6-VPCs Flashcards
What are the basic components of VPCs?
- The CIDR address range
- Subnets
- Route tables
- Network gateways
- NACLs
How does the CIDR address range work?
It covers the private IP addresses of resources in the VPC
The smaller the number after the slash, the bigger the range
How do subnets work?
They exist in a single AZ. It is common to have public and private subnets
How do route tables work?
Thye control traffic between subnets and to the gateways
How do network gateways work?
There are two types - there can be up to one IGW (internet gateway) which connects straight to the internet
Virtual Private Gateways create hardware VPN connections
What is the default VPC like?
All subnets have a route to the internet and each instance has a public and private IP address
How do NACLs work?
They act as firewalls for subnets
How does VPC peering work?
Allows resources to use private IPs for resources in another VPC
Peering can be across accounts but not across regions
Transitive peering and peering with overlapping CIDR blocks is not supported
How can EC2 instances in a private subnet access the internt?
with NAT in which traffic is routed through a resource in a public subnet, whose public IP is used
There are two options - NAT instances are NAT gateways
What are NAT instances?
Generic EC2 instances that are placed in a public subnet.
The disable “source/destination check” option must be enabled
For high-availability, redundancy and fail-over needs to be configured
What are NAT Gateways?
A managed service that are highly-available and automatically scale up to 10 GB/s
They do not use security groups
How do VPC endpoints work?
The allow instances in private subnets to access AWS services i.e. S3
They must be configured in route tables
How is security in VPCs managed?
With NACLs and flow logs
How do NACLs work?
They define rules for inbound and outbound traffic separately - they are stateless
They consist of numbered rules that are evaluated in order, starting with the smallest number
NACLs can be shared across subnets but each subnet can only have one NACL
How do Flow Logs work?
They record IP traffic at the VPC, subnet or network interface level
You can’t reconfigure them once created or enable flow-logs for VPC peering connections that span accounts
