECED-4F6F-8EDB-235ED2B50217" TEXT="Use RFC1918 addresses to avoid routing issues" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BE40FC7A-27B2-4FB2-83AE-0F86FB913038" TEXT="Access to S3 required for logging" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="12B93D0E-FB4B-4490-AA16-CCFF2FCB0DB8" TEXT="Access to SQS required for debugging" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="8BCA59BC-AF6E-4147-99F4-721F0D3EFE0B" TEXT="RDS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="25271BE0-80EF-40EF-8183-097C6EC88BFD" TEXT="Available engines:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="429A1449-8283-49FE-AD0A-40C4332E98EA" TEXT="AWS Aurora" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="72D97BE4-C49B-4293-81CD-BED5536554F8" TEXT="PosteSQL" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E49BC4D9-11B8-41AE-9A0F-6F1C7E74776B" TEXT="MySQL" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="AF6A489D-1D04-4073-BF12-8AE6C074E6C3" TEXT="MariaDB" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="57F107E3-230B-412B-B5BA-0515E798963B" TEXT="Oracle" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="360ABCEC-5549-4CA0-AB76-89941DAC4313" TEXT="MS-SQL" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="3011F294-3661-414A-946B-8C84AE488E20" TEXT="Multi-AZ HA and failover managed for you" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="E591C8F5-3705-4AE4-9466-53753DC2F559" TEXT="Database Migration Service (DMS)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="1E8096C7-2A8B-4B4A-8ABD-F4798EFB3733" TEXT="Migration from most open-source and commercial DBMS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BFAA0611-A227-4244-83F9-48C4B66E42B9" TEXT="Source DB remains operational during migration" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="478EBEBB-A2B4-4B44-BB54-6B5E372E953F" TEXT="Redshift" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A7AC6D71-0D6D-45D6-99D0-DA1E09C654E9" TEXT="Managed data warehouse" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="92D4884A-B027-4552-A671-9C57245EC7B5" TEXT="1 leader node, 1+ compute nodes" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="80CD1D84-3D4F-4166-9293-963CD52B947A" TEXT="Leader node uses ODBC/JDBC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="787E15A2-F7D8-4464-9350-8AE533C49CD4" TEXT="Users do not interact directly with compute nodes" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="160FB7E4-5DD7-4907-AFE5-30A899A41840" TEXT="Requirement for DNS hostnames in the VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BBAC15D6-A83A-4EEF-806F-48AAABA8C42D" TEXT="Enhanced routing requires connectivity to S3" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="75DA805F-25B1-4109-B520-B7348283D0C9" TEXT="Glue" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="CE5FE796-76A1-4F39-B087-9A35CCB7998B" TEXT="Managed Extract Transform Load (ETL) service" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="500CF32D-7830-48C1-B87F-24D337C15CE0" TEXT="Glue cannot be assigned public IPs, and needs NAT for Internet access" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="659440A0-4802-4132-8F3F-352C586953CB" TEXT="Elastic Beanstalk" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8E14403E-A856-4C96-96C3-2459795AEBCB" TEXT="Managed service to scale web applications" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A03559AC-56BD-4FC8-A622-9E04C9443EF6" TEXT="Auto-scales infrastructure while allowing you full access and control to the underlying resources" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="9E5F184F-3CC3-4201-A1FF-ADE97EF73F8F" TEXT="CloudFormation used to create and manage the environment" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A678" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="2ED5A6DE-3B24-4E53-A8A5-A362CFF32B5B" TEXT="Hybrid Architectures" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="012790E7-D605-46B7-9C8B-66550EC63221" TEXT="Connectivity options" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C41901A6-CEA6-4B6C-9F4C-FECBBE2C3E9F" TEXT="Access AWS resources using public IPs over the public Internet" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A9A4B17C-7DDE-4204-8FF2-9DCDDFDC5925" TEXT="Tradeoff: easy to implement, potential security and network performance issues" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="FF0A3F3E-C579-4D1C-8888-369441A1C054" TEXT="Access AWS resources using private IPs via site-to-site IPsec VPN over the public Internet" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="D85C08A6-B954-4C9F-8C64-29D1DA65BF6C" TEXT="Increased security, potential network performance issues" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="B92B2C0C-5BEE-4503-B507-DF12EBA9FBBD" TEXT="Access AWS resources over a private circuit via DirectConnect" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E1A463F3-D6E3-4D97-9609-AF696A28AFBE" TEXT="Highest performance and security by comparison" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="9571A5E1-B289-43AB-B978-F390F129BE4A" TEXT="Application architectures" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="5F652DF1-3D2A-44C6-98D8-AD9D5F95AA94" TEXT="3-tier web" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="00C1EACA-C867-443D-8236-2CD9E5F6A50D" TEXT="One option during migration to AWS is to start by gradually moving the web tier into AWS and use a load balancer in AWS to distribute requests to web servers both within AWS and your premises over VPN or DX" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="0D4AF59B-23A9-40F8-BBDA-9128CCDD939E" TEXT="Another option is to use DNS and weighted load balancing of DNS responses (some go to AWS, some go to your on-premises servers)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="EB25D40D-56AB-4024-9F4B-574D88BB6662" TEXT="Active Directory" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="BFE4EA8C-EB1E-4307-871F-4811B1320FFB" TEXT="Whether AD is in AWS or on-premises, authentication will require a VPN or DX with private VIF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="5A65659E-9280-4672-8D2F-6F014D15BEEA" TEXT="DNS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="85D55844-082E-463D-B025-18B2418D6E0E" TEXT="Same private VPN or VIF connectivity as AD scenario" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="82F2C763-2FE3-4EC9-97D2-4BCF1450C336" TEXT="Applications requiring consistent network performance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="69A0C602-8C1F-405C-84AE-8762EBD6DB56" TEXT="Use multiple DX connections dedicated to specific applications if QoS is not an appropriate solution" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3D1376C8-2608-4FAC-9229-79BD549A8A9D" TEXT="Example: 2 apps in 2 different VPC subnets communicate with different on-premises subnets. Use AS_PATH prepending to make each DX link preferred per-application" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="AECD63E7-FD0E-4229-98F0-6CAB73E94640" TEXT="Example: 2 apps in 2 different VPC subnets communicate with the same on-premises subnets. Place the apps in different VPCs, attach to separate DX gateways." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F63979DF-F3CA-46A7-9FB5-A25084199478" TEXT="(Depending on the SP) QoS is maintained over the DX link up to the AWS demarc. After that, the DSCP markings remain in the IP header, but are not acted upon. Return traffic will maintain the markings, and QoS will be in effect again after leaving the AWS demarc." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="9ED134A2-7331-4ACE-ADE2-5D97A96ADB15" TEXT="Related: Your EC2 instances can set DSCP markings and prioritize which packets get sent first, but it is FIFO inside the AWS network." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="D4A55C08-AE06-4F99-BA29-2E1647D7437C" TEXT="Hybrid operations" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="55A8733F-B8E5-4141-8005-F59D520709A5" TEXT="AWS CodeDeploy and OpsWorks deploy code and launch infrastructure, both in AWS and on-premises" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="0DE7646B-DAF5-4500-A3B7-A2D407A4ED83" TEXT="AWS EC2 Run Command remotely manages VMs in AWS and on-premises via scripting (shell, PowerShell)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4C687705-9309-4957-975E-4528109C127E" TEXT="Requires access to AWS public endpoints from on-premises (via Internet or DX public VIF)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="6DA3F2B2-71BC-4400-B73C-44513EFF3513" TEXT="Remote desktop: WorkSpaces" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="CD3958A4-EF49-4190-9502-D98B31E763A3" TEXT="Could be used as a GUI bastion host inside VPC to reach on-premises devices" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7EAAED10-C264-4315-B509-DC0B5F9FA992" TEXT="To reach WS from on-premises, use DX public VIF or Internet" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="7637AF01-A7F5-443F-A91F-A5F8E744A625" TEXT="Application storage access" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="9A202479-97B7-494B-B82E-1FD365F5EACC" TEXT="S3" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="5E8026DC-F8A7-4040-B74D-22BB7A877C57" TEXT="S3 is the only AWS public IP range that can be limited over DX public VIF because the IP range can be obtained programmatically" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FBCCE8BA-BB00-4AFB-8FAE-73E8EAC6F713" TEXT="You can subscribe to SNS topics to be alerted when the IP ranges change" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="2F458CCD-3B69-47E9-8B8E-7C304998782A" TEXT="Alternative is to use S3 private endpoint with EC2 instances acting as a proxy for on-premises traffic" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="039238E5-5D36-4607-9A5B-1E9087BDBEE6" TEXT="Elastic File System (EFS)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="61374E04-0F96-4452-B065-AE6A1A9112F7" TEXT="EFS can be mounted directly by on-premises services using DX private VIF. IPs are private from VPC, protocol is NFS TCP/UDP 2049" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="701DC535-8A46-4CE1-8EF5-4A9281BA7DC0" TEXT="AWS Storage Gateway" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A2B8ED2E-1615-4870-BDC3-DE00FE71C988" TEXT="Adds iSCSI as option for local connectivity, along with many other features" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F712127A-86F8-4BDA-8C38-24864F80FBDD" TEXT="Consider AWS Snowball for petabyte-scale data transfers" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="6A3F5F49-F009-498B-8320-4FC95FC49529" TEXT="Application Internet access" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="4C218754-6651-46B3-B383-BA1C948C5592" TEXT="IGW default" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="59093725-71BB-4C4D-92E9-3782C13C51F3" TEXT="EC2 on on-premises inspection appliances are also an option" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="125974E0-8AA4-4F7F-8FAE-E64308B713AE" TEXT="Advertise default to VGW from on-premises to backhaul all Internet traffic" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="13ED7678-EFB2-441D-9648-86CD7323DC57" TEXT="Access VPC Endpoints and customer-hosted endpoints over Direct Connect" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="81D407ED-E6F9-4394-999A-C2AF3DECD91A" TEXT="Gateway VPC endpoints use internal AWS routing and DNS and cannot be used directly from VGW or DX private VIF -- create an EC2 proxy layer (similar to S3 option)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E70D99BE-15B0-42D6-AF6B-5828855EC692" TEXT="Interface VPC endpoints and customer-hosted endpoints are reachable over DX private VIF but not VGW or VPC peering. Use EC2 with NAT." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="DD1AD410-97BE-4924-B748-7409CCE25D30" TEXT="Encryption on DX" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="CD331E09-DDC7-4DDD-A869-E7442D97206F" TEXT="Use TLS for applications for best performance and scalability" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F93AB265-C357-45DA-A7BD-853301FE0816" TEXT="Easiest method is to terminate at VGW over DX public VIF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="2D988E65-EFFB-41FA-9065-DF9B5257ECA9" TEXT="Optionally filter all public routes except for VPN endpoints" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="AF2089E0-AD82-4FF5-B0B9-019D43F54393" TEXT="Create site-to-site VPN to EC2 instance over DX private VIF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E180166E-D009-47EE-AD9C-0FA01976915B" TEXT="VPC subnets advertised over private VIF. Optionally use VRF to ensure all private VPC addresses are reached only over the VPN tunnel" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="F8D8DBFD-8819-49C0-9810-423931247178" TEXT="Create site-to-site VPN to EC2 instance via Elastic IP over DX public VIF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="849362CD-027C-4263-81DE-A5C5625862FE" TEXT="Avoids receiving the same routes from the VGW and EC2 instance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="B48FCB0D-450E-4B76-BA36-73E0FEBBFAA8" TEXT="Use EC2 instances in multiple AZs for HA" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="47CC3AC7-90DC-4BC4-893E-35BA48474A99" TEXT="Use Internet for backup if DX link is interrupted" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="5BBFFCCC-9076-49C6-B6DF-EF0D06FAD9C7" TEXT="Use of transitive routing in hybrid IT" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="4039DD17-4374-44F5-9F38-527959C3AB4F" TEXT="Transit Hub VPC with EC2 instances in multiple AZs acting as VPN termination endpoints. Hub EC2s peer with VGW in other VPCs, and detached VGW for Direct Connect" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F01E9DD2-4BB2-4679-86A4-D2A8F893FAAE" TEXT="Transit VPC architecture considerations" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E6CF72AD-157C-445B-9102-061A0995D6C5" TEXT="VPC peering vs. transit VPC for spoke-to-spoke" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="D7344CE7-1722-4510-B043-8CBF136DD3C1" TEXT="Common for multiple security zones (trusted and untrusted)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="9919B1EF-A020-48DC-B610-4605F6270706" TEXT="Peering between trusted VPCs increases throughput, availability while reducing load on EC2 instances" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A97F9685-9B91-4677-BD1B-85EE4012AF71" TEXT="Add static routes between peer VPCs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="D01FB9B0-2D36-41EB-B5AE-4E3B4BB6506E" TEXT="DX gateway vs. transit VPC for on-premises-to-spoke" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B25C6197-48AC-4ECF-A1B5-50081A79E0EE" TEXT="Access trusted VPC from on-premises directly through DX gateway instead of through transit VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="AD12A090-3984-4F4C-B5BC-A32C33D42919" TEXT="On-premises router receives two routes for spoke VPC: one via detached VGW, and one from the spoke VPC VGW. Spoke VPC VGW has shorter AS_PATH and is preferred." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="7FCAC968-E9FF-45CC-BCFA-9ACBA88A1488" TEXT="VGW vs. EC2 instances over VPC peering for VPC spoke-to-hub" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C1F40FDA-F12D-4100-9069-62F90FF41489" TEXT="Use VPC peering between hub and spokes, and terminate VPNs on EC2 instances in both hub and spokes." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="59DCE7ED-1A8B-4CFC-AAD3-EE5876AAA5A5" TEXT="Advantage: potentially more bandwidth than a single VGW can provide" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="30FCA396-D7AE-4B60-8814-5DACD5353BA1" TEXT="Disadvantage: cost and complexity" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="547EA2B2-80B5-4C6B-A5E6-22CEACBE9638" TEXT="Detached VGW vs. VPN from on-premises VPN device to EC2 instances in transit VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="751AA5A7-2129-44DC-B82D-4193C45FDA59" TEXT="BGP vs. static between hub and spokes" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="BB689F2E-8527-4D16-9F0F-980F15DCBF67" TEXT="Transit VPC scenarios" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="9ADDC7AB-B82E-4F7E-BCC5-AE538F3A243E" TEXT="Reduce number of VPN tunnels required for a large number of VPCs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="9665B30F-27FA-416E-9134-4EADCEDE4741" TEXT="Build security layer for all hybrid traffic (inspection at hub)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="69F75402-FB2F-4442-B8A4-914365C9219A" TEXT="Hub as point of NAT for overlapping IPs on-premises and in VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="AF90C97C-5A74-4056-9BEF-9FE1434996BA" TEXT="Remote access to VPC endpoints via hub" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4FF6AB84-9C15-4CAB-A78E-6C3C6BFFC012" TEXT="Remote access (client-to-site) VPN termination" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E5412261-DFC8-43C6-84A3-9DBFB045012B" TEXT="Span multiple regions for global infrastructure" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="CEC51DBB-F6BF-4E7E-973E-4B0106BE6F07" TEXT="Cross-region VPC peering is encrypted by default, so you can use GRE to connect transit hubs together" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#00A700" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
</node>
<node ID="BE443C1D-0351-44B4-9528-443E3E429386" TEXT="Network Troubleshooting" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="930BF451-57C4-482C-827F-223241C5D955" TEXT="Methodology" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="66626E5F-AB88-4287-AB7A-77B63BEC37F4" TEXT="Bottom-up" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="C670F708-1B23-4DD6-B9AA-94AE43D23D5A" TEXT="Top-down" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="7BDB9639-7B61-4ECB-AA18-0ED75EF12802" TEXT="Tools" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="D42A0442-F909-4E52-96BB-FA27C4F336C9" TEXT="Traditional" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="AF2BEA7B-E0FD-481E-893D-ACFA1AFB570D" TEXT="Packet captures" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="EB4C86D5-544B-4536-B32A-8FE4A1FBE158" TEXT="ping" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E84CDF23-55A0-4E6B-9237-A19ED61EDC94" TEXT="traceroute" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="2C1314E1-4B7F-46D4-949A-AF33A2EA10EE" TEXT="Telnet" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F58FD078-9ABE-406F-ABCE-C0EB084DB4B1" TEXT="nslookup" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="F35F6ECB-441F-4CB3-8CC3-41957A700416" TEXT="AWS-Native" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="99F3773D-13FD-4FAE-BDA9-5E0D4A0357B2" TEXT="CloudWatch" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="1B91F92D-808E-467F-AE5B-D573CAC9A87E" TEXT="VPC Flow Logs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="864B394D-9667-4014-980A-A2B267F3CF4F" TEXT="AWS Config" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="28A6E1FE-9954-49BC-86F9-68A795428E3D" TEXT="Comprehensive log of AWS resource configuration changes -- useful for Root Cause Analysis" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="76078C3D-BD2E-4F70-A9F9-05ADF6D5B042" TEXT="AWS Trusted Advisor" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FC3CE76E-EA68-417C-9F26-8F63891B7E04" TEXT="Helps optimize AWS environment and can identify where service limits have been reached" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="93013426-5FC0-4140-8BA0-F6C2051E6247" TEXT="AWS IAM Policy Simulator" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7EA74196-11AC-462F-8437-BE46E1135C7C" TEXT="Help determine effective permissions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="4417FE57-889C-48F1-875F-3959C597CCE8" TEXT="Common Scenarios" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="35CDB9F1-0E07-44F4-8208-17D8C180F452" TEXT="Internet connectivity" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FFFE0125-8F03-449B-B1EB-499041A4BE82" TEXT="Public IP assigned to EC2 instance or NAT gateway in public subnet" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="8F9E959A-C918-4E89-A556-9ACA2CA14489" TEXT="IGW attached to VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5B6A5BF6-C00F-40FE-9E93-3A3F8450B216" TEXT="Default route to IGW or NAT gateway" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="019AEED0-376B-444B-A944-F0823D5EDAE5" TEXT="SG outbound ports open" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7184D693-AEA5-4458-A645-FB8D730BE645" TEXT="NACL inbound/outbound ports open" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="97D0543F-5C32-43D5-9C70-5E0D8107F8A8" TEXT="VPN" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C0250E4C-D810-4F78-956E-32A82D648332" TEXT="Verify VPN tunnels connected" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7E4FA54E-2B93-44E4-A75E-F7CA0812AF4B" TEXT="Verify correct VPC is attached to VGW" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="901147FC-6271-40CB-88CC-A16E72550D29" TEXT="Verify BGP/static routes to VPN subnets with VGW as next-hop" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="ABEFA445-B51C-45EC-8329-8598D1523A88" TEXT="SG/NACLs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="7F2E4440-8B4C-4406-A409-A2C512B5D153" TEXT="IKE" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="3704D196-A241-4F54-8D4D-960B0C76C9C7" TEXT="Phase 1" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FEDCEF7B-8B53-49EF-9875-72322C2286E9" TEXT="IKEv1 only" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A6B424BC-CD5B-479F-B89F-5C34AC463B2E" TEXT="DH group 2" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7A5DE555-8CE1-46DC-B3A2-AB5107F2B348" TEXT="Lifetime 28800 sec" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5F3B2296-7869-4E3F-8724-9345BC6A1147" TEXT="SHA 1" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="11C27A40-6E0A-4516-A7DE-4FA11F4B6628" TEXT="AES 128" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="266CA08F-00F6-40F9-9C6E-2A854E0E10CE" TEXT="PSK" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E29321CC-B447-4624-9FA0-BB1A140D92D3" TEXT="UDP 500 / 4500 (NAT / NAT-T)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="9A5FFA75-CFD8-4D77-9323-1FDE1BF917A0" TEXT="Phase 2" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="D9815DEF-CF3E-419B-857E-17EF7AB7BCDD" TEXT="ESP (IP Protocol 50) unblocked" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BBCD89B0-FD0A-4E5D-801B-5C1B259E3921" TEXT="SA lifetime 3600 sec" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="00DDCBD3-D7AB-4388-A160-29E5A0533CB3" TEXT="Firewall ACLs allowing IPsec" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="AAD3229B-5AE6-419D-A7A2-CF0C6F100B2C" TEXT="SHA 1" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="C2D4D390-9A0B-4BA2-9053-CA724AF6FA30" TEXT="AES 128" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="47342BF6-BAEF-479F-AB5E-FE074796CE57" TEXT="DH group 2" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="997DAB25-7B7D-4CBD-BA33-1B4990ED7C13" TEXT="PFS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="EB2663B2-EB37-4CD7-85AB-F57D6DB7EFA9" TEXT="Enhanced VPN Endpoints support additional hashing / encryption methods" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="8FCC224D-DE43-4E8B-8CB6-A5F532C0814B" TEXT="Direct Connect" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8110D0FC-7B12-4E19-916C-BFB64D58F0FD" TEXT="AWS Partner Network (APN) VIFs are singular and cannot be partitioned further (single VIF)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7DFD7000-1954-4B43-B9DD-C64B2FF26ABC" TEXT="Single Mode Fiber" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="1665FEDB-F2D2-4A72-9604-190F83D5A6A0" TEXT="BGP ASN (must own if public)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3F49538B-1D8E-4C2E-938C-F908727AF6BD" TEXT="Public VIF requires your own /30" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="1794CDBA-7CF8-47C5-97F1-24FF658B049E" TEXT="Limit 50 VIFs per DX" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A2E78F04-6577-4683-8EB3-EB9149B1D86C" TEXT="Limit 100 BGP prefixes per session" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D61AEA10-5CD2-4282-A92F-47DB9EED4C9B" TEXT="MTU 1522 (1518 + 802.1Q)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="0F08A03F-40DB-4C50-8CAA-F8ECBB3F5686" TEXT="SG / NACL" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="19DC61F3-6293-4142-AAE7-B2EF00870EBB" TEXT="Each subnet route tables needs route propagation enabled to learn routes from BGP" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="07DE6E01-D6BF-4D06-BA2F-87CCFC12C539" TEXT="Security groups" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="96F0621E-F82F-4F37-B5D9-CB0968E5A50A" TEXT="Implicit deny, stateful" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="FECECACE-9FBC-4BDC-BF0D-18DD5DD3FB9D" TEXT="Limit 50 inbound / outbound rules" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="6F008072-A296-41D4-9DF7-E82CF6C87629" TEXT="Limit 5 SGs per interface" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="54D7489C-4848-4A2B-8B5F-724744D7ADBF" TEXT="Only Allow rules" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="D0533F43-3722-4CFA-B06A-07FCCAD4BAF3" TEXT="Network ACLs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8DA367B7-7749-4A9C-A3C3-1A0B81E9CAAF" TEXT="Default allow all, stateless" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="CD12899F-A487-4040-9B2B-CFF24800844C" TEXT="Return traffic may need ephemeral ports allowed" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="97BF8705-8E80-4EF1-927D-2F8BBB333A94" TEXT="Limit 20 inbound / outbound rules per ACL" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="072ECDB7-F0A1-4B5B-8403-AD150867F223" TEXT="Custom rules deny by default" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="031D83D4-D29A-425A-8F01-2F4CE336171B" TEXT="Rules processed lowest number first, first match is processed" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="497D438E-B89A-43D5-A48C-21150D6DE4C0" TEXT="Routing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="AD9F626F-C669-4440-9248-27FB876EFCDF" TEXT="Route table attached to each subnet" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A6987F87-E6C9-4ADD-9230-B2E44A8FF77A" TEXT="Main VPC route table is used unless explicitly changed per-subnet" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="23548671-4BD0-4653-BBBE-3492119C746B" TEXT="Longest-match routing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="FABEE4E3-149A-4916-B33C-B9228B77BA22" TEXT="Default local route of VPC CIDR cannot be modified" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="926CE243-5F7A-43F4-9E92-5E3675C1B6C7" TEXT="Any egress/transit devices (IGW, VGW, NGW, VPC endpoint) must have corresponding routes in any subnets that use them" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B82CB6ED-B3AA-4C9D-A6F3-CAF4C9E24CD3" TEXT="Limit 50 local routes in the route table" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3510226B-1DA0-4D8B-918C-FCE85492CA00" TEXT="Limit 100 routes that can be propagated to the route table" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="41FADDB3-BAD7-4285-81E7-537A34172A74" TEXT="Route propagation disabled by default" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="0FC6CBFF-869F-4369-8DE3-C14B2084A176" TEXT="EC2 instance routers must have ENI added to route table and src/dst check disabled" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="05C6E7F8-D87C-45B3-BFAB-C2C059740A42" TEXT="VPC peering" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="AB20958E-5FFC-453D-BB23-38743BFE83DF" TEXT="VPCs must be in the same region" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A6B632B3-4FF0-4DD3-9823-1EFA3CEF1938" TEXT="Peering is not transitive - either source or destination must be in the local VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4FFE3070-B5FD-42B8-8441-BDBBCAC0D57B" TEXT="Subnet route tables need routes added for peer VPCs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7DA52395-8359-4873-B0FA-FE7CDE42BB28" TEXT="No overlapping CIDR ranges" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3405488E-0D19-4E28-8616-C455824F719A" TEXT="Limit 50 peers per VPC (can be increased to 125)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="26788E3C-742D-4997-8513-12987EA7737A" TEXT="SG / NACL" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="E853CCB3-98BE-44AC-9F5F-B61854710886" TEXT="Connectivity to AWS services" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="613CBA63-668A-46A0-AD11-C9ECCA6AEA07" TEXT="Services outside VPC require public IP (or NAT, proxy, VPC Endpoint)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="98A4A98B-1968-4A9B-9FC3-0B29BC2BA1A0" TEXT="VPC endpoint requires route with the endpoint as the destination" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5AE37700-1EA4-44B1-9E43-9E427D1B4FA1" TEXT="SG / NACL" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="EE6E4A21-0E92-4A96-8C48-A8955145E6D1" TEXT="IAM roles if applicable" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="F43ADFA0-2CE5-4E65-A35B-DBF6486FDA2D" TEXT="CloudFront connectivity" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B3FA47CB-A931-4989-B66C-517FCA8E391F" TEXT="Custom DNS requires CNAME pointing to CF distribution domain name" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="386DF767-682C-4CF0-83C3-9D4EFF433BF9" TEXT="S3 origin requires public readability or Origin Access Identity (OAI) attached to CF distribution" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="99E9F30C-BA55-4429-AE3D-AA020945809A" TEXT="HTTP 502 (Bad Gateway) CF cannot connect to origin" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="152A41EA-8AEA-4121-BB51-057CEC69754C" TEXT="HTTP 503 (Service Unavailable) usually means lack of capacity on origin server" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="F11D1804-FFB9-4F57-A3EC-73D6A0C47B8E" TEXT="ELB functionality" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="01C40910-9718-48C0-B5A0-34E31CFD1B3E" TEXT="Verify public LB resides in public subnets only" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A213FA69-8D8F-43B7-80F3-3130AA14A006" TEXT="SG / NACL" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="2260B664-F627-442A-A3B9-D55EA932432C" TEXT="Default success code for health check is 200" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A117E373-0086-4026-80F8-EB04008AFED8" TEXT="Verify sticky sessions for stateful applications" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="A1914509-851D-4FC2-A49B-1DE50F082429" TEXT="DNS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C868CC9F-1B7E-4224-B58E-B611C0AE22BB" TEXT="2nd IP in subnet is DNS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A66CBC33-D418-4DBA-BB58-6CFEB2DA37C7" TEXT="Custom DNS can be specified in DHCP option set" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="83C38D10-90D8-418E-89D9-029E17B8F6EC" TEXT="TTL issues" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A23B73D7-F63E-4A51-83B4-4F1D691A01E9" TEXT="Use only CNAME records to point to AWS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="6A5736EA-7B09-4410-87D5-4D0D8872DA2C" TEXT="Private hosted zones in Route 53 require VPC EnableDnsHostNames and enableDnsSupport" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="F6F79760-A014-4D17-8138-3070926C0710" TEXT="Service limits" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="2C438CB5-595A-4E34-9867-993555E6ED57" TEXT="Each service page on AWS website lists limits" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="2B59401B-36C4-4F45-BD03-C64329278E38" TEXT="AWS Trusted Advisor shows limits for:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="3872201C-646A-4AAF-B484-FE54C6589643" TEXT="Elastic IP addresses" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BECC0D1D-4D55-4B03-A74B-85EEC66F7543" TEXT="VPCs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="EA6252D3-5C0A-4FAF-B390-BE24EF02034F" TEXT="Subnets per SG" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3A90C9F6-DE92-472D-93DF-1159D4C50D4D" TEXT="IGW" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="40394ADD-D313-4FDD-9E0E-3FEB3290F5FB" TEXT="Active load balancers" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#9EA200" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
</node>
<node ID="99822D70-48C4-4D57-A997-BA2A261B895F" TEXT="Billing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="5944E21E-0158-4280-8F31-767EE6876953" TEXT="Service and port-hour fees" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="EF3F2775-4670-4AC5-8EF1-38330FDBA08B" TEXT="VPN" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="557B9B2F-CBF3-4016-83EB-FC72A8D6949A" TEXT="Charged per connection-hour as soon as the VGW is provisioned and available" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="12D779A3-8B27-4253-9C0E-060A25F86430" TEXT="Charged per outbound GB to the Internet" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="71A3D27F-7F65-4004-8C57-B2484734DD7B" TEXT="DX" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="68D87716-BE16-4FD5-8458-79A4D9295DE4" TEXT="Charged per port-hour as soon as the connection is shown as available or after 90 days (whichever is first)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BE1AFE3F-0F28-42EA-86BB-F05FD4B15FE3" TEXT="VIF must be created, then data transfer charges applied to DX owner" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="10265597-7291-4E02-A21E-F34857307A46" TEXT="PrivateLink" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="36BD6011-5A74-43A5-A117-45343B839813" TEXT="VPC endpoints charged per hour per AZ" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3F342AE5-AF3F-4635-89AC-F134D9578344" TEXT="Data transfer per GB regardless of direction" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="5AC8B15A-E3DF-4182-B46C-3C81FE152070" TEXT="NGW" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="219C8ADE-B6B7-43A5-8D31-C8B7F6301C06" TEXT="Charged per hour as soon as the NGW is provisioned and available" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B8AFB317-F7CA-4058-ACC4-6FDF9F40872F" TEXT="Charged data processing fee regardless of direction" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="925861F3-830C-429F-A248-575DA42163E1" TEXT="Outbound traffic toward Internet charged" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="97905342-E8B8-4501-989F-BF39013F03ED" TEXT="ELB" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8DBA44CB-1C9E-4FF6-A81C-85B94ADE4A85" TEXT="CLB charged per hour and GB transferred regardless of direction" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5CD1730E-DFE6-4D2D-86A4-B34B790111BF" TEXT="ALB / NLB charged per hour and Load balancer Capacity Units (LCUs) data processing" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="9E603CBD-3926-4150-88C1-4164D2B15E0C" TEXT="LCU Dimensions:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="6EAD2861-3848-4EE9-95B0-E9A6C2EF9CAD" TEXT="New connections / flows" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4FF7A86F-E830-41B0-9899-DFF2262F092C" TEXT="Active connections / flows" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D38258CD-1C87-49B9-9ED2-04E07258BB4D" TEXT="Bandwidth" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BC016125-6407-4889-A201-0B04DF5567ED" TEXT="ALB rule evaluations" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="77CDFEB7-251B-4F92-989F-167423720E5B" TEXT="If you have 10 or less rules configured, this dimension is ignored" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="1" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="82D36742-08E8-4E0E-8627-8BA206018956" TEXT="You are charged only on the dimension with the highest usage during the hour" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="84383A15-ED9B-4809-846B-CABA4A4CB754" TEXT="ALB LCU:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="F50D94FE-2C07-4354-AFD9-02D7691E823B" TEXT="25 connections per second" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="8710AC03-79A5-4AD8-906D-E4EE29F51B8C" TEXT="3000 active connections per minute" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="E5031242-B3AE-4EB7-A47A-BE96B41E3DDF" TEXT="2.22 Mbps (1 GB per hour)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A847C183-8D17-4EAE-811E-294CF913B509" TEXT="1000 rule evaluations per second" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="268504E5-7E73-4C43-A176-D8F7AD2A166B" TEXT="NLB LCU:" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="4B3E34FE-D602-425E-AB8F-5137878092AB" TEXT="800 non-SSL connections per second" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="9145D2D0-718F-4D9A-8E25-4486D8E55F6F" TEXT="100k active connections (sampled per minute)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="DBD9E2F2-B639-4E7A-90C3-7D8FE30B3657" TEXT="2.22 Mbps (1 GB per hour)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="F52ADBD8-3037-4713-93AB-C8EE8C53A190" TEXT="Data transfer" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="8251E07A-B8E2-4183-BDF7-D1D449FB767E" TEXT="Internet" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="F4456F44-85F9-441D-A133-97396A2F8349" TEXT="Data transfer from AWS-owned public IP to non-AWS public IP" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="1D9475E0-B05D-498C-87F2-E5B8488924CA" TEXT="Excluding inter-region and public-to-public intra-region" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="6BA2E1FB-8699-4F55-9B9B-57422B7CE274" TEXT="Inbound data not charged" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="056AAEE3-0650-4D7B-BDFA-2ED7A8C18927" TEXT="Inter-region" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="17D7FF72-A024-4F13-93BD-374E7906D498" TEXT="Data is charged on egress -- bidirectional flows are charged for each egress direction" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="CDDDC37C-C009-4983-80F3-F37E8F772EC3" TEXT="CloudFront" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="6B00EC20-5615-484D-B7FD-9D01B35C1003" TEXT="No outbound transfer charges from origin if origin is in AWS (S3, EC2)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F3251E92-1870-4D58-92FF-7F1AFE68BE91" TEXT="Inbound data transfer to CF charged at inter-region rate" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="407D96CE-748B-4B31-9210-9CA96E6D28E2" TEXT="Intra-region public IP" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FEB96894-4933-47E9-8C3E-6A24D96AD99A" TEXT="No charge to/from regional AWS service" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B08AEC92-3C45-4135-84EB-5631C4E61AAD" TEXT="Transfer between two EC2 instances using public IPs is charged in both directions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="7E101AE7-F821-496E-BF24-B5694C598F19" TEXT="Inter-AZ" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="2D08C464-8F95-4122-BAFC-826A4CF7FDD7" TEXT="Transfer between two EC2 instances in the same VPC but different AZs is charged in both directions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="209C9D20-809E-40FE-9996-157D4C60D6C7" TEXT="VPC peering" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7241DEE3-B3B5-4301-977F-EE3B4587B4BD" TEXT="Transfer between two EC2 instances in different VPCs is charged in both directions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="8A5B75CF-4989-4688-897F-F33CCA05C473" TEXT="Intra-AZ" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="0D667F23-EA09-4275-BC0A-7B6DE05B4E7F" TEXT="No charge between two EC2 instances in the same AZ in the same VPC" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="51C8AD78-2584-430D-8F15-3AD73D3304F6" TEXT="VPN Endpoint (VGW)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="694F9E05-9159-4486-946C-F812E98DC1A6" TEXT="EC2 in another region connecting to VGW is charged at a lower rate than the Internet rate" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="AF166E1D-10B0-4A3D-A526-78DD06CD16A6" TEXT="DX public VIF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E9D18068-9748-45C4-8471-9B4F516860DD" TEXT="If the traffic destination is associated with your account public VIF and is being advertised by BGP, you are charged the reduced rate instead of the Internet rate" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#2A008C" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
<node ID="AE08D966-56DF-4D39-AD5A-B9EF3AFBD6C4" TEXT="Risk / Compliance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="6" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="19CDF9BC-B94F-45BC-AF89-9F745196C36D" TEXT="Threat modeling" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="B8853CB7-A08C-4C7D-B59D-68F06869F1BD" TEXT="Model" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="63CA87C9-8FA6-45EA-8F24-27BFB01BA6AC" TEXT="Separation of duty" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BFB048D1-098A-46DA-88EE-2CD2482EBB03" TEXT="Least privilege" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="4890BD98-8E14-4DBD-848D-353975636FF8" TEXT="Need to know" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="7813D5EB-2435-45C9-B9E3-68634EB76304" TEXT="Compliance and scoping" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="DF70B433-4180-4C7F-B3D1-D1645A99B253" TEXT="AWS maintains a matrix of which services and features are in scope for particular compliance frameworks and standards" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="51A8AE68-107C-4F20-BBDE-3C5DDB60D498" TEXT="If a particular service is not compliant with a particular standard, you must not process sensitive data with that service in order to be compliant" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="293AD6AF-6D55-4A1C-A225-7C5ED91522F8" TEXT="Be aware of the entire data processing chain. Just because two services individually are compliant, it does not mean they are compliant when used together." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="38C86E75-5C8F-41B2-8F9A-7B90565605FC" TEXT="Audit reports" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="A0E9C6FD-1945-45A1-87A9-556F028BABF3" TEXT="Your auditor is who ultimately determines if your environment is compliant or not" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="DBD0B6EA-8878-4C3C-BC85-C0CEDB3F25F5" TEXT="Several reports and whitepapers are available to help understand AWS compliance, including from external auditors" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="35068DBB-C637-4B45-97A8-D6194E51614E" TEXT="Audit reports available in AWS Artifact service" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="EB0C4FC0-9490-4B99-A031-2A388F927931" TEXT="Ownership model and the role of network management" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="F82609D4-6AC8-43A1-99FD-BFAFDB11973D" TEXT="AWS handles the physical, you handle the logical" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="E644F925-66BD-4BD3-BDE7-BCFCFB26DE82" TEXT="Controlling access to AWS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="813232F1-848B-41EE-B1C0-6C2D1A17CCE3" TEXT="PARC model" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7064BE3B-B804-4341-8530-79418B647E0A" TEXT="Principle Action Resource Condition" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7681D3A2-63F8-4F57-93FE-9CADA9806920" TEXT="IAM policy is deny by default" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="02E03890-9312-4707-BCD9-0B625950E513" TEXT="IAM can be augmented with AWS Organizations Service Control Policies (SCP)" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="EFAD6950-954F-4C2D-B843-6C0435056FE7" TEXT="AWS Organizations" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="3D835EF5-B377-4493-94E4-12451B9ACD4B" TEXT="Allows SCP to be set on child AWS accounts, including root users of those accounts" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="E6A7DDEA-AF91-4E3C-BCDE-04CC3C4A80D1" TEXT="CloudFront Distributions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="35C63870-A232-4E8C-A998-01999F14ED6A" TEXT="IP geolocation support" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="CB0B0CBF-B987-4BF1-B304-1F9C1B1B7DFF" TEXT="Encryption options" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E0FA99D7-6E20-4E61-BE58-209A26E93942" TEXT="API calls and Internet API endpoints" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="99805B04-46FE-4ED8-9020-D2B27198DF92" TEXT="AWS calls are authenticated and encrypted" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="E297ED12-E507-4FCA-A357-81150E67D7AF" TEXT="Selecting cipher suites" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FD29A18B-1E02-4DBD-AD34-1052B02F695A" TEXT="AWS services offer a range of ciphers which are client-selectable" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="0EC47C0F-601B-4C36-95BD-5AAF6272AB47" TEXT="Some services enforce server-side selection as well" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="4E343F7B-2806-4B37-A6BD-A82946D08E68" TEXT="Encryption in transit inside AWS environments" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7ABED7BF-7455-4131-A1AE-8E7882DC05D9" TEXT="Encryption is normally terminated at the network interface of the service, but ELB can be configured in pass-through mode so the encryption is terminated at the EC2 instance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A93068FB-219C-4C1E-B738-3779ADC86E5D" TEXT="ALB and CF can use keys from AWS Certificate Manager. They can also re-encrypt traffic before passing it on" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="F3AA3CE9-8D4D-4823-B76C-0161BCF755C1" TEXT="All transit traffic inside a VPC can be encrypted" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="577BDAFF-8669-4A5E-91A5-4A4F346E1986" TEXT="Encryption in load balancers and CF PoPs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="7511656A-A4E0-416B-87C0-737EE7AAE966" TEXT="AWS load balancers have unidirectional trust, not mutual with client. Use 3rd party LB if you need that functionality." COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="E593B645-7043-4AD8-B1F9-B0D5B9CCA4FD" TEXT="Network activity monitoring" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="0630DF32-FBE7-4F29-B1BD-EAEF127EC6EF" TEXT="CloudTrail" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="9AB1149D-4E69-489E-B415-3D72A93F3073" TEXT="API logging" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7666A849-9D32-47F2-881D-AAAA384BC7CF" TEXT="Logs sent to S3" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="A5F9696C-0292-4AB0-B13D-CD7F399D6EFA" TEXT="Log digests can also be generated for anti-tampering" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="D1057B0B-6977-4EF4-A273-4F3D0ACBFF64" TEXT="Config" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="C4DE2145-55AE-4A53-A5EB-E0EBE76A9E3D" TEXT="Records changes to AWS assets" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D29C1511-6B1A-4B7F-B71B-61583D5B8E85" TEXT="Serves as ITIL CMDB" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="8020774D-95D9-4DCE-878A-1F9A815A418F" TEXT="Details sent to S3" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D2A1B09C-9797-4192-9BCC-8785DA1FEC2C" TEXT="Config Rules can trigger Lambda functions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="A5B4A1E3-7745-4A86-A21F-5C1885146681" TEXT="CloudWatch" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="738DD19F-2AEF-4D07-B105-1C9CEFBCD60F" TEXT="You can publish your own metrics to CW via API" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7119CD6E-6A18-4D69-BB0E-18B03AD66A20" TEXT="Alarm function can initiate actions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="0BAF0318-34B3-4B2C-A880-EAFA83530DA9" TEXT="CW Logs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="FA2F90F3-C476-4112-87D8-1F9C25F3238F" TEXT="Processes text logs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D6188234-D2D3-45E7-8388-BB52A0CCAF94" TEXT="Logs are rolled up based on time" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="62AAAA66-F65F-4A78-A301-21AB97BB45D8" TEXT="VPC Flow Logs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="2B239644-D1CB-4F51-A5CC-4F9AC8223B8A" TEXT="Enabled per-VPC, per-subnet, or per-interface" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="BA6DE3C4-D046-4BB3-9A5A-20949199630E" TEXT="Excludes traffic to VPC-native DNS, EC2 metadata, DHCP, or Windows license activation server" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="6CD66D34-9C7B-4EC8-9F1A-1E6837AAA630" TEXT="Delivered to CW Logs" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="EBFECE32-F296-4E79-9FDA-8A19467608DB" TEXT="CloudFront" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="014F8332-FE7B-4700-8A15-22E0A688A765" TEXT="Logs sent to S3" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="2D6FA92B-B3AE-41EA-B14F-A794B162E6B5" TEXT="Malicious activity detection" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="F7E8B36D-E8C2-4B18-9F6D-B8DD5F6788FD" TEXT="Shield and anti-DDoS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="E6DB909D-30E3-4CBF-A03D-A4182EDFEF6D" TEXT="Shield Advanced" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="130CE2CB-6F4B-4921-AAEC-607B4BF60C72" TEXT="UDP reflection attacks" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="5E50B507-2D45-45CE-BEE2-9A5B91F4B03A" TEXT="SYN flood" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="89A8D4A9-95AB-4D35-A61F-2D97D0F29554" TEXT="DNS query flood" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="B1DC78A8-C72B-4141-B22B-27845A70F0C3" TEXT="HTTP flood" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="FCC66216-ECED-456B-A186-CAAAD10A2DA4" TEXT="24/7 escalation support" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="1D6D2B4C-0101-42A0-B2FB-8458F988017A" TEXT="AWS WAF included" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="EF6EE4DD-039C-4541-B6E6-C3560B6E1E1A" TEXT="VPC flow logs analysis" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="8DAA16B7-635F-4429-B957-717A3ADD7543" TEXT="CW alerting and Lambda" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="0683AB92-0517-4C51-B3AA-DE53D91FAE0A" TEXT="AWS Marketplace" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="58BBA1B3-B755-4BC7-9614-87F5C28739EF" TEXT="SIEM" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="443FEE85-CD33-40D4-BB66-22FBD258866D" TEXT="WAF" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="3F2E1E74-7C26-47D9-873D-6CC9C88B274D" TEXT="IDS / IPS" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="30C09D9F-26E1-42EB-BB43-D29C41929AC9" TEXT="Inspector" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="79F4F3CE-871E-4588-9E4D-F1C72D570A86" TEXT="Agent installed on EC2 instance" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="75AB8ACB-A750-432C-B6A6-E2F67D427E01" TEXT="Assesses configuration and behavior of instance based on rules package" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
<node ID="E05F6075-49A0-43EC-B513-B9EB58824D14" TEXT="Penetration testing and vulnerability assessment" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="5" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="AE6C55AD-A724-48B9-BB2A-E40DEF0C152A" TEXT="PT authorization scope and exceptions" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="86C1E9C8-B81B-48BC-ACA4-550AC1B2D95B" TEXT="Exceptions: EC2/RDS smaller instance types, Lambda, CF, API gateway, LightSail" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7EBB6200-E57F-4DDC-8FD5-C5E70EDF1910" TEXT="Pre-authorized AMIs from AWS Marketplace do not require authorization" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="12E2D17C-4233-4E4C-94F1-EC3448FCC19D" TEXT="You must be the owner of all targets" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
<node ID="FB7CF01A-7405-4E31-BF33-01D560FBAEF0" TEXT="Applying for PT authorization" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="4" /><font NAME="HelveticaNeue" SIZE="14" /><node ID="AC22071B-DF94-4DD3-932C-9CF554899497" TEXT="Authorization for time window up to 90 days" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D39AF94D-1F46-4C50-BC87-2ADE7D886EF3" TEXT="Detailed form must be filled out" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="7D0C3911-02FF-4E4B-8821-85A4B9BB3216" TEXT="CIDR cannot be larger than /24" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
<node ID="D6E218B7-8E30-4E6E-AE6B-786B73305C09" TEXT="Successful authorization will include an authorization number" COLOR="#FFFFFF" POSITION="right" STYLE="fork"><edge COLOR="#004E8B" WIDTH="3" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</node>
</node>
</node>
<node ID="CC3760CA-32D0-40D8-81E3-E93D5414CDD5" BACKGROUND_COLOR="#000000" TEXT="NOTE: All information in this document is sourced from AWS public documentation or rephrased from the Official Study Guide and contains no proprietary information. This file is considered unofficial,&#34;as-is&#34;, and not associated with Amazon Web Services, Inc., John Wiley &#38; Sons, Inc., or their affiliates.&#8232;&#8232;Original version available at neckercube.com" COLOR="#FFFFFF" POSITION="right" STYLE="bubble"><edge COLOR="#7F7F7F" WIDTH="2" /><font NAME="HelveticaNeue" SIZE="14" /></node>
</node>
</map>
