VPC Flashcards
What is a Virtual Private Cloud (VPC)?
An isolated section of the AWS cloud where you can launch AWS resources in a user defined virtual network
How many regions can a VPC span?
1
How many AZs does a VPC span?
VPCs span all of the AZs in the Region
How many VPC’s can you have per region?
5
How many subnets can a VPC contain?
“200
more can be requested through AWS”
What is created in default VPCs?
"A CIDR block size /16 A default subnet per AZ block size /20 An Internet Gateway A default security group A default NACL A default Route Table Default DHCP options *CIDR classless inter-domain routing"
What is a Default Everywhere IP?
“0.0.0.0/0
represents all possible IP addresses”
In VPCs what is the Internet Gateway (IGW) component?
“A VPC component used to allow a VPC access to the internet
creates a target in the VPC route tables for internet-routable traffic
performs NAT for instances assigned public IPv4 addresses
*NAT network address translation”
In VPCs what is the Routing Tables component?
A VPC component used to determine where network traffic is directed
What is the relationship between route tables and subnets?
“Each subnet in your VPC must be associated with a route table
A subnet can be associated with only one route table at a time
A route table can be associated with multiple subsets”
What is a Bastion / Jumpbox?
“An EC2 instance with hardened security, the only point that accepts SSH/RDP access from the internet, the only IP allowed to SSH/RDP into surrounding VPC components
Bastions/Jumpboxes must be located in a public subnet”
Bastion vs NAT
“NAT provides private subnets outbound access and denys inboud initiations from the internet
Bastions provide inbound access to private subnets”
What is a Subnet?
“A logical subdivision of an IP network
Subnets can be public or private”
What is AWS Direct Connect?
“An AWS solution for establishing dedicated network connections from on-premises locatoins to AWS
Offers a very fast and very consistant network
Low-end Bandwidth from 50-500M
High-end Bandwidth either 1GB or 10GB”
What is a NAT?
“Network Address Translation
A method of re-mapping one IP Address space into another
Use cases:
allowing private instances internet access
resolve network address conflicts”
NAT instance vs NAT Gateway?
“Both are:
EC2 instances with NAT
located in public subnets
NAT instance(legacy)
Community maintained EC2 instance for NAT
EC2 controlled by the user
NAT Gateway
AWS maintained and managed EC2 instance for NAT
EC2s controlled by AWS
Launched with redundant instances in the slected AZ
Cannot associate a security group with a NAT gateway”
Securly connect two private subnets in different peering VPCs?
Create a NAT gateway in both VPC and configure the routes
What is the VPC Peering feature?
“It allows you to connect one VPC to another over a direct network route using private IP addresses
Instances on peered VPCs behave as though they were on the same network
Can connect to different AWS accounts and different regions”
What are some limitations on the VPC Peering feature?
“Each connection must be explicitly created
There is no Transitive Peering(the connection must be direct and explicit)
Cannot connect VPC with overlapping CIDR Blocks”
In VPCs what is a VPC Endpoint component?
“A private network connection from your VPC to anotherAWS service
Endpoints are supported within the same region only.
Benifits:
Instances in VPC don’t require public IP addresses to communicate to service resources
Traffic between your VPC and other services does not leave the AWS network”
What are the two types of VPC Endpoints?
“Interface Endpoints
Use Elastic Network Interfaces (ENI) with a private IP adress
Powered by AWS PrivateLink
Costs
Gateway Endpoints
Free
Adds a target for a specific route in your route table
Most common use case is connecting to S3 and DynamoDB”
What is the VPC Flow Logs feature?
“Monitors in-and-out traffic of your network interfaces within you VPC
They contain source and destination IP adresses (not hostnames)
They can be sent to either S3 or CloudWatch Logs”
At what infrastructure level can you turn on CloudWatch Logs?
“VPC
Subnets
Network Interface
*Each level contains information from all sources below it as well”
What are some limitations on VPC Flow Logs?
“Cannot be tagged like other AWS services
Cannot change the configuration once its created
Cannot enable flow logs for VPCs peered wiht you VPC unless it is in the same account
Some instance traffic is not monitored”
