© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

Becky Weiss, Senior Principal Engineer, EC2

Creating Your Virtual Data Center

VPC Fundamentals and Connectivity Options

NET201

November 30, 2016

EC2 Instance

172.31.0.128

172.31.0.129

172.31.1.24

172.31.1.27

54.4.5.6

54.2.3.4

VPC

What to Expect from the Session

• Get familiar with VPC concepts

• Walk through a basic VPC setup

• Learn about the ways in which you

can tailor your virtual network to meet

your needs

Walkthrough: setting up an

Internet-connected VPC

Creating an Internet-connected VPC: steps

Choosing an

address range

Setting up subnets

in Availability Zones

Creating a route to

the Internet

Authorizing traffic

to/from the VPC

Choosing an IP address range

CIDR notation review

CIDR range example:

172.31.0.0/16

1010 1100 0001 1111 0000 0000 0000 0000

Choosing an IP address range for your VPC

172.31.0.0/16

Recommended:

RFC1918 range

Recommended:

/16

(64K addresses)

Subnets

VPC subnets and Availability Zones

172.31.0.0/16

Availability Zone Availability Zone Availability Zone

VPC subnet VPC subnet VPC subnet

172.31.0.0/24 172.31.1.0/24 172.31.2.0/24

eu-west-1a eu-west-1b eu-west-1c

VPC subnet recommendations

• /16 VPC (64K addresses)

• /24 subnets (251 addresses)

• One subnet per Availability Zone

Route to the Internet

Routing in your VPC

• Route tables contain rules for which

packets go where

• Your VPC has a default route table

• … but you can assign different route

tables to different subnets

Traffic destined for my VPC

stays in my VPC

Internet Gateway

Send packets here if you want

them to reach the Internet

Everything that isn’t destined for the VPC:

Send to the Internet

Network security in VPC:

Network ACLs / Security Groups

Network ACLs: Stateless firewalls

English translation: Allow all traffic in

Can be applied on a subnet basis

“MyWebServers” Security Group

“MyBackends” Security Group

Allow only “MyWebServers”

Security groups follow application structure

Security groups example: web servers

In English: Hosts in this group are reachable

from the Internet on port 80 (HTTP)

Security groups example: backends

In English: Only instances in the MyWebServers

Security Group can reach instances in this

Security Group

Security groups in VPC: additional notes

• Follow the Principle of Least Privilege

• VPC allows creation of egress as well as ingress

Security Group rules

• Many application architectures lend themselves to a 1:1

relationship between security groups (who can reach

me) and IAM roles (what I can do).

Connectivity options for VPCs

Beyond Internet connectivity

Restricting Internet accessConnecting to your

corporate network

Connecting to other

VPCs

Restricting Internet access:

Routing by subnet

Routing by subnet

VPC subnet

VPC subnet

Has route to Internet

Has no route to Internet

Outbound-only Internet access: NAT gateway

VPC subnet VPC subnet

0.0

.0.0

/0

0.0.0.0/0

Public IP: 54.161.0.39

NAT gateway

Inter-VPC connectivity:

VPC peering

Example VPC peering use:

shared services VPC

Common/core services

• Authentication/directory

• Monitoring

• Logging

• Remote administration

• Scanning

Security groups across peered VPCs

VPC Peering

172.31.0.0/16 10.55.0.0/16

Orange Security Group Blue Security Group

ALLOW

Establish a VPC peering: initiate request

172.31.0.0/16 10.55.0.0/16

Step 1

Initiate peering request

Establish a VPC peering: accept request

172.31.0.0/16 10.55.0.0/16

Step 1

Initiate peering request

Step 2

Accept peering request

Establish a VPC peering: create route

172.31.0.0/16 10.55.0.0/16Step 1

Initiate peering request

Step 2

Accept peering request

Step 3

Create routes

In English: Traffic destined for the

peered VPC should go to the peering

Connecting to on-premises networks:

Virtual Private Network & Direct Connect

Extend an on-premises network into your VPC

VPN

Direct Connect

AWS VPN basics

Customer

Gateway

Virtual

Gateway

Two IPSec tunnels

192.168.0.0/16 172.31.0.0/16

192.168/16

Your networking device

VPN and AWS Direct Connect

• Both allow secure connections

between your network and your VPC

• VPN is a pair of IPSec tunnels over

the Internet

• DirectConnect is a dedicated line with

lower per-GB data transfer rates

• For highest availability: Use both

VPC and the rest of AWS

VPC and the rest of AWS

AWS Services in

Your VPC

VPC Endpoints for

Amazon S3

DNS in-VPC with

Amazon Route 53

Logging VPC Traffic

with VPC Flow Logs

AWS services in your VPC

Example: Amazon RDS database in your VPC

Reachable via DNS Name: mydb-cluster-1

….us-west-2.rds.amazonaws.com

Example: AWS Lambda function in your VPC

Best practices for in-VPC AWS services

• Many AWS services support running in-VPC.

• Use security groups for Least-Privilege network access.

• For best availability, use multiple Availability Zones.

Examples:

• Multi-zone RDS deployments

• Use a zonal mount point for EFS access

VPC Endpoints for Amazon S3

S3 and your VPC

S3 Bucket

Your applications

Your data

AWS VPC endpoints for S3

S3 Bucket

AWS VPC endpoints for S3

S3 Bucket

Route S3-bound

traffic to the VPCE

IAM policy for VPC endpoints

S3 Bucket

IAM Policy at VPC Endpoint:

Restrict actions of VPC in S3

IAM Policy at S3 Bucket:

Make accessible from

VPC Endpoint only

DNS in a VPC

VPC DNS options

Use Amazon DNS server

Have EC2 auto-assign DNS

hostnames to instances

Amazon Route 53 private hosted zones

Private Hosted

Zoneexample.demohostedzone.org

172.31.0.99

VPC Flow Logs:

VPC traffic metadata in Amazon

CloudWatch Logs

VPC Flow Logs

Visibility into effects of security

group rules

Troubleshooting network

connectivity

Ability to analyze traffic

VPC Flow Logs: setup

VPC traffic metadata captured in

CloudWatch Logs

VPC Flow Logs data in CloudWatch Logs

Who’s this?# dig +short -x 109.236.86.32 internetpolice.co.

REJECT

UDP Port 53 = DNS

VPC: your private network in AWS

The VPC network

VPC network security

VPC connectivity

Thank you!

Remember to complete

your evaluations!

Related sessions

• NET303 - Next-Gen Networking: New Capabilities for

Amazon’s Virtual Private Cloud

• NET304 - Moving Mountains: Netflix’s Migration Into

VPC

• NET401 - Another Day, Another Billion Packets

• NET402 - Deep Dive: AWS Direct Connect and VPN

• NET404 - Making Every Packet Count