1. VPC and subnets #
Your private network in AWS.
Principle #
A VPC is an isolated network within a region, defined by an address range (CIDR, for example 10.0.0.0/16). It is split into subnets, each in a single availability zone. A subnet is public if its route table sends 0.0.0.0/0 to an Internet Gateway, private otherwise.
The building blocks #
| Element | Role |
|---|---|
| Internet Gateway | Inbound and outbound Internet access for public subnets |
| NAT Gateway | Outbound access for private subnets (one per AZ for high availability) |
| Route table | Where to send traffic based on the destination |
| VPC Endpoint | Private access to S3, DynamoDB or other services without going through the Internet |
| Peering / Transit Gateway | Connecting VPCs (Transit Gateway for dozens of VPCs and the corporate network) |
2. Filtering #
Security groups and NACLs.
Comparison #
| Security group | NACL | |
|---|---|---|
| Applies to | A network interface (instance, database, load balancer) | A subnet |
| State | Stateful: the response is allowed automatically | Stateless: allow both directions |
| Rules | Allows only | Allows and denies, evaluated by number |
| Common use | Main filtering, references between groups | Guardrail, blocking an address range |
Example #
aws ec2 create-security-group --group-name app --description "Instances applicatives" --vpc-id vpc-0abc
# n'autoriser que le trafic venant du groupe de l'équilibreur
aws ec2 authorize-security-group-ingress --group-id sg-app --protocol tcp --port 8080 --source-group sg-albGood practice: Reference security groups rather than IP addresses: the rule automatically follows instances as they come and go.
3. Exposing and distributing #
DNS, load balancing and caching.
Services #
- Elastic Load Balancing: ALB (HTTP, routing by path and host), NLB (TCP/UDP, very low latency).
- Route 53: managed DNS, latency-based routing, geolocation, failover on health checks.
- CloudFront: global CDN in front of S3 or a load balancer, with TLS and AWS WAF protection.
- Site-to-site VPN or Direct Connect to connect the company's data center.
Checking #
aws ec2 describe-route-tables --filters Name=vpc-id,Values=vpc-0abc --output table
aws ec2 describe-security-groups --group-ids sg-app
aws ec2 create-flow-logs --resource-type VPC --resource-ids vpc-0abc --traffic-type REJECT \
--log-destination-type cloud-watch-logs --log-group-name vpc-rejets --deliver-logs-permission-arn <role>