VPC Flashcards
Think of VPC as
a logical datacenter in AWS
VPCs can span
AZs. They cannot span Regions
VPCs consist of
IGWs (or Virtual Private Gateways), Route Tables, Network ACLs, Subnets, Security Groups
1 subnet =
1 AZ
Security Groups are
stateful
Network ACLs are
stateless. responses to allow inbound traffic are subject to the rules for outbound traffic and vice versa
You can peer VPCs both in
same account and with other AWS accounts
Is transitive peering allowed?
No
When creating a NAT instance
Disable Source/Destination Check on the instance
NAT instances must be in a
public subnet and be behind a security group
NAT instances must have what in order to work?
elastic IP address, a route out of the private subnet to the NAT instance
the amount of traffic that NAT instances supports depends on
the instance size. If you are bottlenecking, increase the instance size
create high availability using
Autoscaling Groups, multiple subnets in different AZs and a script to automate failover
NAT gateways
preferred by enterprise, scale automatically up to 10 Gbps, No need to patch, not associated w/ security groups, assigned a public IP automatically, update route tables, no need to disable source/dest checks
Default Network ACL
created automatically with VPC and by default it allows all outbound and inbound traffic
Custom Network ACL
by default it denies all outbound and inbound traffic until you add rules
Each subnet in VPC must be associated w/
network ACL/route table. if you don’t explicitly associate a subnet, the subnet associated with default Network ACL/route table
You can associate a nACL with
multiple subnets
You can associate a subnet with
only 1 nACL at a time. when you associate a nACL with a subnet, previous association is removed
Rules in NACL are
evaluated numerically starting w/ lowest number. inbound and outbound rules separate; each can either allow or deny traffic
to block IP addresses
use nACLs not security groups
NAT vs Bastions
NAT provides internet traffic to EC2 instances in private subnets. Bastion is used to securely administer EC2 instances in private subnets
If you want resiliency
always have 2 public subnets and 2 private subnets. make sure each subnet is in different AZs. with ELBs, 2 public subnets in 2 different AZs. with Bastions, put them behind autoscaling group w/ min size = 2 and use Route53 to fail over
