VPC

VPC

1. Overview

   • Virtual Data Centre
     • Can Hardware VPN and use as extension
   • IGW or VPN into VPC
     • 5 VPCs per region
     • 1 Subnet = 1 AZ
       • Smallest = /28
   • Security and Groups
     • Groups Stateful
     • ACLs Stateless
   • Default
     • All subnets same route to Internet

2. VPC Peering

   • Isolated resources need to talk
   • Can cross-account peer
   • Direct network route - private IPs
   • No transitive peering - Hub and spoke

3. NAT Instance & Gateway

   • Instance
     • Community AMI. Public subnet
     • In Security Group
     • Must have route out of private
     • Single is bottleneck - SPOF
     • Can use as Bastion
       • Administration only
   • Gateway
     • Egress only (IPv6) Gateway (Ipv4)
     • Preferred to instances
       • More secure
     • Not only 1 in AZ

4. NACLs & SGs

   • One subnet = 1 AZ with 1 ACL
     • ACL can be multiple subnets
   • Increment in 100s
   • NACL more granular
     • Block IPs, not with SG
   • Ephemeral ports = 1024-65535
   • Deny before allow - stops when found

5. VPCs and ELBs

   • ALB, unless network performance
   • 2 subnets chosen (public)

6. Flow Logs

   • To/from Network Interfaces
     • Not all logged
       • DNS, Windows License, 169.254.169.254, DHCP, VPC router
       • Peered VPCs
   • 3 levels: VPC, Subnet, Network Interface
   • Can't change config after created

7. Endpoints

   • Can attach to live EC2
   • Interface
     • ENI entry point
   • Gateway
     • Similar to NAT
       • But private network
         • No Internet access, e.g. S3