VPC Summary Flashcards
Think of VPC as…
…a logical datacenter in AWS
1 Subnet =
1 AZ
Security Groups are…
…stateful
Network ACLs are…
…stateless
Can you peer VPCs in same account?
Yes
Can you peer VPCs in different accounts?
Yes
Transitive peering?
No
When creating a NAT instance…
…disable Source/Destination Check on the instance
NAT instances must be in which subnet?
Public
For NAT instance to work…
…must have elastic IP address, must be a route out of the private subnet to the NAT instance
How much traffic do NAT instances support?
Depends on the instance size. If bottlenecking, increase the instance size
You can create high availability using…
…AutoScaling Groups, multiple subnets in different AZs, a script to automate failover
T/F: NAT instances are behind a security group.
True
NAT gateways…
…scale automatically up to 10 Gbps, no need to patch, not associated with security groups, automatically assigned a public IP, do not need to disable source/dest check
Default NACL…
…automatically created with a VPC and by default it allows all inbound and outbound traffic
Custom NACL…
…denies all inbound and outbound traffic until you add rules
T/F: Each subnet in your VPC must be associated with a network ACL
True
If you don’t explicitly associate a subnet with a network ACL…
…the subnet is automatically associated w/ default network ACL
Can you associate a network ACL with multiple subnets?
Yes, but a subnet can only be associated with one NACL at a time
When you associate a network ACL with a subnet…
…the previous association is removed
NACL rules…
…evaluated in order, starting with the lowest numbered rule
NACL inbound and outbound rules are…
…separate. Each rule can either allow or deny traffic
NACLs are stateless, so…
…responses to allowed inbound traffic are subject to the rules of outbound traffic (and vice versa)
Block IP addresses using…
…NACLs not Security Groups
A NAT is used to…
…provide internet traffic to EC2 instances in private subnets
A Bastion is used to…
…securely administer EC2 instances using SSH or RDP in private subnets
If you want resiliency…
…always have 2 public subnets and 2 private subnets. Make sure each subnet is in different AZs
With ELBs, make sure…
…they are in 2 public subnets in 2 different AZs
With Bastion hosts…
…put them behind an autoscaling group w/ a minimum size of 2. Use Route53 (round robin or health check) to automatically fail over
To make NAT instances resilient…
…need one in each public subnet, each with their own public IP, and you need to write a script to fail between the two. Instead, where possible, use NAT gateways
