AWS Global Infrastructure: Regions, Availability Zones, Local Zones, and Edge Services – SAP-C02 Study Guide

Purpose of This Lesson

AWS global infrastructure determines where workloads run, how they achieve high availability, and how they serve users with acceptable latency. For the SAP-C02 exam, the key design decision is usually whether to distribute resources across Availability Zones within one Region, deploy across multiple Regions, or use infrastructure closer to users through edge and specialized deployment locations.

Key Concepts

AWS Regions

An AWS Region is a separate geographic area containing multiple Availability Zones. Regions are designed to provide geographic isolation from one another and operate as distinct deployment boundaries.

Choose a Region based on factors such as:

• User and application latency
• Data residency and regulatory requirements
• Service availability
• Disaster recovery objectives
• Cost and pricing differences
• Proximity to connected corporate or partner infrastructure

A workload deployed in one Region is not automatically available in another. Cross-Region resiliency requires explicit architecture, such as replication, backup, data synchronization, or a deployment pipeline that can recreate the environment elsewhere.

Availability Zones

An Availability Zone (AZ) is one or more discrete data centers within a Region. AZs have independent infrastructure, including separate power and networking arrangements, to reduce correlated failures.

AZs within a Region are connected using AWS-managed, redundant networking with low latency. This makes them suitable for distributing application tiers, database replicas, and other resources that need regional high availability.

Availability Zones are not the same as Regions:

• AZs are relatively close together and support low-latency regional architectures.
• Regions are geographically separated and are more appropriate for disaster recovery, data sovereignty, or global deployment.
• Failure isolation is improved across AZs, but an AZ-spanning design does not protect against a full-Region outage.

AWS does not guarantee that every Region has the same number of AZs or that every service is available in every AZ or Region. Always verify service and feature availability when selecting a deployment location.

VPC Subnets and Availability Zones

A subnet is an IP address range within a VPC and is associated with exactly one Availability Zone. A subnet cannot span multiple AZs.

Common subnet patterns include:

• Public subnets: Have a route to an Internet Gateway. Resources still need appropriate routing, public addressing, and security controls to be reachable from the internet.
• Private subnets: Do not have a direct route from the internet. They can still initiate outbound connections through services such as a NAT Gateway, subject to the route table and security controls.

For a highly available architecture, create subnets in multiple AZs and distribute resources across them. For example, an internet-facing load balancer can use public subnets in multiple AZs, while application servers can run in private subnets in those same or additional AZs.

A subnet being labeled public or private is determined primarily by its routing, not by the subnet name or by whether its instances have public IP addresses.

AWS Global Network

AWS operates and manages a global network connecting Regions and supporting connectivity within Regions. This network provides predictable, high-performance connectivity compared with sending traffic across the public internet, but it does not remove the need to consider distance, latency, bandwidth, and data-transfer costs.

Cross-Region communication is still subject to geographic latency. A private connection through the AWS network does not make distant Regions behave like a single local data center.

AWS Outposts

AWS Outposts extends selected AWS infrastructure and services into a customer data center or on-premises location. It is useful when workloads need to remain on premises because of latency, local data processing, regulatory, or operational requirements while still using AWS APIs and management patterns.

Important characteristics:

• Outposts supports only a subset of AWS services and instance types.
• The Outpost is connected to a parent AWS Region.
• It is not equivalent to deploying a complete AWS Region on premises.
• The customer remains responsible for aspects of the physical site, including suitable power, networking, and facilities requirements.

AWS Local Zones

AWS Local Zones place selected AWS compute, storage, and other resources closer to large population centers or metropolitan areas. They are useful when a workload needs very low latency to end users or on-premises systems but does not require an entire workload to run outside the parent Region.

Local Zones are associated with a parent Region and have limited service availability compared with that Region. They may incur additional costs, so they should be selected when latency requirements justify the tradeoff.

AWS Wavelength Zones

AWS Wavelength embeds selected AWS infrastructure within telecommunications providers’ 5G networks. It is designed for applications requiring extremely low latency to 5G-connected mobile and edge devices, such as real-time gaming, augmented reality, industrial control, or connected-vehicle workloads.

Wavelength Zones remain connected to a parent AWS Region and support only selected services. They are not a general replacement for standard AZs or Local Zones.

Amazon CloudFront and Edge Locations

Amazon CloudFront is a content delivery network (CDN). It caches and serves content from edge locations closer to viewers, reducing latency and decreasing the number of requests that must travel to an origin such as Amazon S3, an Application Load Balancer, or a custom HTTP server.

CloudFront is particularly useful for:

• Static assets such as images, scripts, and video
• Dynamic content acceleration
• Global HTTP/HTTPS delivery
• TLS termination at the edge
• Integration with AWS WAF and AWS Shield features

CloudFront improves content delivery performance, but it is not the same as deploying the application compute tier in every geographic location. Cache behavior, origin latency, cache-control headers, invalidation strategy, and data-transfer costs still matter.

Exam-Relevant Takeaways

• Deploy resources across multiple AZs within a Region for high availability and protection against an AZ failure.
• Use multiple Regions when the requirement includes protection from a Region-wide disaster, geographic redundancy, data residency, or global user distribution.
• A subnet belongs to one AZ only; design subnet tiers across multiple AZs rather than trying to make one subnet span AZs.
• Public and private subnet behavior is determined by routing, especially the presence or absence of a route to an Internet Gateway.
• An AZ is a failure-isolation boundary, while a Region is a broader geographic and service-isolation boundary.
• Use CloudFront to cache and deliver content close to users; use Local Zones or Wavelength Zones when compute or application processing itself must be closer to users.
• Use Outposts when selected AWS infrastructure must run in a customer-controlled on-premises location.
• Verify service availability in the target Region, AZ, Local Zone, or Wavelength Zone before finalizing an architecture.
• Cross-AZ and cross-Region designs can introduce data-transfer charges and replication complexity.
• Geographic distribution does not automatically provide data consistency, failover, or application-level recovery. Those capabilities must be designed explicitly.

Architecture Decision Guide

Requirement	Preferred approach	Main tradeoffs
Protect an application from a single data-center or AZ failure	Deploy across multiple AZs in one Region	Requires multi-AZ networking, replication, and potentially higher baseline cost
Recover from a Region-wide outage	Deploy or replicate into a second Region	Higher operational complexity, cross-Region latency, and data-transfer cost
Serve static or cacheable content globally with low latency	Amazon CloudFront	Cache management, origin design, and possible invalidation or transfer costs
Run compute close to users in a specific metropolitan area	AWS Local Zones	Limited service set and possible additional cost
Run applications with very low latency to 5G devices	AWS Wavelength Zones	Limited services and dependence on supported telecom/5G locations
Keep selected AWS workloads on premises	AWS Outposts	Limited service scope and customer responsibility for site facilities
Provide internet-facing and internal application tiers	Public and private subnets across multiple AZs	Requires correct route tables, gateways, security groups, and network ACLs

Common Exam Traps

• Confusing a Region with an AZ: A Region contains multiple AZs. They are not interchangeable resiliency boundaries.
• Assuming one subnet can span AZs: Each subnet is tied to a single AZ. Create equivalent subnets in each AZ.
• Treating public IP addresses as sufficient for internet access: A resource also needs a suitable route, an Internet Gateway path where applicable, and permissive security controls.
• Assuming private means no internet access at all: Private-subnet resources can have outbound internet access through a NAT Gateway or another approved egress design without accepting unsolicited inbound internet connections.
• Using CloudFront as a substitute for multi-AZ application architecture: CloudFront accelerates content delivery; it does not automatically make an origin application highly available.
• Assuming every AWS service is available everywhere: Service, feature, capacity, and deployment-model availability varies by Region and specialized location.
• Assuming cross-Region replication is automatic: Databases, object data, configuration, secrets, and application artifacts each require an intentional replication or recovery strategy.
• Assuming AZs are completely independent networks: AZs are designed for isolation but are connected by low-latency, redundant regional networking. Applications still need to tolerate network and dependency failures.
• Ignoring cost in geographically distributed designs: Cross-AZ and cross-Region traffic, duplicate infrastructure, replication, and specialized locations can materially increase cost.

Real-World Engineer Notes

• Begin with the failure domain required by the business. Multi-AZ deployment is usually the baseline for production regional workloads; multi-Region deployment should be justified by recovery objectives, regulatory requirements, or global demand.
• Place stateful components carefully. Distributing stateless application servers across AZs is generally straightforward, while databases and storage systems require service-specific replication and consistency decisions.
• Keep application tiers private where possible and expose only required entry points through internet-facing load balancers, CloudFront, or other controlled interfaces.
• Test both AZ and Region recovery. A design diagram that shows two Regions is not evidence that DNS failover, data promotion, secrets, deployment artifacts, and operational runbooks work.
• Consider dependencies outside the primary workload, including identity, monitoring, CI/CD, third-party APIs, DNS, and inter-Region connectivity.
• Local Zones and Wavelength Zones solve specialized latency problems; they should not be selected solely because they sound more geographically distributed.
• Review supported services, quotas, capacity, and pricing for the exact target location. Specialized locations can have materially different capabilities from the parent Region.

Quick Reference Summary

• Region: Geographic AWS deployment area containing multiple AZs.
• Availability Zone: One or more discrete data centers designed as a regional failure-isolation boundary.
• Subnet: An IP range associated with exactly one AZ.
• Public subnet: A subnet whose route table provides a path to an Internet Gateway.
• Private subnet: A subnet without a direct inbound internet route; outbound access may use NAT.
• AWS global network: AWS-managed connectivity between and within global infrastructure locations.
• Outposts: Selected AWS infrastructure deployed at a customer site and connected to a parent Region.
• Local Zones: Selected AWS resources placed closer to metropolitan users or on-premises systems.
• Wavelength Zones: Selected AWS resources placed within 5G provider networks.
• CloudFront: CDN that serves cached content from edge locations near users.
• Multi-AZ: Regional high availability.
• Multi-Region: Geographic disaster recovery or global deployment.

Flashcards

1. Q: What is an AWS Region?

A: A separate geographic area containing multiple Availability Zones.

1. Q: What is an Availability Zone?

A: One or more discrete data centers within a Region, designed to provide infrastructure isolation from other AZs.

1. Q: Can a subnet span multiple Availability Zones?

A: No. A subnet is associated with exactly one AZ.

1. Q: Why deploy application resources across multiple AZs?

A: To continue operating if one AZ experiences an infrastructure failure.

1. Q: When is multi-Region architecture appropriate?

A: When protection from a Region-wide outage, geographic redundancy, data residency, or global user proximity is required.

1. Q: What makes a subnet public?

A: Its routing includes a path to an Internet Gateway, along with the required addressing and security configuration.

1. Q: Can resources in a private subnet access the internet?

A: Yes. They can use a NAT Gateway or another controlled egress path for outbound access.

1. Q: What problem does CloudFront solve?

A: It caches and delivers content from edge locations closer to users, reducing delivery latency.

1. Q: What is AWS Outposts used for?

A: Running a supported subset of AWS infrastructure and services at a customer-controlled on-premises location.

1. Q: What is the primary use case for AWS Local Zones?

A: Providing selected AWS resources closer to users or on-premises systems in a metropolitan area.

1. Q: What is the primary use case for AWS Wavelength Zones?

A: Low-latency application processing for devices connected through supported 5G networks.

1. Q: Does cross-Region deployment automatically synchronize application data?

A: No. Replication, consistency, failover, and recovery procedures must be designed explicitly.

Practice Questions

Question 1

A company runs a web application in one AWS Region. The application servers are distributed across two AZs, but the database exists in only one AZ. The company requires the application to remain available if an AZ fails. Which design change best addresses the requirement?

A. Add a CloudFront distribution in front of the application.
B. Create a second public subnet in the same AZ as the database.
C. Use a database configuration that provides a standby or replica in another AZ and update the application architecture accordingly.
D. Move all application servers into a single larger AZ.

Correct answer: C

Explanation: Multi-AZ availability must include critical stateful dependencies. CloudFront can improve content delivery but does not make a single-AZ database highly available.

Question 2

A company must serve large image and video files to users worldwide. The origin content is stored in Amazon S3, and the primary requirement is lower viewer latency. Which service should the architect recommend?

A. AWS Outposts
B. Amazon CloudFront
C. AWS Wavelength
D. A second VPC in the same AZ

Correct answer: B

Explanation: CloudFront caches content at edge locations near viewers and can use S3 as an origin. The other options do not provide a general global content-delivery function.

Question 3

A manufacturing company must run selected AWS workloads inside its own facility because the equipment must remain on premises and must interact with local systems. The company still wants AWS APIs and connectivity to an AWS Region. Which option is most appropriate?

A. AWS Outposts
B. Amazon CloudFront
C. A public subnet with an Elastic IP address
D. A second Availability Zone

Correct answer: A

Explanation: Outposts extends supported AWS infrastructure and services into a customer facility while connecting it to a parent Region.

Question 4

A mobile gaming provider requires extremely low latency between application processing and users connected through a supported 5G network. Which AWS infrastructure option is designed for this requirement?

A. AWS Wavelength Zone
B. Cross-Region VPC peering only
C. Amazon S3 Multi-Region Access Points only
D. An additional private subnet in the primary Region

Correct answer: A

Explanation: Wavelength Zones place selected AWS resources within telecommunications providers’ 5G networks, reducing latency to supported 5G devices.

Question 5

An architect is designing a production service that must tolerate an AZ outage and must also recover after a complete Regional disaster. Which strategy best matches both requirements?

A. Use one large EC2 instance in a single AZ and CloudFront for caching.
B. Deploy redundant components across multiple AZs and establish a tested recovery or secondary deployment in another Region.
C. Use two subnets in the same AZ and an Internet Gateway.
D. Place all components in an AWS Local Zone without a regional deployment.

Correct answer: B

Explanation: Multi-AZ architecture addresses regional high availability against an AZ failure. A separate Region, with explicit data replication and recovery procedures, addresses a full-Region disaster.