Creating your Virtual Data Centre

Transcription

1 Creating your Virtual Data Centre VPC Fundamentals and Connectivity Options Paul Burne, Senior Technical Account Manager, Enterprise Support - 28 th June , Amazon Web Services, Inc. or its Affiliates. All rights reserved.

2 EC2 Instance

3

4 What to Expect from the Session Get familiar with VPC concepts Walk through a basic VPC setup Learn about the ways in which you can tailor your virtual network to meet your needs

5 Setting up an Internet Connected VPC

6 Creating an Internet-connected VPC Choosing an Setting up subnets Creating a route to Authorizing traffic address range in Availability Zones the Internet to/from the VPC

7 Choosing an IP Address Range

8 CIDR Notation Review CIDR range example: /

9 Choosing an IP Address Range for your VPC /16 Recommended: RFC1918 range Recommended: /16 (64K addresses)

10 Subnets

11 VPC Subnets and Availability Zones /16 eu-west-1a eu-west-1b eu-west-1c / / /24 VPC subnet VPC subnet VPC subnet Availability Zone Availability Zone Availability Zone

12 VPC Subnet Recommendations /16 VPC (64K addresses) /24 Subnets (251 addresses) One subnet per Availability Zone

13 Route to the Internet

14 Routing in your VPC Route tables contain rules for which packets go where Your VPC has a default route table but you can assign different route tables to different subnets

15 Routing Table Traffic destined for my VPC stays in my VPC

16 Internet Gateway Send packets here if you want them to reach the Internet

17 Routing Table Everything that isn t destined for the VPC: Send to the Internet

18 Network Security in VPC: Network ACLs and Security Groups

19 Network ACLs: Stateless firewalls Can be applied on a subnet basis English translation: Allow all traffic in

20 Security Groups Follow Application Structure MyWebServers Security Group Allow only MyWebServers MyBackends Security Group

21 Security Groups Example: MyWebServers In English: Hosts in this group are reachable from the Internet on port 80 (HTTP)

22 Security Groups Example: MyBackends In English: Only instances in the MyWebServers Security Group can reach instances in this Security Group

23 Security Groups in VPC: Additional Notes Follow the Principle of Least Privilege VPC allows creation of egress as well as ingress Security Group rules Many application architectures lend themselves to a 1:1 relationship between Security Groups (who can reach me) and IAM roles (what I can do).

24 Connectivity Options for VPCs

25 Beyond Internet Connectivity Restricting Internet access Connecting to other VPCs Connecting to your corporate network

26 Restricting Internet Access by Subnet

27 Routing by Subnet Has route to Internet VPC subnet Has no route to Internet VPC subnet

28 Outbound-only Internet Access: NAT Gateway Public IP: / /0 NAT Gateway VPC subnet VPC subnet

29 Inter-VPC Connectivity: VPC Peering

30 Example VPC Peering Use: Shared Services VPC Common/core services Authentication/directory Monitoring Logging Remote administration Scanning

31 Security Groups Across Peered VPCs / /16 VPC Peering ALLOW Orange Security Group Blue Security Group

32 Establish VPC Peering: Initiate Request / /16 Step 1

33 Establish VPC Peering: Accept Request / /16 Step 1 Step 2

34 Establish VPC Peering: Create Route / /16 Step 1 Initiate peering request In English: Traffic destined for the peered VPC should go to the peering Step 2 Accept peering request Step 3

35 Connecting to On-premises Networks: Virtual Private Network & Direct Connect

36 Extend an On-Premises Network Into Your VPC VPN Direct Connect

37 AWS VPN basics / /16 Customer Gateway Virtual Gateway /16 Two IPSec tunnels Your networking device

38 VPN and Amazon Direct Connect Both allow secure connections between your network and your VPC VPN is a pair of IPSec tunnels over the Internet DirectConnect is a dedicated line with lower per-gb data transfer rates For highest availability: Use both

39 VPC and the Rest of AWS

40 VPC and the Rest of AWS AWS Services in Your VPC VPC Endpoints for Amazon DNS in-vpc with Amazon Logging VPC Traffic with VPC S3 Route53 Flow Logs

41 AWS Services in Your VPC

42 Best practices for in-vpc AWS services Many AWS Services support running in-vpc. Use Security Groups for Least-Privilege network access. For best availability, use multiple Availability Zones. Multi-zone RDS deployments Use a zonal mount point for EFS access

43 Example: Amazon RDS database in Your VPC Reachable via DNS Name: mydb-cluster-1.us-west-2.rds.amazonaws.com

44 Example: AWS Lambda Function in Your VPC

45 VPC Endpoints

46 S3 and Your VPC Your applications Your data S3 Bucket

47 AWS VPC Endpoints for S3 S3 Bucket

48 AWS VPC Endpoints for S3 Route S3-bound traffic to the VPCE S3 Bucket

49 IAM Policy for VPC Endpoints IAM Policy at VPC Endpoint: Restrict actions of VPC in S3 S3 Bucket IAM Policy at S3 Bucket: Make accessible from VPC Endpoint only

50 DNS in a VPC

51 VPC DNS options Use Amazon DNS server Have EC2 auto-assign DNS hostnames to instances

52 Route53 Private Hosted Zones Example.demohostedzone.org à Private Hosted Zone

53 VPC Flow Logs: VPC traffic Metadata in Amazon CloudWatch Logs

54 VPC Flow Logs Visibility into effects of Security Group rules Troubleshooting network connectivity Ability to analyze traffic

55 VPC Flow Logs: setup VPC traffic metadata captured in CloudWatch Logs

56 VPC Flow Logs data in CloudWatch Logs Who s this? # dig +short -x internetpolice.co. UDP Port 53 = DNS REJECT

57 VPC: Your Private Network in AWS

58 The VPC network

59 VPC Connectivity

60 VPC Network Security

61 Want to Dive Deeper? Visit the AWS YouTube Channel NET303 - Next-Gen Networking: New Capabilities for Amazon s Virtual Private Cloud NET304 - Moving Mountains: Netflix s Migration Into VPC NET401 - Another Day, Another Billion Packets NET402 - Deep Dive: AWS Direct Connect and VPN NET404 - Making Every Packet Count

62 Thank you!