Cloud Arena
All Cheat Sheets

Networking Cheat Sheet

Multi-cloud reference for AWS, Azure, and Google Cloud Networking services

AWS Application Load Balancer (ALB)

AWS
Explore Deep Dive Guide

Key Commands & CLI Operations

CommandDescription
aws elbv2 create-load-balancer --name web-alb --subnets subnet-1 subnet-2 --security-groups sg-alb --scheme internet-facing --type applicationCreate internet-facing Layer 7 load balancer
aws elbv2 create-target-group --name api-tg --protocol HTTP --port 80 --vpc-id vpc-12345 --target-type ip --health-check-path /healthzCreate container IP target group with health checks
aws elbv2 create-listener --load-balancer-arn ALB_ARN --protocol HTTPS --port 443 --certificates CertificateArn=CERT_ARN --default-actions Type=forward,TargetGroupArn=TG_ARNCreate HTTPS listener with SSL termination

Architectural Key Facts

  • •Layer 7 load balancer routing HTTP and HTTPS traffic based on URL paths, host headers, HTTP methods, and query strings.
  • •Supports dynamic port mapping and IP target registration for ECS Fargate microservices and EKS pods.
  • •Native AWS WAF attachment inspects payloads at the perimeter and blocks SQLi/XSS before reaching backend servers.
  • •Pair with AWS Global Accelerator to route traffic over AWS's global backbone fiber network via static Anycast IPs.
  • •Weighted Target Groups facilitate automated canary deployments and zero-downtime blue/green traffic shifting.

Production Limits & Quotas

Item / DimensionLimit / Quota
Rules per listener100 rules (excluding default rule)
Target groups per load balancer100 target groups
Targets per target group1,000 targets

Amazon VPC

AWS

Key Commands & CLI Operations

CommandDescription
aws ec2 create-vpc --cidr-block 10.0.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=prod-vpc}]'Create regional VPC network
aws ec2 create-subnet --vpc-id vpc-12345 --cidr-block 10.0.1.0/24 --availability-zone us-east-1aCreate private subnet in AZ
aws ec2 create-nat-gateway --subnet-id subnet-public --allocation-id eipalloc-123Deploy NAT Gateway for outbound egress
aws ec2 create-vpc-endpoint --vpc-id vpc-12345 --service-name com.amazonaws.us-east-1.s3 --vpc-endpoint-type GatewayProvision free Gateway endpoint for private S3 access

Architectural Key Facts

  • •Logically isolated virtual network dedicated to your AWS account within a single geographic region.
  • •Subnets reside strictly within single Availability Zones; divided into Public (IGW route) and Private (NAT Gateway).
  • •Security Groups are stateful firewalls evaluated at the hypervisor ENI layer; Network ACLs are stateless subnet filters.
  • •VPC Endpoints (Gateway for S3/DynamoDB, Interface/PrivateLink for other services) eliminate public internet transit.
  • •VPC Peering connects VPCs without internet gateways; Transit Gateway provides centralized hub-and-spoke routing.

Production Limits & Quotas

Item / DimensionLimit / Quota
VPCs per region5 VPCs (expandable via quota)
Subnets per VPC200 subnets
Route tables per VPC200 route tables

Azure Virtual Network (VNet)

Azure

Key Commands & CLI Operations

CommandDescription
az network vnet create -g myrg -n prod-vnet --address-prefixes 10.0.0.0/16 --subnet-name web-subnet --subnet-prefixes 10.0.1.0/24Create regional VNet and subnet
az network nsg create -g myrg -n web-nsgCreate Network Security Group
az network nsg rule create -g myrg --nsg-name web-nsg -n AllowHTTPS --priority 100 --direction Inbound --access Allow --protocol Tcp --destination-port-ranges 443Create prioritized NSG firewall rule
az network vnet peering create -g myrg -n VNet1-to-VNet2 --vnet-name prod-vnet --remote-vnet vnet2-id --allow-vnet-accessEstablish low-latency private VNet peering

Architectural Key Facts

  • •Fundamental building block for your private network in Azure, logically isolated within a single Azure subscription and region.
  • •Network Security Groups (NSGs) filter inbound and outbound traffic at the subnet or individual VM network interface (NIC) layer.
  • •VNet Peering connects two VNets directly across Microsoft's private backbone network with zero gateway transit latency.
  • •Azure Private Endpoints assign private IP addresses from your VNet directly to PaaS services (Storage, SQL, Cosmos DB).
  • •User Defined Routes (UDRs) override default Azure system routing to steer traffic through network virtual appliances (NVAs) or firewalls.

Production Limits & Quotas

Item / DimensionLimit / Quota
VNets per subscription1,000 VNets (expandable to 10,000)
Subnets per VNet3,000 subnets
Security rules per NSG1,000 rules

Azure Application Gateway

Azure

Key Commands & CLI Operations

CommandDescription
az network application-gateway create -g myrg -n appgw-prod --sku WAF_v2 --capacity 2 --vnet-name prod-vnet --subnet appgw-subnet --http-settings-cookie-based-affinity Disabled --public-ip-address appgw-ipCreate Layer 7 App Gateway with WAF v2
az network application-gateway url-path-map create -g myrg --gateway-name appgw-prod -n api-map --paths '/api/*' --http-settings default-http --address-pool api-poolConfigure URL path-based routing rule

Architectural Key Facts

  • •Layer 7 application-level load balancer providing intelligent URL path-based and multi-site HTTP/HTTPS routing.
  • •Integrated Web Application Firewall (WAF v2) protects web applications against OWASP Top 10 exploits without code modification.
  • •SSL/TLS termination decrypts traffic at the gateway, offloading encryption overhead from backend application servers.
  • •Cookie-based session affinity ensures subsequent requests from the same client session are routed to the same backend server.
  • •Autoscaling dynamically scales capacity units up or down based on changing application traffic patterns.

Production Limits & Quotas

Item / DimensionLimit / Quota
Max listeners100 HTTP/HTTPS listeners
Backend pools per gateway100 backend pools
Max URL path maps100 path maps

VPC

Google Cloud
Explore Deep Dive Guide

Key Commands & CLI Operations

CommandDescription
gcloud compute networks create my-vpc --subnet-mode=customCreate a custom VPC
gcloud compute networks subnets create my-sub --network=my-vpc --region=us-central1 --range=10.0.0.0/24Create a subnet
gcloud compute firewall-rules create allow-http --network=my-vpc --allow tcp:80 --source-ranges=0.0.0.0/0Create firewall rule
gcloud compute routers create my-router --network=my-vpc --region=us-central1Create Cloud Router

Architectural Key Facts

  • •Global resource; subnets are regional resources.
  • •A single VPC can span multiple regions without requiring a VPN.
  • •VPC Peering connects two VPCs (even across organizations) but is not transitive.
  • •Shared VPC allows multiple projects to share a common network managed centrally.
  • •Firewall rules are applied at the network level and can use tags or service accounts to target VMs.

Production Limits & Quotas

Item / DimensionLimit / Quota
Max VPCs per project15 (soft quota)
Max subnets per VPC7000
Max firewall rules per network500

Load Balancing

Google Cloud
Explore Deep Dive Guide

Key Commands & CLI Operations

CommandDescription
gcloud compute backend-services create my-backend --global --protocol=HTTPCreate backend service
gcloud compute url-maps create my-map --default-service=my-backendCreate URL map
gcloud compute target-http-proxies create my-proxy --url-map=my-mapCreate Target Proxy
gcloud compute forwarding-rules create my-rule --global --target-http-proxy=my-proxy --ports=80Create Global Forwarding Rule

Architectural Key Facts

  • •Global HTTPS LB uses a single Anycast IP address to route traffic globally to the nearest healthy region.
  • •Internal TCP/UDP LB is for traffic inside the VPC.
  • •Network LB (external) routes TCP/UDP traffic and is not proxy-based (preserves client IP).
  • •Cloud CDN can be enabled with a single checkbox on Global HTTPS Load Balancers.
  • •Cloud Armor integrates with HTTPS LB to provide DDoS protection and WAF.

Production Limits & Quotas

Item / DimensionLimit / Quota
Max backend services50 per project
Max forwarding rulesVaries by quota type
Cloud CDN cache entry limit5 TB