AWS Networking (Part 2) — AWS Solutions Architect Associate Complete Course
Chapter 21: Networking in AWS Part 2
Last week, I published the first part of the chapter on Networking in Amazon Web Services. As this is quite an important topic, which the AWS Solutions Architect Associate Exam will ask quite a lot, I have divided it into two parts. We will see more services in this last part than in the previous chapter, but they are less complex than the others. Let’s get on with it!
- VPC peering
- VPC endpoints
- Flow logs
- AWS Managed VPN
- Direct Connect & Direct Connect Gateway
- AWS Private Link
- VPN Cloudhub
- Transit Gateway
- Other network services
Remember that all the chapters from the course can be found in the following link:
VPC PEERING
VPC peering allows you to connect two private VPCs using IP addresses, acting like a VPC. Instances in either VPC can communicate as if they are within the same network. It even works with VPCs from different regions.
The only requirement is that the CIDR of the subnets cannot overlap. You also need to update the route table of each VPC. This will allow the instances to communicate with each other.
VPC peering is not transitive. What does it mean? If we had two VPCs connected to VPC A, for example, VPC B and VPC C, as shown in the following diagram, they could not establish a connection between them. You would need another VPC peering connection between them to allow it.
VPC ENDPOINTS
What if we want to establish a connection between an AWS service (for example, Amazon S3) and the instances from your private network? As we saw in the last chapter, you can do it, but the connection would be using the internet. What if we don’t want this traffic to be public? That’s why we use VPC endpoints. A VPC endpoint enables connections between a VPC and supported services without exposing it to the public internet.
There are two types of VPC endpoints:
- Interface endpoints → It provides an Elastic Network Interface as the entry point.
- Gateway endpoints → It provides a Gateway Load Balancer endpoint as a target to put in the routing table. We only use these endpoints with Amazon S3 and DynamoDB!
FLOW LOGS
VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. We can use Amazon CloudWatch Logs or Amazon S3 Athena to analyze them.
The most typical params that we can capture are:
- “srcaddr” → The source IP address for incoming traffic.
- “srcport” → The source port of the traffic.
- “action” → The action associated with the traffic (ACCEPT or REJECT, depending on the Security Groups and the NACLs).
AWS MANAGED VPN
You can create an IPsec VPN connection between your remote networks and Amazon VPC over the internet. A VPN creates a private network connection between devices through the internet. VPNs are used to safely and anonymously transmit data over public networks, and can be configured to encrypt data over the shared connection.
To create this connection, we would need the following services:
- Site-to-Site VPN Connection → A secure connection between your on-premises equipment and your VPCs.
- Virtual Private Gateway → Gateway for the Amazon side of the Site-to-Site VPN connection. It’s used on the VPC to allow this Site-to-site connection.
- Customer Gateway → Physical or software appliance that you own or manage in your on-premises network to allow this Site-to-site connection.
DIRECT CONNECT
AWS Direct Connect is a cloud service that links your on-premise network directly to your AWS VPC in a private way, bypassing the internet to deliver more consistent, lower-latency performance. It’s important to know that this connection is not encrypted, but it’s private.
As we can see in the following diagram, we connect the client’s on-premise data network to the AWS Direct Connect Location using a Direct Connect endpoint that we will use to establish a connection with AWS.
There is just one problem, what if we want to connect our on-premise network to many different AWS VPCs? In that case, we can use Direct Connect Gateway. You can also connect to different VPCs in different regions.
- Connect to one region with different VPCs → You connect the Direct Connect Gateway to a Transit Gateway (we will study this service below).
- Connect to different regions → You connect the Direct Connect Gateway to Virtual Private Gateways, as shown in the following diagram.
AWS PRIVATELINK
AWS PrivateLink allows you to expose a service to the VPCs/on-premise networks that you want in a private way. It uses Network Load Balancers to expose services, and the client would only need an ENI endpoint to connect to these provided services.
If the exam asks you to privately connect a service to hundreds of VPCs, or even use Network Load Balancers to do it, this will be the chosen one.
AWS VPN CLOUDHUB
It allows us to establish secure communications between multiple on-premise networks. This is its main functionality, establishing secure connections between your on-premises networks, but you can also include your AWS VPCs. The following diagram shows that we can connect the Customer Network Office of New York with Los Angeles using AWS CloudHub.
AWS TRANSIT GATEWAY
It connects VPCs and on-premises networks through a central hub, acting as a cloud router. Imagine you want to connect with ten different VPCs from your on-premise network. You can create an AWS Transit Gateway with these ten VPCs and establish a connection once, as it’s a transitive service. You can gather VPCs that are even in different regions.
OTHER NETWORK SERVICES
- Bastion Hosts → Server aims to provide access to a private network from the internet. You can access your instances in a private network using SSH.
- Egress-only Internet Gateway → Allows outbound communication over IPv6 from instances in your VPC to the Internet.
Thanks for Reading!
If you like my work and want to support me…
- You can follow me on Medium here.
- Feel free to clap if this post is helpful for you! :)
- More AWS practice exam questions? Find them at FullCertified.com!
