Networking & Content Delivery | Amazon Virtual Private Cloud (VPC) Flashcards
What is Amazon Virtual Private Cloud?
General Questions
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Amazon VPC lets you provision a logically isolated section of the Amazon Web Services (AWS) cloud where you can launch AWS resources in a virtual network that you define. You have complete control over your virtual networking environment, including selection of your own IP address ranges, creation of subnets, and configuration of route tables and network gateways. You can also create a hardware Virtual Private Network (VPN) connection between your corporate datacenter and your VPC and leverage the AWS cloud as an extension of your corporate datacenter.
You can easily customize the network configuration for your Amazon VPC. For example, you can create a public-facing subnet for your web servers that have access to the Internet, and place your backend systems such as databases or application servers in a private-facing subnet with no Internet access. You can leverage multiple layers of security, including security groups and network access control lists, to help control access to Amazon EC2 instances in each subnet.
What are the components of Amazon VPC?
General Questions
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Amazon VPC comprises a variety of objects that will be familiar to customers with existing networks:
A Virtual Private Cloud: A logically isolated virtual network in the AWS cloud. You define a VPC’s IP address space from ranges you select.
Subnet: A segment of a VPC’s IP address range where you can place groups of isolated resources.
Internet Gateway: The Amazon VPC side of a connection to the public Internet.
NAT Gateway: A highly available, managed Network Address Translation (NAT) service for your resources in a private subnet to access the Internet.
Hardware VPN Connection: A hardware-based VPN connection between your Amazon VPC and your datacenter, home network, or co-location facility.
Virtual Private Gateway: The Amazon VPC side of a VPN connection.
Customer Gateway: Your side of a VPN connection.
Router: Routers interconnect subnets and direct traffic between Internet gateways, virtual private gateways, NAT gateways, and subnets.
Peering Connection: A peering connection enables you to route traffic via private IP addresses between two peered VPCs.
VPC Endpoints: Enables private connectivity to services hosted in AWS, from within your VPC without using an an Internet Gateway, VPN, Network Address Translation (NAT) devices, or firewall proxies.
Egress-only Internet Gateway: A stateful gateway to provide egress only access for IPv6 traffic from the VPC to the Internet.
Why should I use Amazon VPC?
General Questions
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Amazon VPC enables you to build a virtual network in the AWS cloud - no VPNs, hardware, or physical datacenters required. You can define your own network space, and control how your network and the Amazon EC2 resources inside your network are exposed to the Internet. You can also leverage the enhanced security options in Amazon VPC to provide more granular access to and from the Amazon EC2 instances in your virtual network.
How do I get started with Amazon VPC?
General Questions
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Your AWS resources are automatically provisioned in a ready-to-use default VPC. You can choose to create additional VPCs by going to the Amazon VPC page in the AWS Management Console and selecting “Start VPC Wizard”.
You’ll be presented with four basic options for network architectures. After selecting an option, you can modify the size and IP address range of the VPC and its subnets. If you select an option with Hardware VPN Access, you will need to specify the IP address of the VPN hardware on your network. You can modify the VPC to add or remove secondary IP ranges and gateways, or add more subnets to IP ranges.
The four options are:
VPC with a Single Public Subnet Only
VPC with Public and Private Subnets
VPC with Public and Private Subnets and Hardware VPN Access
VPC with a Private Subnet Only and Hardware VPN Access
What are the different types of VPC Endpoints available on Amazon VPC?
Billing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
VPC endpoints enable you to privately connect your VPC to services hosted on AWS without requiring an Internet gateway, a NAT device, VPN, or firewall proxies. Endpoints are horizontally scalable and highly available virtual devices that allow communication between instances in your VPC and AWS services. Amazon VPC offers two different types of endpoints: gateway type endpoints and interface type endpoints.
Gateway type endpoints are available only for AWS services including S3 and DynamoDB. These endpoints will add an entry to your route table you selected and route the traffic to the supported services through Amazon’s private network.
Interface type endpoints provide private connectivity to services powered by PrivateLink, being AWS services, your own services or SaaS solutions, and supports connectivity over Direct Connect. More AWS and SaaS solutions will be supported by these endpoints in the future. Please refer to VPC Pricing for the price of interface type endpoints.
How will I be charged and billed for my use of Amazon VPC?
Billing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
There are no additional charges for creating and using the VPC itself. Usage charges for other Amazon Web Services, including Amazon EC2, still apply at published rates for those resources, including data transfer charges. If you connect your VPC to your corporate datacenter using the optional hardware VPN connection, pricing is per VPN connection-hour (the amount of time you have a VPN connection in the “available” state.) Partial hours are billed as full hours. Data transferred over VPN connections will be charged at standard AWS Data Transfer rates. For VPC-VPN pricing information, please visit the pricing section of the Amazon VPC product page.
What defines billable VPN connection-hours?
Billing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
VPN connection-hours are billed for any time your VPN connections are in the “available” state. You can determine the state of a VPN connection via the AWS Management Console, CLI, or API. If you no longer wish to use your VPN connection, you simply terminate the VPN connection to avoid being billed for additional VPN connection-hours.
What usage charges will I incur if I use other AWS services, such as Amazon S3, from Amazon EC2 instances in my VPC?
Billing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Usage charges for other Amazon Web Services, including Amazon EC2, still apply at published rates for those resources. Data transfer charges are not incurred when accessing Amazon Web Services, such as Amazon S3, via your VPC’s Internet gateway.
If you access AWS resources via your VPN connection, you will incur Internet data transfer charges.
Do your prices include taxes?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Except as otherwise noted, our prices are exclusive of applicable taxes and duties, including VAT and applicable sales tax. For customers with a Japanese billing address, use of AWS services is subject to Japanese Consumption Tax. Learn more.
What are the connectivity options for my VPC?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
You may connect your VPC to:
The Internet (via an Internet gateway)
Your corporate data center using a Hardware VPN connection (via the virtual private gateway)
Both the Internet and your corporate data center (utilizing both an Internet gateway and a virtual private gateway)
Other AWS services (via Internet gateway, NAT, virtual private gateway, or VPC endpoints)
Other VPCs (via VPC peering connections)
How do I connect my VPC to the Internet?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Amazon VPC supports the creation of an Internet gateway. This gateway enables Amazon EC2 instances in the VPC to directly access the Internet.
Are there any bandwidth limitations for Internet gateways? Do I need to be concerned about its availability? Can it be a single point of failure?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
No. An Internet gateway is horizontally-scaled, redundant, and highly available. It imposes no bandwidth constraints.
How do instances in a VPC access the Internet?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
You can use public IP addresses, including Elastic IP addresses (EIPs), to give instances in the VPC the ability to both directly communicate outbound to the Internet and to receive unsolicited inbound traffic from the Internet (e.g., web servers). You can also use the solutions in the next question.
How do instances without public IP addresses access the Internet
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Instances without public IP addresses can access the Internet in one of two ways:
Instances without public IP addresses can route their traffic through a NAT gateway or a NAT instance to access the Internet. These instances use the public IP address of the NAT gateway or NAT instance to traverse the Internet. The NAT gateway or NAT instance allows outbound communication but doesn’t allow machines on the Internet to initiate a connection to the privately addressed instances.
For VPCs with a hardware VPN connection or Direct Connect connection, instances can route their Internet traffic down the virtual private gateway to your existing datacenter. From there, it can access the Internet via your existing egress points and network security/monitoring devices.
Can I connect to my VPC using a software VPN?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes. You may use a third-party software VPN to create a site to site or remote access VPN connection with your VPC via the Internet gateway.
How does a hardware VPN connection work with Amazon VPC?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
A hardware VPN connection connects your VPC to your datacenter. Amazon supports Internet Protocol security (IPsec) VPN connections. Data transferred between your VPC and datacenter routes over an encrypted VPN connection to help maintain the confidentiality and integrity of data in transit. An Internet gateway is not required to establish a hardware VPN connection.
What is IPsec?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
IPsec is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a data stream.
Which customer gateway devices can I use to connect to Amazon VPC
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
There are two types of VPN connections that you can create: statically-routed VPN connections and dynamically-routed VPN connections. Customer gateway devices supporting statically-routed VPN connections must be able to:
Establish IKE Security Association using Pre-Shared Keys
Establish IPsec Security Associations in Tunnel mode
Utilize the AES 128-bit or 256-bit encryption function
Utilize the SHA-1 or SHA-2 (256) hashing function
Utilize Diffie-Hellman (DH) Perfect Forward Secrecy in “Group 2” mode, or one of the additional DH groups we support
Perform packet fragmentation prior to encryption
In addition to the above capabilities, devices supporting dynamically-routed VPN connections must be able to:
Establish Border Gateway Protocol (BGP) peerings
Bind tunnels to logical interfaces (route-based VPN)
Utilize IPsec Dead Peer Detection
Which Diffie-Hellman Groups do you support?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
We support the following Diffie-Hellman (DH) groups in Phase1 and Phase2.
Phase1 DH groups 2, 14-18, 22, 23, 24
Phase2 DH groups 2, 5, 14-18, 22, 23, 24
What customer gateway devices are known to work with Amazon VPC?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
The following devices meeting the aforementioned requirements are known to work with hardware VPN connections, and have support in the command line tools for automatic generation of configuration files appropriate for your device:
Statically-routed VPN connections:
Cisco ASA 5500 Series version 8.2 (or later) software
Cisco ISR running Cisco IOS 12.4 (or later) software
Cisco Meraki MX Series iOS 9.0 (or later) software
Check Point Security Gateway running R77.10 (or later) software
Dell SonicWALL Next Generation Firewalls (TZ, NSA, SuperMassive Series) running SonicOS5.8 (or later)
F5 Big-IP v12.0.0 (or later) software
Fortinet Fortigate 40+ Series running FortiOS 4.0 (or later), or 5.0 (or later) software
H3C MSR800 running Version 5.20 software
IIJ SEIL/B1, SEIL/X1 and SEIL/X2 running 3.70 (or later) software
IIJ SEIL/x86 running 2.30 (or later) software
Juniper J-Series Service Router running JunOS 9.5 (or later) software
Juniper SRX-Series Services Gateway running JunOS 9.5 (or later) software
Juniper SSG running ScreenOS 6.1, or 6.2 (or later) software
Juniper ISG running ScreenOS 6.1, or 6.2 (or later) software
Microsoft Windows Server 2008 R2 or 2012 R2 software
Netgate pfSense running OS 2.2.5 (or later) software
Palo Alto Networks PANOS running 4.1.2 (or later), or 7.0 (or later) software
WatchGuard XTM, Firebox Fireware OS 11.11.4 software
Yamaha RTX Routers Rev.10.01.16 (or later) software
Zyxel Zywall Series running 4.20 (or later) software
Dynamically-routed VPN connections (requires BGP)
Barracuda NextGen Firewall F-Series running 6.2 (or later) software
Check Point Security Gateway running R77.10 (or later) software
Cisco ISR running Cisco IOS 12.4 (or later) software
Dell SonicWALL Next Generation Firewalls (TZ, NSA, SuperMassive Series) running SonicOS5.9 (or later)
F5 Big-IP v12.0.0 (or later) software
Fortinet Fortigate 40+ Series running FortiOS 4.0 (or later), or 5.0 (or later) software
H3C MSR800 running Version 5.20 software
IIJ SEIL/B1, SEIL/X1 and SEIL/X2 running 3.70 (or later) software
IIJ SEIL/x86 running 2.30 (or later) software
Juniper J-Series Service Router running JunOS 9.5 (or later) software
Juniper SRX-Series Services Gateway running JunOS 9.5 (or later) software
Juniper SSG running ScreenOS 6.1, or 6.2 (or later) software
Juniper ISG running ScreenOS 6.1, or 6.2 (or later) software
Palo Alto Networks PANOS running 4.1.2 (or later), or 7.0 (or later) software
Sophos Astaro Security Gateway Essential Firewall Edition V8.300 (or later) software
Vyatta Network OS 6.5 (or later) software
Yamaha RTX Routers Rev.10.01.16 (or later) software
Zyxel Zywall Series running 4.30 (or later) software
Please note, these sample configurations are for the minimum requirement of AES128, SHA1, and DH Group 2. You will need to modify these sample configuration files to take advantage of AES256, SHA256, or other DH groups.
If my device is not listed, where can I go for more information about using it with Amazon VPC?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
We recommend checking the Amazon VPC forum as other customers may be already using your device.
What is the approximate maximum throughput of a VPN connection?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
VGW supports IPSEC VPN throughput upto 1.25 Gbps. Multiple VPN connections to the same VPC are cumulatively bound by the VGW throughput of 1.25 Gbps.
What factors affect the throughput of my VPN connection?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
VPN connection throughput can depend on multiple factors, such as the capability of your Customer Gateway (CGW), the capacity of your connection, average packet size, the protocol being used (TCP vs. UDP), and the network latency between your CGW and the Virtual Private Gateway (VGW).
What tools are available to me to help troubleshoot my Hardware VPN configuration?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
The DescribeVPNConnection API displays the status of the VPN connection, including the state (“up”/”down”) of each VPN tunnel and corresponding error messages if either tunnel is “down”. This information is also displayed in the AWS Management Console.
How do I connect a VPC to my corporate datacenter?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Establishing a hardware VPN connection between your existing network and Amazon VPC allows you to interact with Amazon EC2 instances within a VPC as if they were within your existing network. AWS does not perform network address translation (NAT) on Amazon EC2 instances within a VPC accessed via a hardware VPN connection.
Can I NAT my CGW behind a router or firewall?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes, you will need to enable NAT-T and open UDP port 4500 on your NAT device.
What IP address do I use for my CGW address?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
You will use the public IP address of your NAT device.
How do I disable NAT-T on my connection?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
You will need to disable NAT-T on your device. If you don’t plan on using NAT-T and it is not disabled on your device, we will attempt to establish a tunnel over UDP port 4500. If that port is not open the tunnel will not establish.
I would like to have multiple CGWs behind a NAT, what do I need to do to configure that?
Connectivity
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
You will use the public IP address of your NAT device for the CGW for each of your connections. You will also need to make sure UDP port 4500 is open.
How many IPsec security associations can be established concurrently per tunnel?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
The AWS VPN service is a route-based solution, so when using a route-based configuration you will not run into SA limitations. If, however, you are using a policy-based solution you will need to limit to a single SA, as the service is a route-based solution.
What IP address ranges can I use within my VPC?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
You can use any IPv4 address range, including RFC 1918 or publicly routable IP ranges, for the primary CIDR block. For the secondary CIDR blocks, certain restrictions apply. Publicly routable IP blocks are only reachable via the Virtual Private Gateway and cannot be accessed over the Internet through the Internet gateway. AWS does not advertise customer-owned IP address blocks to the Internet. You can allocate an Amazon-provided IPv6 CIDR block to a VPC by calling the relevant API or via the AWS Management Console.
How do I assign IP address ranges to VPCs?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
You assign a single Classless Internet Domain Routing (CIDR) IP address range as the primary CIDR block when you create a VPC and can add up to four (4) secondary CIDR blocks after creation of the VPC. Subnets within a VPC are addressed from these CIDR ranges by you. Please note that while you can create multiple VPCs with overlapping IP address ranges, doing so will prohibit you from connecting these VPCs to a common home network via the hardware VPN connection. For this reason we recommend using non-overlapping IP address ranges. You can allocate an Amazon-provided IPv6 CIDR block to your VPC.
What IP address ranges are assigned to a default VPC?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Default VPCs are assigned a CIDR range of 172.31.0.0/16. Default subnets within a default VPC are assigned /20 netblocks within the VPC CIDR range.
Can I advertise my VPC public IP address range to the Internet and route the traffic through my datacenter, via the hardware VPN, and to my VPC?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes, you can route traffic via the hardware VPN connection and advertise the address range from your home network.
How large of a VPC can I create?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Currently, Amazon VPC supports five (5) IP address ranges, one (1) primary and four (4) secondary for IPv4. Each of these ranges can be between /28 (in CIDR notation) and /16 in size. The IP address ranges of your VPC should not overlap with the IP address ranges of your existing network.
For IPv6, the VPC is a fixed size of /56 (in CIDR notation). A VPC can have both IPv4 and IPv6 CIDR blocks associated to it.
Can I change a VPC’s size?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes. You can expand your existing VPC by adding four (4) secondary IPv4 IP ranges (CIDRs) to your VPC. You can shrink your VPC by deleting the secondary CIDR blocks you have added to your VPC. You cannot however change the size of the IPv6 address range of your VPC.
How many subnets can I create per VPC?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Currently you can create 200 subnets per VPC. If you would like to create more, please submit a case at the support center.
Is there a limit on how large or small a subnet can be?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
The minimum size of a subnet is a /28 (or 14 IP addresses.) for IPv4. Subnets cannot be larger than the VPC in which they are created.
For IPv6, the subnet size is fixed to be a /64. Only one IPv6 CIDR block can be allocated to a subnet.
Can I use all the IP addresses that I assign to a subnet?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
No. Amazon reserves the first four (4) IP addresses and the last one (1) IP address of every subnet for IP networking purposes.
How do I assign private IP addresses to Amazon EC2 instances within a VPC?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
When you launch an Amazon EC2 instance within a VPC, you may optionally specify the primary private IP address for the instance. If you do not specify the primary private IP address, AWS automatically addresses it from the IP address range you assign to that subnet. You can assign secondary private IP addresses when you launch an instance, when you create an Elastic Network Interface, or any time after the instance has been launched or the interface has been created.
Can I change the private IP addresses of an Amazon EC2 instance while it is running and/or stopped within a VPC?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Primary private IP addresses are retained for the instance’s or interface’s lifetime. Secondary private IP addresses can be assigned, unassigned, or moved between interfaces or instances at any time.
If an Amazon EC2 instance is stopped within a VPC, can I launch another instance with the same IP address in the same VPC?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
No. An IP address assigned to a running instance can only be used again by another instance once that original running instance is in a “terminated” state.
Can I assign IP addresses for multiple instances simultaneously?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
No. You can specify the IP address of one instance at a time when launching the instance.
Can I assign any IP address to an instance?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
You can assign any IP address to your instance as long as it is:
Part of the associated subnet’s IP address range
Not reserved by Amazon for IP networking purposes
Not currently assigned to another interface
Can I assign multiple IP addresses to an instance?
IP Addressing
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes. You can assign one or more secondary private IP addresses to an Elastic Network Interface or an EC2 instance in Amazon VPC. The number of secondary private IP addresses you can assign depends on the instance type. See EC2 User Guide for more information on the number of secondary private IP addresses that can be assigned per instance type.
Can I assign one or more Elastic IP (EIP) addresses to VPC-based Amazon EC2 instances?
Routing and Topology
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes, however, the EIP addresses will only be reachable from the Internet (not over the VPN connection). Each EIP address must be associated with a unique private IP address on the instance. EIP addresses should only be used on instances in subnets configured to route their traffic directly to the Internet gateway. EIPs cannot be used on instances in subnets configured to use a NAT gateway or a NAT instance to access the Internet. This is applicable only for IPv4. Amazon VPCs do not support EIPs for IPv6 at this time.
What does an Amazon VPC router do?
Routing and Topology
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
An Amazon VPC router enables Amazon EC2 instances within subnets to communicate with Amazon EC2 instances in other subnets within the same VPC. The VPC router also enables subnets, Internet gateways, and virtual private gateways to communicate with each other. Network usage data is not available from the router; however, you can obtain network usage statistics from your instances using Amazon CloudWatch.
Can I modify the VPC route tables?
Routing and Topology
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes. You can create route rules to specify which subnets are routed to the Internet gateway, the virtual private gateway, or other instances.
Can I specify which subnet will use which gateway as its default?
Routing and Topology
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes. You may create a default route for each subnet. The default route can direct traffic to egress the VPC via the Internet gateway, the virtual private gateway, or the NAT gateway.
Does Amazon VPC support multicast or broadcast?
Security and Filtering
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
No.
How do I secure Amazon EC2 instances running within my VPC?
Security and Filtering
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Amazon EC2 security groups can be used to help secure instances within an Amazon VPC. Security groups in a VPC enable you to specify both inbound and outbound network traffic that is allowed to or from each Amazon EC2 instance. Traffic which is not explicitly allowed to or from an instance is automatically denied.
In addition to security groups, network traffic entering and exiting each subnet can be allowed or denied via network Access Control Lists (ACLs).
What are the differences between security groups in a VPC and network ACLs in a VPC?
Security and Filtering
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Security groups in a VPC specify which traffic is allowed to or from an Amazon EC2 instance. Network ACLs operate at the subnet level and evaluate traffic entering and exiting a subnet. Network ACLs can be used to set both Allow and Deny rules. Network ACLs do not filter traffic between instances in the same subnet. In addition, network ACLs perform stateless filtering while security groups perform stateful filtering.
What is the difference between stateful and stateless filtering?
Security and Filtering
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Stateful filtering tracks the origin of a request and can automatically allow the reply to the request to be returned to the originating computer. For example, a stateful filter that allows inbound traffic to TCP port 80 on a webserver will allow the return traffic, usually on a high numbered port (e.g., destination TCP port 63, 912) to pass through the stateful filter between the client and the webserver. The filtering device maintains a state table that tracks the origin and destination port numbers and IP addresses. Only one rule is required on the filtering device: Allow traffic inbound to the web server on TCP port 80.
Stateless filtering, on the other hand, only examines the source or destination IP address and the destination port, ignoring whether the traffic is a new request or a reply to a request. In the above example, two rules would need to be implemented on the filtering device: one rule to allow traffic inbound to the web server on TCP port 80, and another rule to allow outbound traffic from the webserver (TCP port range 49, 152 through 65, 535).
Within Amazon VPC, can I use SSH key pairs created for instances within Amazon EC2, and vice versa?
Security and Filtering
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes.
Can Amazon EC2 instances within a VPC communicate with Amazon EC2 instances not within a VPC?
Security and Filtering
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes. If an Internet gateway has been configured, Amazon VPC traffic bound for Amazon EC2 instances not within a VPC traverses the Internet gateway and then enters the public AWS network to reach the EC2 instance. If an Internet gateway has not been configured, or if the instance is in a subnet configured to route through the virtual private gateway, the traffic traverses the VPN connection, egresses from your datacenter, and then re-enters the public AWS network.
Can Amazon EC2 instances within a VPC in one region communicate with Amazon EC2 instances within a VPC in another region?
Security and Filtering
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes. Instances in one region can communicate with each other using Inter-Region VPC Peering, public IP addresses, NAT gateway, NAT instances, VPN Connections or Direct Connect connections.
Can Amazon EC2 instances within a VPC communicate with Amazon S3?
Security and Filtering
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes. There are multiple options for your resources within a VPC to communicate with Amazon S3. You can use VPC Endpoint for S3, which makes sure all traffic remains within Amazon’s network and enables you to apply additional access policies to your Amazon S3 traffic. You can use an Internet gateway to enable Internet access from your VPC and instances in the VPC can communicate with Amazon S3. You can also make all traffic to Amazon S3 traverse the Direct Connect or VPN connection, egress from your datacenter, and then re-enter the public AWS network.
Why can’t I ping the router, or my default gateway, that connects my subnets?
Security and Filtering
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Ping (ICMP Echo Request and Echo Reply) requests to the router in your VPC is not supported. Ping between Amazon EC2 instances within VPC is supported as long as your operating system’s firewalls, VPC security groups, and network ACLs permit such traffic.
Can I monitor the network traffic in my VPC?
Amazon VPC and EC2
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes. You can use the Amazon VPC Flow Logs feature to monitor the network traffic in your VPC.
Within which Amazon EC2 region(s) is Amazon VPC available?
Amazon VPC and EC2
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Amazon VPC is currently available in multiple Availability Zones in all Amazon EC2 regions.
Can a VPC span multiple Availability Zones?
Amazon VPC and EC2
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
Yes.
Can a subnet span Availability Zones?
Amazon VPC and EC2
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
No. A subnet must reside within a single Availability Zone.
How do I specify which Availability Zone my Amazon EC2 instances are launched in?
Amazon VPC and EC2
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
When you launch an Amazon EC2 instance, you must specify the subnet in which to launch the instance. The instance will be launched in the Availability Zone associated with the specified subnet.
How do I determine which Availability Zone my subnets are located in?
Amazon VPC and EC2
Amazon Virtual Private Cloud (VPC) | Networking & Content Delivery
When you create a subnet you must specify the Availability Zone in which to place the subnet. When using the VPC Wizard, you can select the subnet’s Availability Zone in the wizard confirmation screen. When using the API or the CLI you can specify the Availability Zone for the subnet as you create the subnet. If you don’t specify an Availability Zone, the default “No Preference” option will be selected and the subnet will be created in an available Availability Zone in the region.
