VPC Flashcards
VPC
Virtual Data Center
In the cloud
VPC
L VPCs allowed in each AWS region by
default
VPC
All subnets in default VPC have
Internet Gateway attached
VPC
Multiple Internet Gateways can be created but there can be only 1
attached to a VPC
VPC
Each EC2 instance have both Public and Private
IP addresses
VPC
If you delete the default VPC - how do you get it back
Submit a support ticket
VPC
When you create a VPC then this is automatically created as well
Default main routing table.
VPC
One subnet is mapped to one
There can be only 1 AZ
–thus multiple AZs are not allowed
VPC
The largest CIDR block available when provisioning an IP space for a VPC
/16
VPC
Always subnet as is never useable
x.x.x.0
VPC
Reserved by AWS for VPC routr
x.x.x.1
VPC
Reserved by AWS for subnet DNS
x.x.x.2
VPC
Reserved by AWS for future use
x.x.x.3
VPC
Always subnet broadcast address and is never useable
x.x.x.255
VPC
169.254.169.253
Amazon DNS
VPC
By default all traffic between subnets is
Allowed
VPC
By default NOT all subnets have access to the
Internet
VPC
Need by a subnet to access the internet
Internet Gateway
–or–
Nat Gateway
VPC
Nat Gateway is required for
Private subnets
VPC
Only 1 Internet Gateway per
VPC
VPC
Can stretch across different AZs
Security Group
VPC
Use for Hardware Virtual Private Network VPN
Connection between your corporate data center and your VPC to leverage the AWS cloud as an extension of your corporate data center
VPC
Disable Source/Destination checks when creating a NAT instance
Or you could encounter issues
VPC
Must be in a PUBLIC subnet
NAT INSTANCES
VPC
In order for it to work correctly there must be a route out of the private subnet to the
Nat Instance
VPC
If you experience any bottlenecks with nat instances
Increase the size of the instance
VPC
Nat instances are always behind a
Security Group
VPC
Achieved by using Auto-scaling groups or multiple subnets in different AZs - with scripted fail-pver
High Availability
VPC
Nat instances scale automatically up to
DaZe Gob
10 Gigabytes
VPC
Do you patch NAT gateways
NO - because the AMI is handled by AWS
VPC
NAT gateways are automatically assigned
a public IP address
VPC
You need to do this when creating a new NAT Gateway
Update your route table.
VPC
NAT Gateways are NOT associated with
Security Groups
VPC
Numbered list of rules that are evaluated in order - starting at the lowest numbered rule first to determine what traffic is allowed in or out depending on what subnet is associated with the rule
Network Access Control List
NACL
VPC
The highest NACL rule number is
MuDKaPP
32766
VPC
Begin with rules at this number so you can insert rules if needed
DiSS
100
VPC
By default the default NACL allows traffic
IN and Out
VPC
A NACL must be attached to each subnet because if a subnet is not associated with one
No traffic goes IN or OUT
VPC
NACL rules - allow traffic in but outbound rules are not created automatically
Stateless
VPC
Lobsters - single NACL to single
Subnet
VPC
Connection between two VPCs that enables you to route traffic between them using private IP addresses via a direct network route
VPC Peering
VPC - Peering
Instances in either VPC can communicate with each other as if they are within the same
Network
VPC - Peering
You can create connections between your own VPCs or with a VPC in another account within a
SINGLE region
VPC - Peering
AWS uses existing infrastructure of a VPC to create peering connections
It is not a gateway nor a VPN and does not rely on separate hardware
VPC - Peering
There is not single point of failure for communication
Nor any bandwidth bottleneck
VPC - Peering
Peering between 1 VPC to get to another is not allowed
Transitive Peering
VPC - Peering
(1 to 1) Hub and
Spoke
VPC - Peering
Be mindful of IPS in each VPC - if multiple VPCs have the same IP blocks
They will not be able to communicate
VPC - Peering
Peering is allowed with other AWS accounts and
your own network
VPC
Subnets per VPC
NiSS
200
VPC
Customer Gateways per region
LoZer
50
VPC
VPN connections per region
LoZer
50
VPC
VPN connections per VPC per virtual private gateway
DoS
10
VPC
Route tables per VPC
Lo
5
