VPC

VPC (Virtual Private Cloud)

This is your private section of AWS, where you can place AWS resources, and allow/restrict access to them.

  • exists within a single AWS region

  • user defined IP address range

Internet gateway (IGW)

Provides your private network with a route to the world outside of VPC.

  • IGW <one-to-one> VPC

  • if (VPC contains active resources) {
    IGW can not be detached from VPC
}

Route tables RTs

RTs contains rules (routes) that are used to determine where network traffic is directed.

  • 172.31.0.0/16 local

    • if destination IP address falls in this range => communication is kept local inside VPC

  • 0.0.0.0/0 igw-<some-id>

    • if destination IP is not in the range above (172.31...) => communication is directed through the IGW out to the internet 

    • if (IGW is detached) {
    RTs still directs traffic to IGW
    But IGW has no connection to outside world
}
    • if (detach IGW_1 & attach IGW_2 for VPC) {
    update_RTs_routes()
}

func update_RTs_routes() {
    delete route for IGW_1
    add "0.0.0.0/0" route to IGW_2
}

Network Access Control List (NACL)

It is a optional layer of security for VPC that acts like a firewall for controlling traffic in and out of one or more subnets.

Rules:

  • numbered (processed from lowest to highest)

    • The first rule evaluated that applies to the traffic type get immediately applied and executed regardless of the rules that come after (have a higher rule #)

  • "*" is a default (i.e. if you do not explicitly allow traffic => default rule will DENY it)

💡 Subnet <-1-1-> Network ACL (subnet can be in only one NACL)

⚠️ Whenever you have a problem with connectivity of services => check NACL

Subnet

💡 One subnet can not span more than one availability zone.

Subnet <=> Route table. So if Route table does not have a route to internet => Subnet is private.

Availability zone

When you create a VPC => it spans all of the Availability zones in the region. After creating a VPC, you can add one/more subnets in each Availability zone.

  • High availability

    • I can always access my data in the cloud

    • My website never crashes and it always available to customers

  • Fault tolerance

    • If web server failed => backup server immediately takes over

    • If something in the system fails => it can repair itself

PreviousAWSNextEC2

Last updated