AWS for DevOps — Advanced Networking Exercises

4 minute read

12.6 — Practice Exercises: Advanced Networking

Test your understanding of Route 53, CloudFront, load balancers, ACM, and WAF.

Exercise 1 — Set Up DNS with Failover

You have a primary API in ap-south-1 and a disaster recovery API in us-east-1. Configure Route 53 failover routing so traffic automatically switches to DR when the primary fails.

Show Answer 
# 1. Create health check for primary
$ aws route53 create-health-check \
    --caller-reference "primary-health-$(date +%s)" \
    --health-check-config '{
      "Type": "HTTPS",
      "FullyQualifiedDomainName": "primary-alb.ap-south-1.elb.amazonaws.com",
      "Port": 443,
      "ResourcePath": "/health",
      "RequestInterval": 10,
      "FailureThreshold": 3
    }'
# Note the HealthCheckId: hc-primary-123

# 2. Create primary failover record
$ aws route53 change-resource-record-sets \
    --hosted-zone-id Z1234567890 \
    --change-batch '{
      "Changes": [{
        "Action": "CREATE",
        "ResourceRecordSet": {
          "Name": "api.example.com",
          "Type": "A",
          "SetIdentifier": "primary",
          "Failover": "PRIMARY",
          "HealthCheckId": "hc-primary-123",
          "AliasTarget": {
            "HostedZoneId": "Z_AP_SOUTH_1",
            "DNSName": "primary-alb.ap-south-1.elb.amazonaws.com",
            "EvaluateTargetHealth": true
          }
        }
      }]
    }'

# 3. Create secondary failover record
$ aws route53 change-resource-record-sets \
    --hosted-zone-id Z1234567890 \
    --change-batch '{
      "Changes": [{
        "Action": "CREATE",
        "ResourceRecordSet": {
          "Name": "api.example.com",
          "Type": "A",
          "SetIdentifier": "secondary",
          "Failover": "SECONDARY",
          "AliasTarget": {
            "HostedZoneId": "Z_US_EAST_1",
            "DNSName": "dr-alb.us-east-1.elb.amazonaws.com",
            "EvaluateTargetHealth": true
          }
        }
      }]
    }'

How it works: Route 53 checks the primary health check every 10 seconds. If 3 consecutive checks fail, it returns the secondary ALB’s address instead.

Exercise 2 — Deploy a Static Site with CloudFront

Set up an S3 bucket to host a static website, put CloudFront in front of it, and configure an ACM certificate for www.example.com.

Show Answer 
# 1. Create S3 bucket with static hosting
$ aws s3 mb s3://www-example-com
$ aws s3 website s3://www-example-com \
    --index-document index.html \
    --error-document error.html

# 2. Upload content
$ aws s3 sync ./build/ s3://www-example-com/

# 3. Request ACM certificate (MUST be in us-east-1 for CloudFront)
$ aws acm request-certificate \
    --region us-east-1 \
    --domain-name www.example.com \
    --validation-method DNS

# 4. Add DNS validation record to Route 53
# (get the CNAME from describe-certificate output)

# 5. Create CloudFront distribution
# - Origin: S3 bucket
# - Alternate domain name: www.example.com
# - Certificate: ACM cert from us-east-1
# - Default root object: index.html
# - Custom error response: 403 → /index.html (for SPA)

# 6. Create Route 53 Alias record
$ aws route53 change-resource-record-sets \
    --hosted-zone-id Z1234567890 \
    --change-batch '{
      "Changes": [{
        "Action": "CREATE",
        "ResourceRecordSet": {
          "Name": "www.example.com",
          "Type": "A",
          "AliasTarget": {
            "HostedZoneId": "Z2FDTNDATAQYW2",
            "DNSName": "d1234567890.cloudfront.net",
            "EvaluateTargetHealth": false
          }
        }
      }]
    }'

Key points:

  • ACM cert must be in us-east-1 for CloudFront
  • Z2FDTNDATAQYW2 is the hosted zone ID for all CloudFront distributions
  • Use Origin Access Identity to prevent direct S3 access

Exercise 3 — Choose the Right Load Balancer

For each scenario, decide whether to use ALB or NLB and explain why.

  1. A REST API with path-based routing (/v1/*, /v2/*)
  2. A real-time gaming server using TCP connections
  3. A microservices architecture with gRPC
  4. A service that needs a static IP for firewall allowlisting
Show Answer
Scenario Choice Reason
REST API with path routing ALB Layer 7 routing: can route /v1/* and /v2/* to different target groups
Real-time gaming (TCP) NLB Layer 4 (TCP), ultra-low latency, millions of concurrent connections
gRPC microservices ALB Native gRPC support with HTTP/2
Static IP for allowlisting NLB Supports Elastic IP allocation, ALB IPs change

Exercise 4 — Secure an API with WAF

Your public API receives SQL injection and bot attacks. Set up WAF with: (1) SQL injection protection, (2) rate limiting to 1000 requests per 5 minutes per IP, and (3) a geo-restriction to block traffic from specific countries.

Show Answer

Create a Web ACL with three rules:

$ aws wafv2 create-web-acl \
    --name api-protection \
    --scope REGIONAL \
    --default-action Allow={} \
    --rules '[
      {
        "Name": "RateLimit",
        "Priority": 0,
        "Statement": {
          "RateBasedStatement": {"Limit": 1000, "AggregateKeyType": "IP"}
        },
        "Action": {"Block": {}},
        "VisibilityConfig": {
          "SampledRequestsEnabled": true,
          "CloudWatchMetricsEnabled": true,
          "MetricName": "RateLimit"
        }
      },
      {
        "Name": "SQLiProtection",
        "Priority": 1,
        "Statement": {
          "ManagedRuleGroupStatement": {
            "VendorName": "AWS",
            "Name": "AWSManagedRulesSQLiRuleSet"
          }
        },
        "OverrideAction": {"None": {}},
        "VisibilityConfig": {
          "SampledRequestsEnabled": true,
          "CloudWatchMetricsEnabled": true,
          "MetricName": "SQLiProtection"
        }
      },
      {
        "Name": "GeoBlock",
        "Priority": 2,
        "Statement": {
          "GeoMatchStatement": {
            "CountryCodes": ["CN", "RU", "KP"]
          }
        },
        "Action": {"Block": {}},
        "VisibilityConfig": {
          "SampledRequestsEnabled": true,
          "CloudWatchMetricsEnabled": true,
          "MetricName": "GeoBlock"
        }
      }
    ]' \
    --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=APIProtection

Then associate with the ALB:

$ aws wafv2 associate-web-acl \
    --web-acl-arn arn:aws:wafv2:...:regional/webacl/api-protection/abc123 \
    --resource-arn arn:aws:elasticloadbalancing:...:loadbalancer/app/my-api-alb/def456

Exercise 5 — End-to-End HTTPS Setup

Walk through setting up HTTPS for api.example.com from scratch: ACM certificate, ALB with HTTPS listener, HTTP→HTTPS redirect, and Route 53 alias record.

Show Answer 
# 1. Request ACM certificate
$ aws acm request-certificate \
    --domain-name api.example.com \
    --validation-method DNS

# 2. Add DNS validation CNAME to Route 53 (from describe-certificate output)

# 3. Wait for validation
$ aws acm wait certificate-validated --certificate-arn $CERT_ARN

# 4. Create HTTPS listener on ALB
$ aws elbv2 create-listener \
    --load-balancer-arn $ALB_ARN \
    --protocol HTTPS --port 443 \
    --certificates CertificateArn=$CERT_ARN \
    --default-actions Type=forward,TargetGroupArn=$TG_ARN

# 5. Create HTTP→HTTPS redirect listener
$ aws elbv2 create-listener \
    --load-balancer-arn $ALB_ARN \
    --protocol HTTP --port 80 \
    --default-actions '[{
      "Type": "redirect",
      "RedirectConfig": {
        "Protocol": "HTTPS",
        "Port": "443",
        "StatusCode": "HTTP_301"
      }
    }]'

# 6. Create Route 53 Alias record
$ aws route53 change-resource-record-sets \
    --hosted-zone-id $ZONE_ID \
    --change-batch '{
      "Changes": [{
        "Action": "CREATE",
        "ResourceRecordSet": {
          "Name": "api.example.com",
          "Type": "A",
          "AliasTarget": {
            "HostedZoneId": "'$ALB_ZONE_ID'",
            "DNSName": "'$ALB_DNS'",
            "EvaluateTargetHealth": true
          }
        }
      }]
    }'

Result: https://api.example.com → Route 53 → ALB (HTTPS:443 with ACM cert) → Target Group. HTTP requests on port 80 are automatically redirected to HTTPS.

Next Chapter → Security Best Practices

Updated:

You may also enjoy