Tag Archives: vpc

AWS Networking Components – Per the 2018 Sol Arch Exam

AWS, , , ,

Solutions Architect

Here are just some of the networking components you should be familiar with if you are interested in mastering AWS.

  • Network Interfaces – this logical network component serves to represent a physical network interface card (NIC); as such, this component can be configured with IPv4 and IPv6 addresses
  • Route Tables – just as would exist on a physical router, AWS route tables contain a set of rules, called routes, that are used to determine where network traffic is directed
  • Internet Gateways – an internet gateway serves two purposes: to provide a target in your VPC route tables for internet-routable traffic, and to perform network address translation (NAT) for instances that have been assigned public IPv4 addresses
  • Egress-Only Internet Gateways – a VPC component that allows outbound communication over IPv6 from instances in your VPC to the Internet, and prevents the Internet from initiating an IPv6 connection with your instances
  • DHCP Options Sets – DHCP provides a standard for passing configuration information to hosts on a TCP/IP network; the options field of a DHCP message contains the configuration parameters; some of those parameters are the domain name, domain name server, and the netbios-node-type; the option sets allow you to configure such options for your virtual private clouds (VPC)
  • DNS – AWS provides you with a DNS server for your VPC, but it is important to realize that you can also use you own
  • Elastic IP Addresses – a static IPv4 address designed for dynamic cloud computing; an Elastic IP address is associated with your AWS account; with this address, you can mask the failure of an instance or software by rapidly remapping the address to another instance in your account
  • VPC Endpoints – enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by PrivateLink without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection
  • NAT – you can use a NAT device to enable instances in a private subnet to connect to the Internet (for example, for software updates) or other AWS services, but prevent the Internet from initiating connections with the instances; AWS offers two kinds of NAT devices—a NAT gateway or a NAT instance, but strongly recommends the use of NAT gateways
  • VPC Peering – a networking connection between two VPCs that enables you to route traffic between them privately; you can create a VPC peering connection between your own VPCs, with a VPC in another AWS account, or with a VPC in a different AWS Region
  • ClassicLink – allows you to link your EC2-Classic instance to a VPC in your account, within the same region; this allows you to associate the VPC security groups with the EC2-Classic instance, enabling communication between your EC2-Classic instance and instances in your VPC using private IPv4 addresses

Some AWS Virtual Private Cloud (VPC) Components to Review for Sol. Arch.

AWS, , ,

Solutions Architect

Here are some key VPC components I would like you to review for the Solutions Architect – Associate certification (2018 edition).

VPC Endpoint

A VPC endpoint enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by PrivateLink without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC do not require public IP addresses to communicate with resources in the service. Traffic between your VPC and the other service does not leave the Amazon network.

There are two types of VPC endpoints – interface and gateway VPC endpoints. The interface type (powered by AWS PrivateLink) is an elastic network interface with a private IP address that serves as an entry point for traffic destined to a supported service. The gateway type is a target for a specified route in your route table, used for traffic destined to a supported AWS service.

Examples of services supported for the VPN interface endpoint type are:

  • EC2 API
  • EC2 Systems Manager
  • Kinesis Data Streams
  • AWS Key Management Service
  • AWS Service Catalog
  • Elastic Load Balancing API
  • Endpoint services hosted by other AWS accounts

Examples of services supported for the VPN gateway endpoint type are:

  • S3
  • DynamoDB

Keep in mind that by default, IAM users do not have permission to work with endpoints. You can create an IAM user policy that grants users the permissions to create, modify, describe, and delete endpoints.

VPC Flow Logs

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data is stored using Amazon CloudWatch Logs. After you have created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs.

Flow logs can help you with a number of tasks; for example, to troubleshoot why specific traffic is not reaching an instance, which in turn helps you diagnose overly restrictive security group rules. You can also use flow logs as a security tool to monitor the traffic that is reaching your instance.

There is no additional charge for using flow logs; however, standard CloudWatch Logs charges apply.