VPC Flashcards
What is an EIP?
An Elastic IP address is a static IPv4 address designed for dynamic cloud computing. By using an Elastic IP address, you can mask the failure of an instance or software by rapidly remapping the address to another instance in your account. An Elastic IP address is allocated to your AWS account, and is yours until you release it.
An Elastic IP address is a public IPv4 address, which is reachable from the internet. If your instance does not have a public IPv4 address, you can associate an Elastic IP address with your instance to enable communication with the internet. For example, this allows you to connect to your instance from your local computer.
What is a VPC endpoint (vpce)?
An endpoint allows instances in a subnet to access services outside the subnet. These services are either AWS services such as a S3 or Dynamodb or other services you may have created yourself.
What is an Internet Gateway (igw)?
An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet.
An internet gateway serves two purposes: to provide a target in your VPC route tables for internet-routable traffic, and to perform network address translation (NAT) for instances that have been assigned public IPv4 addresses. An Internet Gateway allows resources within your VPC to access the internet, and vice versa.
What is a NAT gateway?
You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the internet or other AWS services, but prevent the internet from initiating a connection with those instances.
It allows resources in a private subnet to access the internet (think yum updates, external database connections, wget calls, OS patch, etc). It only works one way. The internet at large cannot get through your NAT to your private resources unless you explicitly allow it.
- Security Groups cannot be associated with a NAT Gateway
- You’ll need one in each AZ since they only operate in a single AZ
How many IGWs per VPC?
Only one can be associated with each VPC
How many NAT gateways in a Region?
One per AZ - for redundancy
Relationship between a VPC/IGW/NAT/SUBNET?
An IGW is per VPC and it allows internet traffic to and from the VPC.
A NATGW is deployed in a public subnet inside the VPC
Instances in the public and private subnets can route traffic to the NATGW from their respective subnets
The NATGW routes traffic to the Internet via the IGW attached to the VPC
NATGWs are AZ resilient - HA inside an AZ (but if whole AZ fails then it would fail)
What is a Route table?
A route table contains a set of rules, called routes, that are used to determine where network traffic from your subnet or gateway is directed.
- Your VPC has an implicit router
- Each subnet in your VPC must be associated with a route table
- You can explicitly associate a subnet with a particular route table, otherwise, the subnet is implicitly associated with the main route table.
- A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same subnet route table.
Difference between IGW and NATGW?
- IGW allows trafficto be initiated from the internet into your VPC and vice-versa, by default
- NATGW allows traffic to be initiated only one way - from subnet to Internet - not the other way round
What CIDR notation should you choose when creating a VPC?
- A large enough address range to support the needed subnets
- Any CIDR range between /16 and /28 can be chosen.
source: LinkedIn Learning
Can subnets span AZs?
No
Can VPCs span AZs?
Yes - since VPCs can comprise of multiple subnets and each subnet could be in its own AZ theoretically.
Source: myself
Manage by DNS - explain this?
Do not be IP-aware, rely on DNS as much as possible.
Source: LinkedIn Learning
What is a Transit Gateway?
AWS Transit Gateway connects VPCs and on-premises networks through a central hub
What is the difference between NACL and Security Groups?
- NACLS has explicit ALLOW and DENY rules and are stateless
- SGs DENY everything by default, needs ALLOW rules
- SGs evaluate all the rules in them before allowing a traffic whereas NACLs do it in the number order, from top to bottom.
- NACLs are used where resources are not involved and subnets are involved
- When SGs are supported on a resource use SGs (reduces number of rules and complexity)
