Virtual Private Cloud

  • Overview
    • Architecture
      • Internet Gateway/Virtual Private Gateway > Router > Route Table > Network ACL > Security Group > Instance (public or private subnet)
      • The VPC CIDR will range from a /16 to /28
    • Default VPC and Custom VPC
      • All subnets in default VPC have a route to the internet
      • Each EC2 instance in a default VPC has a public and private IP address
    • VPC Peering – Allows you to connect one VPC to another VPC via a direct network route using private addresses
      • Instances behave as if they were on the same private network
      • You can peer VPCs in the same account, between regions, and other AWS accounts
      • Peering is in a star configuration with one central VPC which peers with four others (no transitive peering)
  • VPC Flow Logs – A feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data is stored using Amazon CloudWatch Logs. After you’ve created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs.
    • Created at the following three levels
      • VPC, subnet, network interface
  • Bastion Host – A bastion station is used to securely administer EC2 instances using SSH or RDP. Also called a jump box.
  • Direct Connect – Useful for high throughput workloads or if you need a stable and reliable secure connection
  • Global Accelerator – A service in which you create accelerators to improve availability and performance of your applications for local and global users. Global Accelerator directs traffic to optimal endpoints over the AWS global network. This improves the availability and performance of your internet applications that are used by a global audience. You are assigned two static IP addresses (or alternatively you can bring your own). You can control traffic using traffic dials (this is done within the endpoint group)
    • By default, Global Accelerator provides you with two static IP addresses that you associate with your accelerator. Alternatively, you can bring your own.
    • Accelerator – Directs traffic to optimal endpoints over the AWS global network to improve the availability and performance of your internet applications. Each accelerator includes one or more listeners.
    • DNS Name – Global accelerator assigns each accelerator a default DNS name that points to the static IP addresses that Global Accelerator assigns to you
    • Network Zone – A network zone services the static IP addresses for your accelerator from a unique IP subnet. Similar to an AWS availability zone, a network zone is an isolated unit with its own set of physical infrastructure
    • Listener – A listener processes inbound connections from clients to Global Accelerator, based on the port (or port range) and protocol that you configure. Global Accelerator supports both TCP and UDP protocols. Each listener has one or more endpoint groups associated with it, and traffic is forwarded to endpoints in one of the groups. You associate endpoint groups with listeners by specifying the regions that you want to distribute traffic to. Traffic is distributed to optimal endpoints withing the endpoint groups associated with a listener.
    • Endpoint Group – Each endpoint group is associated with a specific region. Endpoint groups include one or more endpoints in the region. You can increase or reduce the percentage of traffic that would be other directed to an endpoint group by adjusting a setting called a traffic dial.
    • Endpoint – Endpoints can be network load balancers, EC2 instances, or Elastic IP addresses
  • VPC Endpoint – A VPC Endpoint enables you to privately connect your VPC to supported AWS services and VPC Endpoint services powered by PrivateLink without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC do not require public IP addresses to communicate with resources in the service. Traffic between your VPC and the other service does not leave the Amazon network.
    • Interface Endpoints – An ENI with a private IP address that serves as an entry point for traffic destined to a supported service
    • Gateway Endpoints