Netflix: control plane on AWS, video on its own CDN
Why the biggest streamer runs everything on AWS except the one thing you'd expect: the video bytes.
Two networks, one product
Netflix splits its architecture along the cleanest seam in networking: control plane versus data plane. Everything that happens before you press play (sign-in, browsing, recommendations, DRM licensing, playback orchestration) runs on AWS, active across four Regions, on thousands of auto-scaling compute groups with Aurora, EMR, and EKS underneath.
The video itself never comes from AWS. It comes from Open Connect, Netflix's own CDN: purpose-built cache appliances (OCAs) that Netflix gives to ISPs for free, racked inside the ISP's own network or peered at internet exchanges.
Two networks, one product: AWS control plane vs Open Connect data plane
Trace
Everything that happens before you press play (sign-in, browsing, recommendations, DRM licensing, playback orchestration) runs on AWS across four active Regions on auto-scaling compute with Aurora, EMR and EKS. The video bytes themselves never come from AWS: they are served by Open Connect Appliances (OCAs) racked inside ISP networks and peered at internet exchanges. S3 is the master content store that feeds the appliances, but user streams terminate at the nearest OCA, not in a Region.
How traffic finds the cache
Each OCA announces routes over BGP sessions with the ISP, and Netflix's steering services in AWS decide, per client, which appliance serves the stream. Popular titles are pushed to appliances during off-peak windows (the nightly fill), so at prime time the bytes travel meters of ISP network instead of transit internet.
This is the pattern behind every 'optimize global delivery' exam scenario: terminate user traffic as close to the user as possible, keep the origin path for fills and misses, and let BGP plus health-aware steering pick the door. CloudFront plus Route 53 or Global Accelerator is the same shape inside AWS.
How traffic finds the cache: BGP announcements plus AWS steering
Trace
Each OCA announces routes over BGP sessions with the ISP, and Netflix's steering services in AWS decide, per client, which appliance serves the stream. Popular titles are pushed to the appliances during off-peak windows (the nightly fill) driven by fill state and appliance health, so at prime time the client's video request terminates at a filled OCA meters away instead of crossing the transit internet. This is the shape behind every 'optimize global delivery' scenario: BGP plus health-aware steering picks the door, and the origin path is kept only for fills and misses.
What this teaches for the exam
When a question separates 'API traffic' from 'bulk content delivery,' treat them as different networks with different answers: edge caching and steering for content, Regional entry points and failover for the control plane.
The multi-Region active-active control plane also matters: four Regions with health-based traffic management is the reference architecture behind Route 53 failover and Application Recovery Controller questions.
What this teaches: multi-Region active-active control plane and the AWS analog
Trace
The control plane runs active-active across four Regions with health-based traffic management: Route 53 resolves users to a healthy nearby Region, and Application Recovery Controller governs readiness and routing so traffic shifts away from an impaired Region. This is the reference architecture behind Route 53 failover and Application Recovery Controller questions. Content delivery stays a separate network (Open Connect); the AWS-native equivalent of that same shape is CloudFront plus Route 53 or Global Accelerator. When a question separates 'API traffic' from 'bulk content delivery,' treat them as two networks with different answers.
More diagrams
Netflix: AWS control plane, Open Connect data plane
Trace
Everything before you press play runs on AWS across four Regions. The video bytes themselves come from Open Connect Appliances embedded inside ISP networks and at internet exchanges, announced over BGP, so streaming traffic never crosses the transit internet or AWS.
