# Managed Dedicated: AWS Architecture

A Managed Dedicated instance on AWS runs in its own VPC, in an AWS account that
Zuplo manages, in the AWS region you choose. Zuplo provisions, operates, scales,
and upgrades the instance. You don't need an AWS account to use it, but you need
one to connect it to backends in your own VPC.

For the components that make up every Managed Dedicated instance, see
[Architecture](../architecture.mdx).

## Availability

The gateway runs across multiple availability zones in your region, and the load
balancer in front of it spreads traffic across zones. If one zone fails, the
other zones keep serving traffic.

To run in more than one region, contact your account manager.

## Inbound traffic

Clients reach the gateway through a public, internet-facing load balancer. Zuplo
terminates TLS and manages the certificates, including for your
[custom domains](../custom-domains.mdx).

To put a CDN or WAF, such as Amazon CloudFront with AWS WAF, in front of the
gateway, make sure clients can't bypass it and call the gateway directly. Have
the CDN add a shared secret header that the gateway checks, or authenticate the
CDN with
[client mTLS](../../articles/securing-the-gateway-with-client-mtls.mdx).

## Outbound traffic and IP addresses

The gateway reaches the internet through NAT gateways, one per availability
zone, each with a fixed public IP address. If your backend or a third-party API
allowlists callers by IP address, ask your account manager for these addresses.

## Connecting to your backends

The gateway can call any backend it can reach over the internet. To keep backend
traffic off the public internet, use PrivateLink, VPC peering, or Transit
Gateway. See [AWS Private Networking](./private-networking.mdx).

However your backend is reached, make sure it only accepts requests from your
gateway. See [Securing your backend](../../articles/securing-your-backend.mdx).