Tagged
On June 15, 2026 AWS made Console Private Access work without internet — VPC endpoints route 100% of browser traffic. First-party benchmark: 161 interface endpoints and ~$263/mo for a 12-service 3-AZ pilot in us-east-1.
The VPC itself, subnets, security groups, and route tables are free. The bill comes from what you attach: public IPv4 at $3.60/month per address (since Feb 2024), Interface VPC Endpoints at $0.01/hour per AZ, Transit Gateway at $0.05/hour per attachment, VPN at $0.05/hour, and inter-AZ data transfer at $0.01/GB each way. A modest production VPC easily lands at $500–$2,000/month.
Packet loss on mobile networks still punishes HTTP/1.1 head-of-line blocking—but HTTP/3 only helps if CloudFront terminates QUIC and your origin connection pools are sized for multiplexed streams. This guide connects Reno, Cubic, BBR, HPACK, and QUIC to ALB and CloudFront decisions.
A full TLS handshake on every API call adds RTTs your p99 cannot afford. This guide walks TLS 1.3 1-RTT resumption, ACM cert rotation, and security policies on ALB and CloudFront.
Your landing zone set up the org, OUs, and baseline SCPs — then most teams stall, duplicating resources per account and wiring brittle cross-account role chains. Since re:Invent 2024 the toolkit changed: RCPs bound what can be done TO a resource (even by external principals), declarative policies enforce EC2/VPC/EBS config state that survives new APIs, and one Route 53 Profile can push DNS to up to 5,000 VPCs. Here is the mechanism-by-job decision matrix and a rollout order that avoids lockouts.
Global Accelerator charges about $0.025 per provisioned accelerator per hour—even while disabled—and adds Data Transfer-Premium on top of normal data transfer. Two static Anycast IPv4 addresses (or four addresses in dual-stack: two IPv4 and two IPv6) front ALBs, NLBs, EC2, or EIPs across Regions; that pricing model changes whether you beat CloudFront or Route 53 latency records alone.
NAT Gateways are one of the most silent budget killers on AWS. AWS finally added Compute Optimizer support to find idle ones — but the real fix is knowing when not to use them at all.
A technical deep dive into EC2 performance optimization for API workloads — covering instance family selection, Graviton vs x86 economics, network tuning, EBS configuration, and Linux kernel parameters that directly impact throughput and tail latency.
July 2026: Route 53 hosted zones, latency/geo/failover routing, health checks, and when DNS TTL is not enough — Route 53 Application Recovery Controller for controlled multi-Region cutover.
A VPC misdesign at month two becomes a multi-quarter migration at year two. CIDR planning, subnet strategies, NAT gateways, VPC endpoints, Transit Gateway, and the network architecture patterns that scale without forcing a re-IP.