This application is hosted on S3, delivered globally via CloudFront CDN, protected by AWS WAF, secured with ACM SSL, routed through Route 53 DNS, load-balanced by ALB, and backed by API Gateway + Lambda.
Follow the request from a user's browser to the backend and back
Route 53 resolves streamflix.com โ nearest CloudFront edge IP
AWS WAF checks for SQL injection, XSS, rate limits, and geo-blocks
ACM Certificate establishes encrypted HTTPS connection
CloudFront serves from cache or fetches from S3 origin via OAC
API Gateway routes dynamic requests to Lambda functions
Click any card to learn more about that service
Static File Storage
index.html, styles.css, app.jsGlobal Content Delivery
Edge Firewall
DNS Management
SSL/TLS Encryption
us-east-1 for CloudFront*.domain.com)Backend Router
GET /hello โ Lambdaprod stageLayer 7 Load Balancing
/api/*, /images/*)Serverless Compute
Click the button to make a real GET request to your AWS Lambda backend through API Gateway
$ Waiting for request...
See how AWS WAF protects your application from common attacks
Simulates: ?id=1' OR '1'='1
Simulates: <script>alert('xss')</script>
Simulates: 50 rapid requests in 3 seconds
Simulates: Request from a blocked country
Understanding DNS record types, IP โ DNS mapping, and routing policies
Maps a domain name directly to an IPv4 address. Used when you know the exact IP of your server (e.g., an EC2 instance with an Elastic IP).
streamflix.com โ A โ 54.230.10.42
Same as A record but for IPv6 addresses. Modern infrastructure increasingly uses IPv6.
streamflix.com โ AAAA โ 2600:1f18:2551:8a00::1
Maps one domain name to another. Cannot be used at the zone apex (root domain like streamflix.com). Use for subdomains only!
www.streamflix.com โ CNAME โ streamflix.com
AWS-specific! Works at the zone apex. Points to AWS resources (CloudFront, ALB, S3, etc.). Free of charge โ no Route 53 query fees. This is the preferred way!
streamflix.com โ ALIAS (A) โ d3abc.cloudfront.net
Routes email to mail servers
streamflix.com โ MX 10 โ mail.google.com
Domain verification, SPF, DKIM for email
streamflix.com โ TXT โ "v=spf1 include:_spf.google.com"
Delegates a hosted zone to specific DNS servers
streamflix.com โ NS โ ns-1234.awsdns-12.org
Zone metadata: primary NS, admin email, serial number
Auto-created with every hosted zone
Controls which CAs can issue SSL certs for your domain
streamflix.com โ CAA โ 0 issue "amazon.com"
Specifies host/port for services (SIP, LDAP, etc.)
_sip._tcp.streamflix.com โ SRV โ 10 5 5060 sip.example.com
The most basic routing. Maps a domain name to one or more resources. If you specify multiple IPs, Route 53 returns them all โ the client picks one randomly. No health checks.
streamflix.comA small company blog hosted on a single EC2 instance with an Elastic IP. No need for complex routing.
Record name: streamflix.com | Type: A | Value: 54.230.10.42 | Routing policy: Simple
Distributes traffic based on weights you assign. Route 53 calculates the percentage as: weight / total_weight. Setting a weight to 0 stops all traffic to that record.
Canary deployment: Netflix deploys a new version to 5% of users. If no errors after 1 hour, increase to 50%, then 100%.
Record 1: A | Value: 10.0.1.10 | Weight: 70 | Set ID: "v2-prod"Record 2: A | Value: 10.0.2.20 | Weight: 30 | Set ID: "v1-prod"
Routes each user to the AWS region with the lowest network latency to them. AWS maintains a global latency database โ it's not measured live per request.
Amazon.com uses this! Users in India get routed to ap-south-1 (Mumbai), US users to us-east-1. Reduces page load time by 200ms+.
Record 1: A | Value: 13.235.x.x | Region: ap-south-1 | Set ID: "mumbai"Record 2: A | Value: 54.230.x.x | Region: us-east-1 | Set ID: "virginia"
Creates an active-passive pair. Route 53 health-checks the primary. If the primary fails 3 times in a row, traffic automatically switches to the secondary. No manual intervention.
PRIMARYSECONDARYBanking website: Primary in us-east-1, standby in eu-west-1. If Virginia goes down (like the 2017 S3 outage), customers automatically hit Ireland. Zero downtime.
Record 1: A | Value: ALB-Primary | Failover: Primary | Health Check: hc-xyzRecord 2: A | Value: ALB-Standby | Failover: Secondary
Routes based on where the user physically is (country, continent, or US state). NOT about speed โ this is about showing different content based on location.
Netflix content licensing: "Squid Game" is available in Korea but not in the US. Geo-routing ensures Korean users see Korean content library, US users see US library.
GDPR compliance: EU users are routed to EU-based servers that comply with European data laws.
Record 1: A | Value: 13.112.x.x | Location: Asia - Japan | Set ID: "japan"Record 2: A | Value: 34.245.x.x | Location: Europe | Set ID: "europe"Record 3: A | Value: 54.230.x.x | Location: Default | Set ID: "default"
Returns up to 8 healthy IP addresses in response to a DNS query. The client randomly picks one. Like Simple routing BUT with health checks, so dead servers are excluded.
Small startup with 4 web servers and no budget for an ALB ($16/month). Use Multivalue to spread traffic and auto-remove bad servers from DNS.
Record 1: A | Value: 10.0.1.10 | Set ID: "web-1" | Health Check: hc-1Record 2: A | Value: 10.0.2.20 | Set ID: "web-2" | Health Check: hc-2Record 3: A | Value: 10.0.3.30 | Set ID: "web-3" | Health Check: hc-3
Routes based on geographic distance between user and resource, with a configurable bias to expand or shrink a region's "catchment area." Available only in Route 53 Traffic Flow (visual editor).
Expanding into a new market: You launch Mumbai servers but want to gradually shift Middle East traffic from Ireland โ Mumbai. Increase Mumbai bias from 0 โ +25 โ +50 over weeks.
This policy is ONLY available via Route 53 Traffic Flow (visual editor).Costs: $50/month per Traffic Flow policy.
Routes based on the client's IP address range (CIDR blocks). You define which IP ranges should go to which endpoints. Useful for ISP-specific or enterprise network optimization.
203.0.113.0/24)Telecom company: Jio users (specific IP ranges) are routed to Mumbai CDN, Airtel users to a different CDN. Optimizes peering and reduces inter-ISP transit costs.
Step 1: Create CIDR collection โ Add CIDR locationsStep 2: Create record โ Routing: IP-based โ Select CIDR location
Select a record type and see how Route 53 resolves it
$ Select a record type and click "Resolve DNS"...
Distributing traffic across multiple targets with health checks
api.streamflix.com/api/* โ EC2 instances/static/* โ Lambda function/* โ Default target group
ALB pings /health every 30s.
If 3 consecutive failures โ target = unhealthy โ traffic diverted
ALB provides a DNS name: my-alb-1234.us-east-1.elb.amazonaws.com
Route 53 ALIAS record maps api.streamflix.com โ ALB DNS
ACM certificate attached to ALB listener on port 443. Backend targets can run on HTTP (port 80), reducing compute overhead.