So, this has been quite a long,
interesting section, I hope.
And hopefully you understand it.
If you need to revise some contents
watch it twice. Maybe it makes more sense
after a week of watching again.
I know VPC was so difficult for me to learn.
It's networking. It's new. Lots of new acronyms,
not easy concepts so take your time and
don't be afraid if you didn't undeestand
all of it, just get back to it.
But let's summarize what we learned.
So a CIDR is an IP range.
A VPC is a Virtual Private Cloud,
which is working for IPv4 and IPv6.
Subnets are tied to an AZ in which we define
CIDRs and we have public and private subnets.
So why do we have a public subnets?
Well, we attach an internet gateway and then
we cut a route from from the public subnet to
the internet gateway, and this provides provides
IPv4 and IPv6 internet access if enabled.
Now route tables will then be edited to have
routes to the alternate gateway,
the VPC peering connections, the VPC endpoints,
and so on. And they're key to make sure
that the network flows within our VPC.
The Bastion Host was a public EC2 instance that
we were able to SSH into, and this instance
had SSH connectivity to other EC2
instances in private subnets.
That's why it's called the Bastion Host.
Net Instances was an EC2 instance deployed
in a private, in a public subnet to
give internet access to EC2 instances in
the private subnets. It is old.
It is getting deprecated and you need to
disable the source destination check flag for it
to work and also edit your security group rules.
So we have the net gateway instead,
which is much better. It's managed by AWS.
It provides scalable internet access to private
EC2 instances, and it only works for IPv4.
So if you want to have the private DNS using
Route 53, you need to enable DNS resolution and
DNS host name settings in your VPC.
So two settings to enable. Next, NACL.
So they were network SCLs and they were
firewall rules to define inbound and outbound
access at the subnet level, and don't forget
about Ephemeral Ports and its NACLs are
stateless, so inbound and outbound rules
are always evaluated. Whereas security group
rules are stateful. That means that if the
inbound is allowed, the outbound is automatically
allowed and vice versa. And security group rules
are applied at the EC2 instance level.
VPC Reachability Analyzer was allowing us
to perform some network connectivity testing
between different AWS resources and debug them.
VPC Peering was very helpful to connect two
VPCs together and only if they have none overlapping
CIDRs, and VPC Peering connections are
non-transitive so if you need to connect 3 VPCs together,
you need to have 3 VPC Peering connections.
VPC endpoints are allowing us to get
private access to AWS services such as
Amazon S3, DynamoDB, CloudFormation, SSM,
whatever you want within a VPC.
We saw they were gateway end points for Amazon S3
and DynamoDB, and all the rest was
interface end points. VPC Flow Logs was the
way for us to get some level of metadata around
all the packets within our VPC, and we had
some information around the ACCEPT and
REJECT traffic. Now, VPC Flow Logs can
be created at the VPC subnets or ENI level,
and they can be analyzed and sent to Amazon S3
and then analyzing Athena, or they can be sent
to CloudWatch logs and then analyzed using
CloudWatch Logs Insights for example.
Now if you connect your VPC to your data center,
you have two options. The first one is a
site-to-site VPN, and so to do a site-to-site VPN
is a VPN connection over the public internet in
which we have to create a virtual private gateway
on AWS and a customer gateway on your sensor,
and then you establish a VPN connection.
And then we saw that if we establish multiple VPN
connections using the same virtual private gateway,
then we could use VPN CloudHub to have a
hub-and-spoke VPN model to connect our sites.
The second way to connect to our data center
was to use Direct Connect, so this time the
connection is completely private.
It does not go over the public internet,
but it takes time to establish.
You need to hook your own data center
to a direct connect location for it to work.
So it's more involved but it's more secure
and has more stability onto the connection.
Now Direct Connect Gateway was to set up a direct
connect to many VPCs in different AWS regions.
We saw PrivateLink or VPC Endpoint Services,
which is to connect privately to services
within your VPC that you have created
yourselves to customer VPC, and the
cool thing about it is that it doesn't
require VPC Peering, or the public internet,
or NAT Gateway, or Route Tables.
It's only used, mostly used with a
Network Load Balancer and ENI,
and this allows us to expose a service with
an RVPC to hundreds or thousands of customer
VPCs without exposing your network.
ClassicLink is to connect EC2-Classic instances
privately to your VPC but it's going to
be deprecated very soon too.
Transit Gateway is a transitive peering
connection for your VPC, VPN and direct connect,
and it has this fact that everything
can flow through it, which is quite nice.
Traffic Mirroring is to copy network traffic
form your ENIs elsewhere for further analysis.
And then we looked at IPv6 in your VPC.
We saw how to enable it, and we saw that
there was the existence of the egress-only
internet gateway, which is just like
a NAT Gateway but for IPv6 traffic out to the internet.
So that's it, it was a very long
summary lecture, of course,
but hopefully you learned a lot and
hopefully all the things I've said,
make sense or ring a bell. If they don't,
watch again this section and you'll be good to go.
So that's it from me. I hope you liked it.
And I will see you in the next lecture.