Thread by @tpschmidt_

📚 AWS 1x1 - 𝗩𝗣𝗖 & 𝗡𝗲𝘁𝘄𝗼𝗿𝗸𝗶𝗻𝗴

Your logically isolated virtual network in the cloud.

From Security Groups, over Route Tables to VPC Peering ↓

𝗧𝗵𝗿𝗲𝗮𝗱 𝗢𝘃𝗲𝗿𝘃𝗶𝗲𝘄 🧵

• VPCs & Subnets
• Route Tables
• Internet Gateway
• NAT Gateways & Instances
• Security Groups
• Network Access Control Lists
• VPC Peering

{ 1/14 }

Maybe you didn't know, but Amazon 𝗩irtual 𝗣rivate 𝗡etwork is the networking layer for EC2.

This virtual network imitates your local data center, but with all the benefits of the cloud's scalable infrastructure.

Knowing about VPC & networking is crucial.

{ 2/14 }

𝗩𝗣𝗖𝘀 & 𝗦𝘂𝗯𝗻𝗲𝘁𝘀

A VPC is a logically isolated network where you can launch resources like Lambda functions or EC2 instances into.

You can also:
• specify IP ranges
• add subnets
• associate security groups
• configure route tables

{ 3/14 }

For subnets, we separate 𝗽𝘂𝗯𝗹𝗶𝗰 & 𝗽𝗿𝗶𝘃𝗮𝘁𝗲 subnets. Public subnets are for resources that need access to the internet - private subnets are for resources that only need internal access.

💡 Some resources can only live in private subnets (e.g. ElastiCache)

{ 4/14 }

Resources in each subnet can be protected with 𝗺𝘂𝗹𝘁𝗶𝗽𝗹𝗲 𝗹𝗮𝘆𝗲𝗿𝘀 𝗼𝗳 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆.

For example:
• 𝗦ecurity 𝗚roups (SGs)
• Network 𝗔ccess 𝗖ontrol 𝗟ists (ACLs)

💡 Your AWS account (created after the end of 2013) comes with a 𝗱𝗲𝗳𝗮𝘂𝗹𝘁 VPC!

{ 5/14 }

𝗥𝗼𝘂𝘁𝗲 𝗧𝗮𝗯𝗹𝗲𝘀

Traffic inside your VPC needs direction. That's what Route Tables are for.

Those are sets of rules which you can associate with a subnet. Each Route Table needs a 𝗱𝗲𝘀𝘁𝗶𝗻𝗮𝘁𝗶𝗼𝗻 and 𝘁𝗮𝗿𝗴𝗲𝘁 which defines how traffic is routed.

{ 6/14 }

The 𝗱𝗲𝘀𝘁𝗶𝗻𝗮𝘁𝗶𝗼𝗻 is a set of IP addresses to where you want to direct your traffic, defined as a Classless Inter-Domain Routing (CIDR) block.

The 𝘁𝗮𝗿𝗴𝗲𝘁 is either a gateway, network interface, or connection that your subnet should send the traffic to.

{ 7/14 }

If you didn't assign your own route table to a subnet, is implicitly assigned to the 𝗺𝗮𝗶𝗻 𝗿𝗼𝘂𝘁𝗲 𝘁𝗮𝗯𝗹𝗲.

There are a lot more key concepts to know for route tables that are well-documented at AWS.

docs.aws.amazon.com/vpc/latest/use…

{ 8/14 }

Some more facts about the default VPC:

• it comes with an internet gateway
• the default subnet is 𝗽𝘂𝗯𝗹𝗶𝗰 - resources there use the internet gateway for accessing the internet
• your default subnets resources have a private & public IPv4 address

{ 9/14 }

An internet gateway is not the only way of enabling access to the world

You can also use a 𝗡etwork 𝗔ddress 𝗧ranslations (𝗡𝗔𝗧) device. It maps multiple of your private IPv4 addresses to a single public IPv4.

💡 It also prevents unsolicited inbound connections.

{ 10/14 }

There are two different types of NAT devices at AWS:

• NAT 𝗚𝗮𝘁𝗲𝘄𝗮𝘆* - an AWS managed gateway
• NAT 𝗜𝗻𝘀𝘁𝗮𝗻𝗰𝗲 - your own NAT device, running on an EC2 instance

* You're paying for each running 𝗵𝗼𝘂𝗿 & 𝗲𝗮𝗰𝗵 𝗚𝗕 𝗼𝗳 𝗱𝗮𝘁𝗮 that is processed!

{ 11/14 }

𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗚𝗿𝗼𝘂𝗽𝘀 (SGs)

SGs define 𝗮𝗹𝗹𝗼𝘄 rules for your traffic - inbound or outbound. It enables traffic filtering based on protocols & port numbers.

💡 Security Groups operate on instance level & are stateful. A must-know fact for exams.

{ 12/14 }

𝗡𝗲𝘁𝘄𝗼𝗿𝗸 𝗔𝗰𝗰𝗲𝘀𝘀 𝗖𝗼𝗻𝘁𝗿𝗼𝗹 𝗟𝗶𝘀𝘁𝘀 (ACLs)

ACLs define 𝗮𝗹𝗹𝗼𝘄 and/or 𝗱𝗲𝗻𝘆 rules. Evaluation starts with the lowest rule number - the first match is used.

💡 ACLs are stateless => return traffic must be 𝗲𝘅𝗽𝗹𝗶𝗰𝗶𝘁𝗹𝘆 allowed by rules.

{ 13/14 }

𝗩𝗣𝗖 𝗣𝗲𝗲𝗿𝗶𝗻𝗴

Peering connections allow you to route traffic between two VPCs as if they were in the same VPC. It also allows you to not only connect to VPCs in other regions but also in other AWS accounts.

💡 CIDR blocks for your VPCs can't overlap!

{ 14/14 }

VPC & networking are huge topics and this was just an introduction to some important parts 👋
Learn more by exploring the docs and more important by getting hands-on practice! 👨‍💻

Retweet & like the initial post if you enjoyed reading this & follow me for more cloud content 🌤