Maximum resiliency (recommended for critical workloads):
  ├── DX Location A — Connection 1 → VGW/TGW
  ├── DX Location A — Connection 2 → VGW/TGW
  ├── DX Location B — Connection 3 → VGW/TGW
  └── DX Location B — Connection 4 → VGW/TGW

High resiliency:
  ├── DX Location A — Connection 1 → VGW/TGW
  └── DX Location B — Connection 2 → VGW/TGW

Development (non-critical only):
  └── DX Location A — Connection 1 + VPN backup → VGW/TGW

# Create customer gateway
aws ec2 create-customer-gateway \
  --type ipsec.1 \
  --public-ip 203.0.113.10 \
  --bgp-asn 65000

# Create VPN connection (BGP)
aws ec2 create-vpn-connection \
  --type ipsec.1 \
  --customer-gateway-id cgw-0abc123 \
  --vpn-gateway-id vgw-0abc123 \
  --options TunnelOptions='[{PreSharedKey=mysecret1},{PreSharedKey=mysecret2}]'

# Download configuration for your device type
aws ec2 get-vpn-connection-device-sample-configuration \
  --vpn-connection-id vpn-0abc123 \
  --vpn-connection-device-type-id 5fb390ba

# Check tunnel status
aws ec2 describe-vpn-connections \
  --vpn-connection-ids vpn-0abc123 \
  --query 'VpnConnections[*].VgwTelemetry'

# Create a private hosted zone
aws route53 create-hosted-zone \
  --name corp.internal \
  --vpc VPCRegion=us-east-1,VPCId=vpc-0abc123 \
  --caller-reference $(date +%s)

# Upsert a weighted record (blue/green)
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234 \
  --change-batch '{
    "Changes": [{
      "Action": "UPSERT",
      "ResourceRecordSet": {
        "Name": "api.example.com",
        "Type": "A",
        "SetIdentifier": "blue",
        "Weight": 90,
        "AliasTarget": {
          "DNSName": "blue-alb.us-east-1.elb.amazonaws.com",
          "EvaluateTargetHealth": true,
          "HostedZoneId": "Z35SXDOTRQ7X7K"
        }
      }
    }]
  }'

# Health check
aws route53 create-health-check \
  --caller-reference $(date +%s) \
  --health-check-config Type=HTTPS,FullyQualifiedDomainName=api.example.com,Port=443,ResourcePath=/health

Static site (S3 + CloudFront + OAC):
  S3 bucket (no public access) ← OAC ← CloudFront ← users

API + static assets:
  /api/*  → ALB origin (no caching or short TTL)
  /*      → S3 origin (long TTL for versioned assets)

Multi-origin failover:
  Origin group: primary ALB + failover ALB
  Triggers on HTTP 5xx or 4xx from primary

# Invalidate cached paths
aws cloudfront create-invalidation \
  --distribution-id E1ABCDEF \
  --paths "/index.html" "/assets/*"

# Check distribution status
aws cloudfront get-distribution \
  --id E1ABCDEF \
  --query 'Distribution.{Status:Status,Domain:DomainName}'

# Enable real-time logs
aws cloudfront create-realtime-log-config \
  --end-points StreamType=Kinesis,KinesisStreamConfig={RoleARN=arn:...,StreamARN=arn:...} \
  --fields timestamp c-ip sc-status cs-uri-stem time-taken \
  --name my-realtime-logs \
  --sampling-rate 100

# Create accelerator
aws globalaccelerator create-accelerator \
  --name my-app \
  --ip-address-type IPV4 \
  --enabled

# Add listener (port 443)
aws globalaccelerator create-listener \
  --accelerator-arn arn:aws:globalaccelerator::123456789:accelerator/xxx \
  --protocol TCP \
  --port-ranges FromPort=443,ToPort=443

# Add endpoint groups per region
aws globalaccelerator create-endpoint-group \
  --listener-arn arn:aws:globalaccelerator::... \
  --endpoint-group-region us-east-1 \
  --traffic-dial-percentage 100 \
  --endpoint-configurations EndpointId=arn:aws:elasticloadbalancing:...,Weight=100

# Create ALB
aws elbv2 create-load-balancer \
  --name my-alb \
  --type application \
  --subnets subnet-public-1a subnet-public-1b \
  --security-groups sg-alb

# Create HTTPS listener with certificate
aws elbv2 create-listener \
  --load-balancer-arn arn:aws:elasticloadbalancing:... \
  --protocol HTTPS --port 443 \
  --certificates CertificateArn=arn:aws:acm:... \
  --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:...

# Add path-based routing rule
aws elbv2 create-rule \
  --listener-arn arn:aws:elasticloadbalancing:... \
  --priority 10 \
  --conditions Field=path-pattern,Values="/api/*" \
  --actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:.../api-tg

# Enable access logs
aws elbv2 modify-load-balancer-attributes \
  --load-balancer-arn arn:... \
  --attributes Key=access_logs.s3.enabled,Value=true \
               Key=access_logs.s3.bucket,Value=my-alb-logs

# Step 1: Create an NLB in front of your service
aws elbv2 create-load-balancer --name my-svc-nlb --type network ...

# Step 2: Create an endpoint service
aws ec2 create-vpc-endpoint-service-configuration \
  --network-load-balancer-arns arn:aws:elasticloadbalancing:... \
  --acceptance-required          # require manual approval per consumer
  --no-acceptance-required       # auto-accept

# Step 3: Allow consumer accounts
aws ec2 modify-vpc-endpoint-service-permissions \
  --service-id vpce-svc-0abc123 \
  --add-allowed-principals arn:aws:iam::987654321:root

# Create interface endpoint to the provider's service
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-consumer \
  --vpc-endpoint-type Interface \
  --service-name com.amazonaws.vpce.us-east-1.vpce-svc-0abc123 \
  --subnet-ids subnet-private-1a subnet-private-1b \
  --security-group-ids sg-endpoints \
  --private-dns-enabled

Need private connectivity to AWS?
  ├── Consistent SLA, high bandwidth, low latency → Direct Connect
  │     ├── Single VPC → Private VIF + VGW
  │     └── Multiple VPCs/regions → Transit VIF + DXGW + TGW
  └── Quick setup, cost-sensitive, internet OK → Site-to-Site VPN
        └── Latency sensitive → Accelerated VPN (via TGW)

Exposing a service to consumers without VPC peering?
  └── PrivateLink (NLB-backed endpoint service)

Global traffic routing?
  ├── HTTP content, caching needed → CloudFront
  ├── Non-HTTP or static IP needed → Global Accelerator
  └── DNS-level routing (failover, geo, weighted) → Route 53