AWS Virtual Private Cloud (VPC)

This is part of a blog series giving a high level overview of the different services examined on the AWS Solution Architect Associate exam, to view the whole series click here.

VPC Summary

VPC Logo — https://bit.ly/3dfDUH2

• A VPC is a logically separated section of AWS for you to launch resources in a network you define.
• VPC’s consist of an internet gateway or virtual private gateway, subnets, route tables, network access control lists and security groups.
• A subnet is a range of IP addresses within your VPC. A subnet can not span multiple availability zones.
• When we create a VPC, the following are created by default: a route table, network access control list and security group.
• Subnets or internet gateway are not created by default.
• Auto assigning a public IP Address is turned off by default, this will need to be updated if you want a public subnet.
• You can only have one internet gateway in your VPC
• You are not charged for using a VPC, however you are charged for the components used within it e.g. gateway, traffic monitoring etc.
• One way to save costs when it comes to networking is to use private IP addresses instead of public IP addresses as they utilise the AWS Backbone network.
• If you want to cut all network costs, group all EC2 instances in same AZ and use private IP addresses.
• You can have 5 VPCs per AWS region.

Connecting to a VPC

There are two ways to connect into a VPC:

1. Virtual Private Gateway
2. Internet Gateway

What you can do with VPC

• Launch instances
• Assign custom IP address ranges
• Configure route tables between subnets

VPC IP Ranges

• Amazon don’t allow /8 prefix as it is too large — the largest they allow is /16
• AWS will always reserve 5 IP Addresses within a CIDR block for:

1. Network Address
2. Router Address
3. DNS Server Address
4. Broadcast address
5. 1 more for future use

• These are the first four IP addresses and the last IP address

VPC Peering

• This is a connection between VPCs, that allows you to route traffic between them using private IP addresses.
• The peering connections allow instances to operate as if they were in the same network.
• It is possible to peer with another AWS account or region.
• Peering connections have to be one-to-one relationships. There is no transitive peering, so you can’t transit between one VPC to connect to another — each VPC has to be directly connected to another.

Types of tenancy

On set up of your VPC you will be asked to choose either:

1. Dedicated → Everything on dedicated hardware (Very expensive)
2. Default → multi-tenant share underlying hardware with other AWS customers

Network Access Control Lists (NACL)

• Extra layer of security for your VPC as it can be used to control the traffic in and out of subnets.
• Similar to security groups, as they contain rules, but you can you can block IP addresses with a NACL, unlike with security groups.
• A NACL can be associated with many Subnets, but a subnet can only have one NACL
• NACL are stateless, meaning they can have separate inbound and outbound rules, again unlike with security groups.

Route Table

• A route table is created by default with your VPC.
• Allows subnets to talk to each other. It is a set of rules that determines where the network traffic is directed.
• Every subnet within your VPC must be associated with a route table.
• By default your subnets are associated with the main route table, but this can be a security risk e.g. if you were to put a route out to the public internet in the route table all subnets would automatically be made public.
• To resolve this — keep main route table as private and then have separate route tables that use the main one, but have additional routes.

Internet Gateways

• Allows your VPC to communicate with the internet.
• For internet communication, you must set up a route in your route table that directs traffic to the Internet Gateway.
• Performs network address translation for instances.

Network Address Translation (NAT) Gateways/ Instances

• NAT gateways/instances provides private subnets access to internet traffic, but ensures internet traffic does not initiate a connection with the instances.
• For example this can enable our EC2 Instances in a private subnet to go out and download software by communicating with our Internet Gateway.
• The NAT gateway or instance must live in a public subnet and then for a private subnet to connect to it, the private subnet must have a route in its route table that directs traffic to it.

NAT Instances

• Since NAT Instances send and receive traffic from different sources/destinations, it can cause some issues as EC2 does source/destination checks automatically — so when using a NAT Instance you need to disable source/destination checks on the EC2 instance when creating it.
• NAT instances are managed by you.
• You can associate them with security groups to control inbound and outbound traffic.

NAT Gateway

• NAT Gateways are preferred by enterprise as they are highly available, can scale and are managed by AWS.
• Can not be associated with security groups, but you can associate the resources behind the NAT Gateway with security groups.
• Automatically assigned public IP Address
• For NAT Gateways you don’t need to worry about disabling source & destination checks on the instance.
• You can create an AZ independent architecture with Network Gateways to reduce the risks of failures. This can be done by creating a NAT Gateway in each AZ and then configuring the routing to ensure resources in the same NAT Gateway are in the same AZ.

VPC Flow Logs

• Capture information about IP traffic entering and leaving interfaces in your VPC.
• You can publish these flow logs with CloudWatch or S3.
• They allow you to monitor the traffic reaching your instances and can help you see if your security groups are restrictive enough.
• Flow logs do not impact latency or network throughput as they are collected outside the path of your network traffic.
• You can have flow logs for peered VPCs, but only if they are in same account.
• Can be created at 3 levels: VPC, Subnet, Network Interface level.

Direct Connect

• Directly connects your on-premise datacenter to an AWS VPC using a dedicated network connection over a standard ethernet fiber-optic cable.
• Benefits of using Direct Connect includes: reduced network costs and increase in bandwidth throughput.

Global Accelerator

• Allows you to improve availability and performance of your applications for global users.
• Can improve performance by up to 60% as it directs traffic to optimal endpoints to avoid congestion.
• You are assigned two static IP address — alternately you can bring your own.
• Can automatically mitigate endpoint failure by re-routing traffic to nearest healthy endpoint.

VPC Endpoint

Allows you to privately connect a VPC to other AWS resources and it is powered by Private Link, so traffic never leaves the AWS Network.

3 types:

1. Interface endpoint →Attach an elastic network interface with a private IP address onto your EC2 instance for it to communicate to services using AWS network.
2. Gateway Load Balancer endpoints → Is an entry point that intercepts traffic and routes it to services configured using Gateway Load Balancers.
3. Gateway endpoints →Create it as a route table target for traffic to services, like NAT gateways — its supported for only S3 & Dynamo.

VPC Private Link

• Provides private connections between VPC’s, AWS services and on-premise networks.
• Best way to expose your VPC to hundreds or thousands of other VPC’s.
• Can secure your traffic and simplify network management.
• Doesn’t require VPC peering, route tables or NAT gateways
• Requires Network Load Balancer on the service VPC and an elastic network interface on the customer VPC.

Transit Gateway

• Allows transitive peering between VPCs and on-premises data centres through a central hub.
• Works on regional bases but can span multiple regions.
• Supports IP Multicast, so can distribute the same content to multiple specific destinations (NOT supported by any other service)
• Overall used to simplify network typology.

VPN CloudHub

• With multiple sites all on different VPN connections, you can use VPN CloudHub to securely connect them.
• Low cost easy to manage.
• Operates over public internet, but all traffic is encrypted.