Aws VPC
- 1. Amazon Virtual Private Cloud Abhishek Amralkar
- 5. Benefits of Using Amazon VPC 1. Amazon VPC gives a lot of security to your data and instances 2. An isolated environment inside Amazon AWS to launch your instances 3. A virtual network where you can define rules and policies for your services 4. Assign static private IP addresses to your instances that persist across starts and stops. 5. Assign multiple IP addresses to your instances. 6. Change security group membership for your instances while they’re running. 7. Run your instances on single-tenant hardware. 8. Add an additional layer of access control to your instances un the form of network access control lists (ACL)
- 6. VPC Capabilities in a nutshell • User-defined address space up to /16 65,536 addresses • Up to 200 user-defined subnets up to /16 • User-defined: Virtual routing, DHCP server, and NAT instances Internet gateways, ACL’s, ingress/egress security groups and VPN tunnels. • Private IPs stable once assigned • Elastic Network Interfaces
- 7. Introduction to Amazon Virtual Private Cloud Amazon Virtual Private Cloud (Amazon VPC) enables you to launch Amazon Web Services (AWS) resources into a virtual network that you've defined. • Logically isolated network in cloud that we can control • User-defined virtual IP networking for EC2 • Private or mixed private/public addressing and secured ingress/egress • Re-use of proven and well-understood networking concepts and technologies. Four VPC Architecture scenarios • Scenario 1: VPC with a Public Subnet Only • Scenario 2: VPC with Public and Private Subnets • Scenario 3: VPC with Public and Private Subnets and Hardware VPN Access • Scenario 4: VPC with a Private Subnet Only and Hardware VPN Access
- 8. VPC with a Public Subnet Only The configuration for this scenario includes a virtual private cloud (VPC) with a single public subnet, and an Internet gateway to enable communication over the Internet. We recommend this configuration if you need to run a single-tier, public-facing web application, such as a blog or a simple website.
- 9. VPC with Public and Private Subnets • The configuration for this scenario includes a virtual private cloud (VPC) with a public subnet and a private subnet. We recommend this scenario if you want to run a public-facing web application, while maintaining back-end servers that aren't publicly accessible. A common example is a multi-tier website, with the web servers in a public subnet and the database servers in a private subnet. You can set up security and routing so that the web servers can communicate with the database servers. • The instances in the public subnet can receive inbound traffic directly from the Internet, whereas the instances in the private subnet can't. The instances in the public subnet can send outbound traffic directly to the Internet, whereas the instances in the private subnet can't. Instead, the instances in the private subnet can access the Internet by using a network address translation (NAT) instance that you launch into the public subnet.
- 11. VPC with Public and Private Subnets and Hardware VPN Access The configuration for this scenario includes a virtual private cloud (VPC) with a public subnet and a private subnet, and a virtual private gateway to enable communication with your own network over an IPsec VPN tunnel. We recommend this scenario if you want to extend your network into the cloud and also directly access the Internet from your VPC. This scenario enables you to run a multi-tiered application with a scalable web front end in a public subnet, and to house your data in a private subnet that is connected to your network by an IPsec VPN connection.
- 13. Default VPC Basics If you created your AWS account after 2013-12-04, it supports only EC2-VPC. Components • When we create a default VPC, we do the following to set it up for you: • Create a default subnet in each Availability Zone. • Create an Internet gateway and connect it to your default VPC. • Create a main route table for your default VPC with a rule that sends all traffic destined for the Internet to the Internet gateway. • Create a default security group and associate it with your default VPC. • Create a default network access control list (ACL) and associate it with your default VPC. • Associate the default DHCP options set for your AWS account with your default VPC.
- 15. Security in Your VPC Amazon VPC provides two features that you can use to increase security for your VPC: • Security groups—Act as a firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the instance level • Network access control lists (ACLs)—Act as a firewall for associated subnets, controlling both inbound and outbound traffic at the subnet level
- 16. Comparison of Security Groups and Network ACLs The following table summarizes the basic differences between security groups and network ACLs. Security Group Network ACL Network ACL Operates at the instance level (first layer of defense) Operates at the subnet level (second layer of defense) Supports allow rules only Supports allow rules and deny rules Is stateful: Return traffic is automatically allowed, regardless of any rules Is stateless: Return traffic must be explicitly allowed by rules We evaluate all rules before deciding whether to allow traffic We process rules in number order when deciding whether to allow traffic Applies to an instance only if someone specifies the security group when launching the instance, or associates the security group with the instance later on Automatically applies to all instances in the subnets it's associated with (backup layer of defense, so you don't have to rely on someone specifying the security group)
- 18. Security Group Basics The following are the basic characteristics of security groups for your VPC: • You can create up to 100 security groups per VPC. You can add up to 50 rules to each security group. If you need to apply more than 50 rules to an instance, you can associate up to 5 security groups with each network interface. • You can specify allow rules, but not deny rules. • You can specify separate rules for inbound and outbound traffic. • By default, no inbound traffic is allowed until you add inbound rules to the security group. • By default, all outbound traffic is allowed until you add outbound rules to the group (and then, you specify the outbound traffic that's allowed). • Responses to allowed inbound traffic are allowed to flow outbound regardless of outbound rules, and vice versa (security groups are therefore stateful).
- 19. • Instances associated with a security group can't talk to each other unless you add rules allowing it (exception: the default security group has these rules by default). • After you launch an instance, you can change which security groups the instance is associated with. • For information about increasing the limits related to security groups, see Amazon VPC Limits.
- 20. Differences Between Security Groups for EC2-Classic and EC2-VPC The following table summarizes the differences between security groups for use with EC2-Classic and those for use with EC2-VPC. EC2-Classic EC2-VPC You can create up to 500 security groups per region. You can create up to 100 security groups per VPC. You can add up to 100 rules to a security group. You can add up to 50 rules to a security group. You can add rules for inbound traffic only. You can add rules for inbound and outbound traffic. You can assign up to 500 security groups to an instance. You can assign up to 5 security groups to a network interface. You can reference security groups from other AWS accounts. You can reference security groups for your VPC only. After you launch an instance, you can't change the security groups assigned to it.
- 21. Dedicated Hardware Dedicated Instances are Amazon EC2 instances that run in a virtual private cloud (VPC) on hardware that's dedicated to a single customer. Your Dedicated Instances are physically isolated at the host hardware level from your instances that aren't Dedicated Instances and from instances that belong to other AWS accounts. If you are planning to use Dedicated Instances, you can implement them using either method: • Create the VPC with the instance tenancy set to dedicated (all instances launched into this VPC are Dedicated Instances). • Create the VPC with the instance tenancy set to default, and specify dedicated tenancy for any instances that should be Dedicated Instances when you launch them.
- 22. VPC Peering • A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IP addresses. Instances in either VPC can communicate with each other as if they are within the same network. You can create a VPC peering connection between your own VPCs, or with a VPC in another AWS account within a single region. • AWS uses the existing infrastructure of a VPC to create a VPC peering connection; it is neither a gateway nor a VPN connection, and does not rely on a separate piece of physical hardware. There is no single point of failure for communication or a bandwidth bottleneck. • A VPC peering connection can help you to facilitate the transfer of data; for example, if you have more than one AWS account, you can peer the VPCs across those accounts to create a file sharing network.
- 23. VPC Peering Limitations To create a VPC peering connection with another VPC, you need to be aware of the following limitations and rules: • You cannot create a VPC peering connection between VPCs that have matching or overlapping CIDR blocks. • You cannot create a VPC peering connection between VPCs in different regions. • You have a limit on the number active and pending VPC peering connections that you can have per VPC. • VPC peering does not support transitive peering relationships; in a VPC peering connection, your VPC will not have access to any other VPCs that the peer VPC may be peered with. This includes VPC peering connections that are established entirely within your own AWS account. • You cannot have more than one VPC peering connection between the same two VPCs at the same time. • Private DNS values cannot be resolved between instances in peered VPCs.
- 24. ClassicLink • ClassicLink allows you to link an EC2-Classic instance to a VPC in your account, within the same region. • ClassicLink allows you to associate the VPC security groups with the EC2-Classic instance, enabling communication between your EC2-Classic instance and instances in your VPC using private IP addresses. • ClassicLink removes the need to make use of public IP addresses or Elastic IP addresses to enable communication between instances in these platforms. For more information about private and public IP addresses, see IP Addressing in Your VPC. • ClassicLink is available to all users with accounts that support the EC2-Classic platform, and can be used with any EC2-Classic instance. • There is no additional charge for using ClassicLink. Standard charges for data transfer and instance hour usage apply.
Editor's Notes
- #8: Run a single-tier, public-facing web application such as a blog or simple web site. Run a public-facing web application, while still maintaining non-publicly accessible back-end servers in a second subnet. Extend your data center into the cloud, and also directly access the Internet from your VPC. Extend your data center into the cloud, and leverage Amazon's infrastructure without exposing your network to the Internet.
- #9: Basic Components for Scenario 1 The following list describes the basic components presented in the configuration diagram for this scenario: A virtual private cloud (VPC) of size /16 (example CIDR: 10.0.0.0/16). This provides 65,536 private IP addresses. A subnet of size /24 (example CIDR: 10.0.0.0/24). This provides 256 private IP addresses. An Internet gateway. This connects the VPC to the Internet and to other AWS products, such as Amazon Simple Storage Service (Amazon S3). An instance with a private IP address in the subnet range (example: 10.0.0.6), which enables the instance to communicate with other instances in the VPC, and an Elastic IP address (example: 198.51.100.2), which enables the instance to be reached from the Internet. A route table entry that enables instances in the subnet to communicate with other instances in the VPC, and a route table entry that enables instances in the subnet to communicate directly over the Internet.
- #11: The following list describes the basic components presented in the configuration diagram for this scenario: A virtual private cloud (VPC) of size /16 (example CIDR: 10.0.0.0/16). This provides 65,536 private IP addresses. A public subnet of size /24 (example CIDR: 10.0.0.0/24). This provides 256 private IP addresses. A private subnet of size /24 (example CIDR: 10.0.1.0/24). This provides 256 private IP addresses. An Internet gateway. This connects the VPC to the Internet and to other AWS products, such as Amazon Simple Storage Service (Amazon S3). Instances with private IP addresses in the subnet range (examples: 10.0.0.5, 10.0.1.5), which enables them to communicate with each other and other instances in the VPC. Instances in the public subnet also have Elastic IP addresses (example: 198.51.100.1), which enable them to be reached from the Internet. Instances in the private subnet are back-end servers that don't need to accept incoming traffic from the Internet; however, they can send requests to the Internet using the NAT instance (see the next bullet). A network address translation (NAT) instance with its own Elastic IP address. This enables instances in the private subnet to send requests to the Internet (for example, for software updates). A custom route table associated with the public subnet. This route table contains an entry that enables instances in the subnet to communicate with other instances in the VPC, and an entry that enables instances in the subnet to communicate directly with the Internet. The main route table associated with the private subnet. The route table contains an entry that enables instances in the subnet to communicate with other instances in the VPC, and an entry that enables instances in the subnet to communicate with the Internet through the NAT instance.
- #14: The CIDR block for a default VPC is always a /16 netmask, for example, 172.31.0.0/16. This provides up to 65,536 private IP addresses. The netmask for a default subnet is always /20, which provides up to 4,096 addresses per subnet, a few of which are reserved for our use. By default, a default subnet is a public subnet, because the main route table sends the subnet's traffic that is destined for the Internet to the Internet gateway. You can make a default subnet a private subnet by removing the route from the destination 0.0.0.0/0 to the Internet gateway. However, if you do this, any EC2 instance running in that subnet can't access the Internet or other AWS products, such as Amazon Simple Storage Service (Amazon S3).