Advanced VPC Networking

Question 1

VPC Flow Logs

Answer 1

Flow logs capture metadata(Not Content) from the capture point down

attached to a VPC-all ENIs in that VPC

subnet- All ENIs in that subnet

Flow logs can capture accepted, rejected or all metadata

not real time

Question 2

Valid destinations for VPC Flow Logs

Answer 2

S3 or CloudWatch Logs

Question 3

why would you uses Athena with s3?

Answer 3

querying flow logs stored in S3 with a SQL like querying method

Question 4

Egress-Only Internet Gateway

Answer 4

Egress-Only is outbound-only for IPv6

Allows public IPv6 address outbound only access to the public internet

without allow external initiate connections(IN)

Question 5

VPC Endpoints : Gateway Endpoints

Answer 5

provide private access to public AWS services like S3 and DynamoDB

Prefix List added to route table → Gateway Endpoint

Highly Available(HA) across all AZs in a region by default

Question 6

Endpoint Policy

Answer 6

used to control what resources it can access

you can apply a gateway policy to a endpoint and only allow it to connect to a particular subset of S3 buckets

Question 7

What type of service is VPC gateway Endpoints Regional or Public ?

Answer 7

Reginal can’t access cross-region services

Question 8

Limitation of VPC Endpoints ?

Answer 8

that they are only accessible from inside the VPC it was created in

Question 9

How can Gateway Endpoints Prevent Leaky Buckets

Answer 9

S3 Buckets can be set to private only by allowing access ONLY from a gateway endpoint

S3 buckets can be locked down by creating a bucket policy and applying it to that S3 bucket and you could configure a bucket policy to only accept operations coming from a specific gateway endpoints

and because S3 is private by default for anything else there would be an implicitly deny

Question 10

VPC Endpoint: Interface Endpoint

Answer 10

provide private access to AWS public Services

can be used with anything that is not DDB

added to a specific subnet-an ENI -not HA

Question 11

How can you Design HA for your Interface Endpoint ?

Answer 11

add one endpoint, to one subnet , per AZ used in the VPC

Question 12

How can you Restrict access with Interface Endpoints ?

Answer 12

Network access can be controlled via security Groups

Endpoint Policies - restrict what can be done with the endpoint

Question 13

Limitations with Interface Endpoints ?

Answer 13

Only support TCP and IPv4 Only

Question 14

How do Interface endpoints operate in the backend ?

Answer 14

PrivateLink is how interface endpoints operate also how you can deploy third party

applications or services directly into your VPC

Question 15

Explain how DNS is used with Interface endpoint ?

Answer 15

when you create an Interface endpoint in a particular region for a particular service you get a new DNS name for that service a endpoint specific DNS name

e.g. vpce-123-xyz.sns.us-east-1.bpce.amazonaws.com - SNS service inside an region

Question 16

Interface Endpoint Private DNS

Answer 16

PrivateDNS overrides the default DNS for service (Like SNS)

enabled by default

associates a Route 53 private hosted zone with your VPC

this private hosted Zone carries a replacement DNS record for the default service endpoint DNS name

overrides the default service DNS with a new one that points at your interface endpoint

Question 17

VPC Peering

Answer 17

Direct encrypted network link between two VPCs

Works same/cross-region and same/cross-account

(optional) Public Hostnames resolve to private IPs

Question 18

Draw Backs of VPC Peering

Answer 18

VPC Peering does not support transitive peering

ex. if A is connected to B and A connected to C, C doesn’t the transitively have a Connection with B

Question 19

What is a benefit of using SG with VPC peering

Answer 19

Same region SG’s can reference peer SG’s

Question 20

How many DNS address does an Interface Endpoint have ?

Answer 20

Endpoint Regional DNS

Endpoint Zonal DNS -each AZ gets a Zonal DNS

either can be used to connect your application to an AWS service

Question 21

Interface Endpoint PrivateDNS

Answer 21

associates a Route 53 private hosted zone with your VPC

this private hosted zone carries a replacement DNS record that points at your interface endpoint overriding the default service endpoint

a option that come enabled by default allowing your applications to uses interface end points without modifications