> For the complete documentation index, see [llms.txt](https://awsfdn.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://awsfdn.adot8.com/module-5.md).

# Module 5

### Amazon VPC<img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FDPLVsvQcniAoGIwjg3Qy%2Fimage.png?alt=media&amp;token=05292dd6-671d-4b0b-b4ae-b92e3120e29e" alt="" data-size="line">

* Enables you to provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define
* •Gives you control over your virtual networking resources
  * &#x20;IP address range
  * Creation of subnets
  * Configuration of route tables and network gateways
* You can customize the network configuration for your VPC
* You can use multiple layers of security

### VPC and Subnets

* VPC's are isolated (logically) from other VPCs and are only for your own AWS Account
* They belong to a single Region but can be across multiple Availability Zones
* The subnets belong to a single Availability Zone and are classified as **public** or **private**

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FszaZZcOWqMwEs0KvVkSB%2Fimage.png?alt=media&amp;token=98dbbb21-3728-4166-a759-1cde3981adb5" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
There aint no CTRL+Z for the address range after creating a VPC **AND** CIDR blocks of subnets **cannot** overlap
{% endhint %}

* /16 (65,536 addresses) is the maximum size of a VPC
* /28 (16 addresses) is the minimum size of a VPC
* IPv6 is also supported

### Example

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FxGRhIgigKZWSsrzxoDl4%2Fimage.png?alt=media&amp;token=be2ba58c-e4ab-4036-9540-4190d3f36d73" alt=""><figcaption></figcaption></figure>

* For each CIDR block that you make, AWS will reserve 5 IP's in that block which won't be available for use
* These addresses are reserverd for:
  * Network address
  * VPC local router (internal communications)
  * Domain Name System (DNS) resolution
  * Future use
  * Network broadcast address

### Public IP address types

<table><thead><tr><th>Public IPv4 address 👘</th><th>Elastic IP address🧽</th><th data-hidden></th></tr></thead><tbody><tr><td>Manually assigned through an Elastic IP address</td><td>Associated with your AWS account</td><td></td></tr><tr><td>Automatically assigned through the auto-assign public IP address settings at the subnet level</td><td>Can be allocated and remapped anytime</td><td></td></tr><tr><td>Uses NAT</td><td>Additional costs may apply</td><td></td></tr></tbody></table>

#### Elastic network Interface

* A virtual network interface that you can attach/detach in an instance and attach to another instance to redirect network traffic
* Its attributes follow when it's reattached to a new instance

{% hint style="info" %}
You cannot detach a primary network interface from an instance.
{% endhint %}

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2Fkpax9u2eqmsetDWGxbQp%2Fimage.png?alt=media&amp;token=5f4bcd5f-705b-464a-a901-028ed05d19a4" alt=""><figcaption></figcaption></figure>

### Route tables and routes

* You can configure route tables to direct network traffic from your subnet
* Each route specifies a destination and a target
* By default, every route table contains a local route for communication within the VPC
* A subnet can be associated with only one route table at a time, but you can associate multiple subnets with the same route table

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2F7STWG0xLiV5nOePsUCD8%2Fimage.png?alt=media&amp;token=a19b05e5-1c67-4846-a30f-bb1d0cc8b30d" alt=""><figcaption></figcaption></figure>

### Some Takeaways

* A VPC is a logically isolated section of the AWS Cloud
* A VPC belongs to one Region and requires a CIDR block.
* A VPC is subdivided into subnets.•A subnet belongs to one Availability Zone and requires a CIDR block.
* Route tables control traffic for a subnet.•Route tables have a built-in local route.
* You add additional routes to the table
* The local route cannot be deleted1

### Internal Gateway

An internet gateway allows communication between instances in your VPC and the internet and serves two purposes:

1. &#x20;Provide a target in your VPC route tables for internet-routable traffic
2. Perform NAT for instances that were assigned public IPv4 addresses

{% hint style="info" %}
To make a subnet public, you attach an internet gateway to your VPC and add a route to the route table to send non-local traffic through the internet gateway to the internet (0.0.0.0/0)
{% endhint %}

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FMm8yctdQnwWysqKa2cz4%2Fimage.png?alt=media&amp;token=caaf27b9-ba79-4712-9e77-4f29c2e47cca" alt=""><figcaption></figcaption></figure>

### NAT Gateway

Functions the same way a router performing NAT would. Allows for private to public translation but blocks connections initiated from the internet

Creation steps:

1. Specify the public subnet in which the NAT gateway should reside
2. Specify an Elastic IP address to associate with the NAT gateway
3. Update the route table that is associated with one or more of your private subnets to point internet-bound traffic to the NAT gateway

You can also use a NAT instance in a public subnet in your VPC instead of a NAT gateway but, a NAT gateway is a managed NAT service that provides better availability, higher bandwidth, and less administrative effort.

{% hint style="success" %}
AWS recommends that you use a NAT gateway instead of a NAT instance.
{% endhint %}

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FIpNoPAZBs0Se1RdMZ0TX%2Fimage.png?alt=media&amp;token=aaf2939d-cb64-4f08-9d7c-3f5be45df89f" alt=""><figcaption></figcaption></figure>

### VPC Sharing

VPC sharing enables customers to share subnets with other AWS accounts in the same organization in AWS Organizations.

VPC sharing allows multiple AWS accounts to create their application services (Amazon EC2 instances, Amazon RDS databases, Amazon Redshift clusters, and AWS Lambda functions) into shared centrally managed VPCs

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FDAOnzdn7lJV9BrAuoFfU%2Fimage.png?alt=media&amp;token=16118767-6935-423c-931b-92381a440989" alt=""><figcaption></figcaption></figure>

### VPC Peering

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FHrOfpt5N16n5Y75jSu6Y%2Fimage.png?alt=media&amp;token=16075ead-999e-44b6-a126-3e07e2a46ce8" alt=""><figcaption></figcaption></figure>

Transitive peering is not supported. For example, suppose that you have three VPCs: A, B, and C. VPC A is connected to VPC B, and VPC A is connected to VPC C. However, VPC B is not connected to VPC C implicitly. To connect VPC B to VPC C, you must explicitly establish that connectivity

### AWS Site-to-Site VPN

Steps to connect your VPC to a remote network:

1. Create a new virtual gateway device (VPN Gateway) and attach it to your VPC
2. Define the configuration of the VPN device or the customer gateway. The customer gateway is not a device but an AWS resource that provides information to AWS about your VPN device
3. Create a custom route table to point corporate data center-bound traffic to the VPN gateway. You also must update security group rules
4. Establish an AWS Site-to-Site VPN connection to link the two systems together.
5. Configure routing to pass traffic through the connection.

{% hint style="info" %}
Dynamic routing protocols can be used
{% endhint %}

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FFzSe8ecTxrk4x5uw6lCX%2Fimage.png?alt=media&amp;token=5bd25cb7-ed63-47ad-92c7-19636bfb2903" alt=""><figcaption></figcaption></figure>

### AWS Direct Connect

Literally just a physical cable going from an AWS data center backbone to your remote network

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FVAMY3bAcyQRAHFHvnsex%2Fimage.png?alt=media&amp;token=97d9996c-65c7-4b48-9983-f1e545834293" alt=""><figcaption></figcaption></figure>

### VPC Endpoints

A VPC endpoint is a virtual device that enables you to privately connect your VPC to supported AWS services and VPC endpoint services that are powered by AWS PrivateLink. Allows you to not have to pay extra if the services being accessed are ran by AWS

The connection to these services does not require an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection

{% hint style="info" %}
Instances in your VPC don't require public IP addresses to communicate with resources in the service. Traffic between your VPC and the other service does not leave the Amazon network
{% endhint %}

Two types of endpoints:

* **Interface endpoints** (powered by AWS PrivateLink)
* **Gateway endpoints** (Amazon S3 and Amazon DynamoDB)

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2F3UwJRQnQ5BApi8wy1mJw%2Fimage.png?alt=media&amp;token=54e35e12-9469-4354-bfb9-e102ebf3acf7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2F7QVEpRCBUXqKpFnKdli0%2Fimage.png?alt=media&amp;token=c6689fba-c5e7-4bf3-9ab2-7a45fa444833" alt=""><figcaption></figcaption></figure>

### AWS Transit Gateway

Gives a central place to manage and configure VPCs

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FvS40flGEzTgqJdXWhjKp%2Fimage.png?alt=media&amp;token=35d4453d-f2a4-47e7-b000-3357de43a34e" alt=""><figcaption></figcaption></figure>

### Examples

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FrrFetStI2JHErLqWCs3a%2Fimage.png?alt=media&amp;token=1c224676-4966-4296-82dd-4e58ef9fbde4" alt=""><figcaption></figcaption></figure>

### Security Groups

{% hint style="info" %}
The default is **block** and the only rules that you can create are to allow things
{% endhint %}

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FznvtwdGNRZKuxcaFfnBO%2Fimage.png?alt=media&amp;token=a5173bc2-b456-4db0-9670-be824e05e39c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2F9p6TXmJewxrsc2UCkePP%2Fimage.png?alt=media&amp;token=f9fc39a2-f51d-41c4-9604-7b04ab7fdc28" alt=""><figcaption></figcaption></figure>

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2F6wQHzaJuCevxPkCsQhxe%2Fimage.png?alt=media&amp;token=82c24e35-d1c8-447c-ae4a-4819c98f2d2e" alt=""><figcaption></figcaption></figure>

### Network ACLs

* A network ACL has separate inbound and outbound rules, and each rule can either allow or deny traffic.
* Default network ACLs allow all inbound and outbound IPv4 traffic.
* Network ACLs are stateless

Network ACLs are stateless, which means that no information about a request is maintained after a request is processed.&#x20;

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FKsWLQLQ1y5zPK4O4R3qs%2Fimage.png?alt=media&amp;token=338d22c0-c67e-45bd-b2fc-09f712109c86" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
The lower the rule number more priority it gets
{% endhint %}

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2F5XPxURY9EtEA4p77EjvQ%2Fimage.png?alt=media&amp;token=22822961-c9b8-4868-9b7e-bb2d933c81f8" alt=""><figcaption></figcaption></figure>

### Differences between Security Groups and Network ACLS

| Attribute       | Security Groups                                                         | Network ACLs                                                         |
| --------------- | ----------------------------------------------------------------------- | -------------------------------------------------------------------- |
| Scope           | Instance level                                                          | Subnet level                                                         |
| Supported Rules | Allow rules only                                                        | Allow and deny rules                                                 |
| State           | Stateful (return traffic is automatically allowed, regardless of rules) | Stateless (return traffic must be explicitly allowed by rules)       |
| Order of Rules  | All rules are evaluated before decision to allow traffic                | Rules are evaluated in number order before decision to allow traffic |

### Amazon Route 53

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FzfTQNLcypRl8oRHPKxvS%2Fimage.png?alt=media&amp;token=64c3d7d9-b3ed-43d2-aafc-d5504b5409ba" alt=""><figcaption></figcaption></figure>

* Is a highly available and scalable Domain Name System (DNS) web service
* Is used to route end users to internet applications by translating names ([www.example.com](http://www.example.com)) into numeric IP addresses (like 192.0.2.1) that computers use to connect
* IWorks withPv4 and IPv6
* Connects user requests to infrastructure running in AWS and also outside of AWS
* Can be used to check the health of your resources
* Lets you register domain names

### Route 53 DNS resolution

Process Route 53 follows when a user initiates a DNS request

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FyMSHyBMQ1lw6x3bDZGWF%2Fimage.png?alt=media&amp;token=27bdc54e-f76a-4e79-b948-d9d24d537350" alt=""><figcaption></figcaption></figure>

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FaawpKQiub6Krq3UcE9xy%2Fimage.png?alt=media&amp;token=da6f86d0-9474-42d9-9339-34699b8c53c3" alt=""><figcaption></figcaption></figure>

### Multi-region deployment

With Route 53, the user is automatically directed to the Elastic Load Balancing load balancer that’s closest to the user. This allows for latency-based routing to the Region and ;load balancing routing to the Availability Zone

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FCLwyl3nBenlCMH9szhwJ%2Fimage.png?alt=media&amp;token=3f204949-e49c-4c94-888a-bb99117a1fb7" alt=""><figcaption></figcaption></figure>

### Route 53 DNS Failover

Route 53 can provide high availability by allowing you to:&#x20;

* Configure backup and failover scenarios for your own applications
* Enable highly available multi-region architectures on AWS
* Create health checks

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FNpSfzpLpyM0orpOD6q1E%2Fimage.png?alt=media&amp;token=e0418386-9f9d-4437-a7d7-194aeb4a8bd7" alt=""><figcaption></figcaption></figure>

### Amazon CloudFront

* Fast, global, and secure CDN service
* Global network of edge locations and Regional edge caches
* Self-service model&#x20;
* Pay-as-you-go pricing

<figure><img src="https://739099499-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlOjiOVl4TnmLMyvNNyQJ%2Fuploads%2FKDdROnA01hlp1BjmV8nm%2Fimage.png?alt=media&amp;token=cc1e52db-9e38-4dd5-997e-6b384babf8ea" alt=""><figcaption></figcaption></figure>