VPCs Flashcards
(39 cards)
VPC
virtual data center in the cloud
1 subnet = 1 AZ
Largest subnet you can use in your VPC
10.0.0.0/16
65,526 addresses
VPC features
launch instances in a subnet of our choosing
assign custom IP address ranges
configure route tables between subnets
create internet gateway and attach to our VPC
NACLs
instance security groups
Default vs custom vpc
default: user friendly; allows immediate deployment of instances
VPC peering
connects 2 VPCs via a direct network route using private IP addresses
Instances behave as if they were on the same private network
can peer across regions
Does not support transitive peering
security groups vs NACLs
security groups: stateful
NACLs: stateless
need to add individual allow and deny lists
What gets created by default when you create a VPC
route table
NACLs
security group
Route table best practice
Keep primary route table private
VPC security groups
security groups cannot span multiple VPCs
NAT instance vs NAT gateway
NAT instance - invidiual instance
NAT gateway - highly available way to provide internet access to private subnets w/out becoming public
NAT gateways HA/DR
redundant inside an AZ
cannot span multiple AZs
NAT gateway security groups
Not associated with security groups
NAT gateway config info
no need to patch need to update route tables automatically assigned a public ip addr no need to disable source/dest checks create a nat gateway in each availability zone
NACLs and Security Group order of operations
NACLs resolved before security groups
NACL rules resolved in order of rule #, stopping on match
ACL and subnet associations
ACL - can have many subnets
subnet - can only have one ACL
Load balancer config
need at least 2 public subnets
VPC flow log levels
vpc
subnet
network interface level
VPC flow log config
cannot change VPC config after it’s created
cannot associate a different IAM role w/ flow log
can tag flow logs
Bastion host - definition
special purpose computer designed and configured to withstand attacks
Either outside of firewall or in DMZ
helps reduce attack surface by removing need to harden devices behind it
used to securely administer EC2 instances
AKA jump box
Direct Connect
service solution used to establish a dedicated network connection from on-prem to AWS
reduces network costs
increases bandwidth
stable and reliable secure connection
global accelerator
improves availability and performance of apps
directs traffic to optimal endpoints over AWS
by default provides two default IP addresses
-customer can bring their own
global accelerator components
static ip addresses accelerator dns name network zone listener endpoint group endpoint
global accelerator network zone
services the static ip addresses
similar to an AZ
each zone is isolated within it’s own physical infrastructure
global accelerator listener
processes inbound connections from clients to global accelerator based on configured port and protocol
listeners forward traffic to endpoints in attached/associated endpoint groups
endpoint groups associated to listeners by region
