Networking

Amazon cloud computing resources are hosted in multiple locations world-wide. These locations are composed of AWS Regions, Availability Zones, and Local Zones.
Each AWS Region is a separate geographic area.
Each AWS Region has multiple, isolated locations known as Availability Zones (AZ).
By using Local Zones, you can place resources, such as compute and storage, in multiple locations closer to your users.

Virtual Private Cloud (VPC) is a secure and isolated network segment, used to segregate resources in an AWS account.
VPCs are specific to a region.
They act as a network boundary.
Every VPC is allocated a range of IPs called a CIDR block.

A default VPC is configured by AWS in every region.
Internet connectivity is enabled by default in a default VPC via the Internet Gateway.
Each default VPC uses a /16 CIDR block range of 172.31.0.0/16 = 65,536 addresses.

A default subnet is created in each Availability Zone (AZ) and is allocated a /20 CIDR block range = 4,096 addresses.

A default security group allows outbound traffic.

A default Network Access Control List (NACL) allows both outbound and inbound traffic.

Subnets are a group of IP addresses within a VPC.
They are bound to an availability zone (AZ).
Subnets can be either public or private.

A Subnet block size is between /16 and /28.
The first 4 IP addresses and the last IP are reserved.

There is an option to auto-assign public addresses to resources created in a subnet.

Every VPC has a VPC Router.
The router has a router interface in every subnet of the VPC.
The Router is allocated the (network IP Address + 1) as its address.

Role of the router is to route traffic between subnets and in/out of the VPC.

A route table controls the router.

Multiple subnets can use the same route table.
However, 1 subnet can have only 1 route table.

By default, subnets are private, that means they are not connected to the public internet.

Internet Gateways make a subnet public.

Internet Gateways have a 1:1 relationship with a VPC.

The following steps can be performed to make a subnet accessible over the public internet.

Internet Gateways are region resilient.

NAT = Network Address Translation

A NAT Instance allows EC2 instances in private subnets to connect to the internet.

The NAT instance must be launched in the public subnet.

It must disable the EC2 settings for Source / Destination Check.

It must have an Elastic IP attached to it.

NAT instances can have their own security groups attached.

A NAT Gateway is an AWS managed NAT that allows internet access only if the communication is initiated from within AWS.
NAT Gateways still need an Internet Gateway to have access to the Internet.
They provide high bandwidth, high availability and need no administration.

NAT Gateways are subnet and AZ specific (they are not region resilient)

NAT Gateways can offer a bandwidth of 5 Gbps to 100 Gbps and you need to pay per hour for usage and bandwidth.

They cannot be used by EC2 instances from within the same subnet.

Domain name for private IP = private IP + .ec2.internal

AWS DNS = 169.254.169.253 or the second IP address of the VPC CIDR

enableDnsHostnames option allows public addresses to get a DNS host name.
enableDnsSupport determines whether the VPC supports DNS resolution through Amazon DNS server.

An Elastic IP is a static IP address reserved for your account.It can be attached to an EC2 instance to have a constant public IP address.

Network Access Control Lists (NACLs) are stateless firewalls.
They operate at the subnet level.
They are used to configure both inbound and outbound rules in order to filter traffic entering and leaving a subnet.

Every subnet has a NACL.

NACL does not handle traffic within a subnet.

NACL rules can either allow or deny traffic.

A default NACL is associated with all new subnets.

Security Groups are stateful firewalls.It means that if a request is permitted then the response is automatically permitted.
Security Groups act as a firewall for individual resources.
Security Groups have a default deny policy and allow only what is needed.
By default, Security Groups allow all outbound traffic.
Security Groups are specific to a VPC.
Rules in different security groups are merged.

One Security Group can be attached to many instances. One instance can be attached to multiple security groups.

Security Groups do not filter traffic for:

AWS Client VPN is an AWS Managed IPSec VPN Connection service that enables you to securely access your AWS resources and resources in your on-premises network. With Client VPN, you can access your resources from any location using an OpenVPN-based VPN client.

An IP SEC tunnel is established over the public internet between the Virtual Private Gateway and the Customer Gateway.

Connection can be of two types:

You are charged for each endpoint association and each VPN connection on an hourly basis.
You are charged for data transfer out from Amazon EC2 to the internet.

1.25 Gbps is the maximum bandwidth per VPN tunnel
Maximum of 140,000 packets can be transmitted per second
Maximum transmission unit (MTU) is 1,466 bytes

Direct connect is a physical connection from on-premise to AWS

A Direct Connect Location (DX) is a rack on a data center. In the DX, both the customer and AWS have a dedicated router. Purchasing Direct Connect means purchasing a port on AWS’s router.

AWS router to public AWS services can connect directly.
AWS router to private AWS services must go through a VPN Gateway.

The connection between the AWS Router in DX to AWS is over the AWS backbone (not internet).

Dedicated: 1 Gbps, 10 Gbps and 100 Gbps options available
Hosted: 50 Mbps, 500 Mbps to 10 Gbps
Charged per port hour and outbound data transfer

ETA to set up a Direct Connect connection is 1 month.

Direct Connect can have High Resiliency by having multiple AWS Direct Connect Locations.

Maximum resilience can be achieved by separate connections terminating on separate devices in more than one location

If Direct Connect Primary Connection fails, then Site to Site connection can be used as a backup to connect through public Internet.

By default, resources in one VPC cannot talk to resources in another VPC. To enable this connection we need VPC Peering.

The constraint to enable VPC peering is that the VPCs cannot have overlapping CIDRs.

VPC Peering can be cross region or even cross account.

Setting up VPC Peering is at no additional cost.

Data transfer within an AZ is free, whereas data transfer across AZs is charged.

A peering request has to be sent and accepted.

Route tables need to be updated.

Security groups can be referenced across VPCs.

A VPC endpoint enables customers to privately connect to supported AWS services and VPC endpoint services powered by AWS PrivateLink (not over the internet).

AWS PrivateLink uses Network Load Balancers to connect interface endpoints to services.

VPC Endpoints remove the need for an Internet Gateway or a NAT Gateway to access AWS services

VPC Flow Logs capture information about IP traffic going into your interfaces.

Flow logs can be captured at the VPC, Subnet or Elastic Network Interface (ENI) level.

The main use of VPC Flow Logs is to help monitor and troubleshoot connectivity issues.

Flow Logs can be saved to S3, CloudWatch Logs or Kinesis Data Firehose.

They can capture network information from AWS managed interfaces like ELB, RDS, ElastiCache, Redshift, WorkSpaces, NAT Gateway, Transit Gateway etc.

VPC FLow Logs can be analyzed using Athena on S3 through SQL queries and visualized using Amazon QuickSight. Another option is to view them through CloudWatch Logs by using CloudWatch Contributor Insights or CloudWatch Alarms.

Site to Site VPN is similar to a Direct Connect, but the connection between the Customer Gateway and the Virtual Private Gateway is via the public internet.

If you have multiple AWS Site-to-Site VPN connections, you can provide secure communication between sites using the AWS VPN CloudHub. This enables your remote sites to communicate with each other, and not just with the VPC. Sites that use AWS Direct Connect connections to the virtual private gateway can also be part of the AWS VPN CloudHub.

As the number of VPCs increases, establishing a connectivity between them becomes complex.
The Transit Gateway is used to have a transitive peering between thousands of VPCs and on-premise environments. It works on a hub-and-spoke (star) model. The VPCs have to peer with the Transit Gateway and then all the VPCs can connect to each other.

One subnet from each AZ is used by the transit gateway to route traffic.

This is great for on-premise environments to connect to AWS. In case of a Direct Connect connection, a connection with the Transit Gateway can be established so on-premise environments have connectivity to all VPCs. Similarly, if a Site to Site VPN connection is used, a VPN connection can be set between the Customer Gateway and the Transit Gateway giving the customer the access to all VPCs.

AWS Transit Gateways can peer with other Transit Gateways even from other accounts using Resource Access Manager.

All communication is governed through route tables.

Transit Gateways can be used to increase bandwidth of Site to Site connection using ECMP (Equal-cost multi-path routing).

Transit Gateway can help to share Direct Connect connections between multiple accounts

VPC Traffic Mirroring allows you to capture and inspect network traffic in your VPC. The traffic can be routed to security appliances that you manage. Traffic gets mirrored into a NLB.

AWS Private Link helps AWS resources within a VPC to have direct access to public services like S3, or other services as if the services were in the same VPC.

Edge locations are small sites hosted all over the world. Amazon has a total of 216 points of presence.

CloudFront is a Content Delivery Network (CDN). It speeds up delivery of static and dynamic content.

CloudFront can be used as a Ingress

Geo Restriction is restricting access based on countries.

Cached content remains set for a TTL (default 24 hours)

Expiry can be defined per file or object.

Cache invalidation can invalidate content in the edge location at a distribution level.

TLS is enabled by default. Custom certificates can be created by ACM.

CloudFront publishes metrics to CloudWatch and can enable extra metrics as well.

CloudFront works very well for static websites, video on demand and streaming services.

CloudFront Functions and Lambda@Edge enable us to run lightweight functions at edge locations.

CloudFront functions can run when:

Lambda@Edge can run when:

CF Functions use-cases:

Lambda@Edge use-cases:

The Global Accelerator service has access to all the edge location of AWS. Global accelerator facilitates connections to go through the AWS backbone.

Global Accelerator is used for routing users to edge locations, so they can immediately get on to the AWS network and optimize the time taken to reach the applications.

It provides two static anycast IP addresses that act as a fixed entry point to your application endpoints in single or multiple AWS Regions, such as your Application Load Balancers, Network Load Balancers, Elastic IP addresses or Amazon EC2 instances.

AWS Global Accelerator uses endpoint weights to determine the proportion of traffic that is directed to endpoints in an endpoint group, and traffic dials to control the percentage of traffic that is directed to an endpoint group (an AWS region where your application is deployed).

Amazon Route 53 is a highly available and scalable Domain Name System (DNS) web service. Route 53 connects user requests to internet applications running on AWS or on-premises.

It is a Global Service.

It is an Authoritative DNS, which means the customer can update the DNS records.

Route 53 can be used to purchase domain names.

Application Recovery Controller is a service that continuously monitors an application’s ability to recover from failures.

A Cell is collection of resources that operate independently.
Recovery group is a collection of cells to ensure high availability.
Resource Set has resources that can span multiple cells.

IPv4 can provide 4.3 billion unique IP addresses, this number will be exhausted very soon.
IPv6 can provide 3.4 x 10³⁸ unique IP addresses.
IPv6 addresses are by default public and internet routable.

Egress-only Internet Gateway is similar to NAT Gateway but used only for IPv6.
It allows instances in your VPC to have outbound connections to the internet, at the same time preventing internet to initiate connection to your instances.

As far as possible, it is advised to use private IPs for networking to reduce costs.
Communication across AZs is charged.

Protects your entire VPC From Layer 3 to Layer 7