VPCs Flashcards
What does VPC stand for?
Virtual Private Cloud
What is a VPC?
- Think virtual data center in the cloud
- A logically isolated section of AWS where you can launch AWS resources in a virtual network that you define
What can you do with a VPC?
- Launch instances into a subnet of your choosing
- Assign custom IP address ranges in each subnet
- Configure route tables between subnets
- Create Internet Gateway and attach it to our VPC
- Much better security control over your AWS resources
- Instance security groups
- Subnet Network Access Control Lists
What is VPC Peering?
- Allows you to connect one VPC with another via a direct network route using private IP addresses
- Instances behave as if they were on the same private network
Can VPC Peering be done between two VPCs in different AWS accounts?
Yes
Suppose VPC A is peered with VPC B, and VPC B is paired with VPC C. Is VPC A considered peered with VPC C?
NO. VPC Peering is NOT transitive!
Can you use VPC Peering to peer two VPC in different AWS regions?
Yes
What does IGW stand for?
Internet Gateway
What are the key components of a VPC?
- Gateway (IGW or Virtual Private Gateway)
- Route Tables
- Network Access Control Lists
- Subnets
- Security Groups
Can you have two VPC subnets in the same AZ?
Yes
Can you have a subnet stretched across multiple AZs?
No
When you create a VPC, what infrastructure is created by default?
- A Default Route Table
- A Network ACL
- A Default Security Group
(Note that it does NOT create subnets or IGWs)
If I launch a VPC into US-East-1a in my account, and someone else launches a VPC into US-East-1a in their account, does this mean the two VPCs are in the same AZ?
Not necessarily, The AZ’s are randomized
How many IP Addresses does Amazon Reserve per subnet?
5
What is the maximum number of IGWs you can have per VPC?
1
Can you have a security group spanning multiple VPCs?
No
Can you create an ELB with only one public subnet?
No, to create an ELB you need at least 2 public subnets
What is a Bastion Host?
A hardened, secure request forwarder allowing you to SSH/RDP in to private subnets in order to administer them (Idea is about lowering surface area of attack)
Can you use a NAT Gateway as a Bastion Host?
No
Are Bastion Hosts usually placed in a private subnet or a public subnet?
They are placed in a public subnet so you can access the private subnet
What is Direct Connect and what are its primary use cases?
- Idea is that it directly connects your data center to AWS
- Useful for high throughput workloads (lots of network traffic)
- Useful if you need a stable and reliable secure connection
What are the steps for setting up AWS Direct Connect?
- Create a virtual interface in the direct connect console. This is a PUBLIC virtual interface
- Go to the VPC Console and then to VPN Connection. Create a Customer Gateway
- Create a Virtual Private Gatway
- Attach the Virtual Private Gateway to the desired VPC
- Select VPN Connections and create a new VPN Connection.
- Select the Virtual Private Gateway and the Customer Gateway
- Once the VPN is available, set up the VPN on the customer gateway or firewall
What is AWS Global Accelerator?
A service in which you create accelerators to improve availability and performance of your applications for local and global users
How many static IP addresses does AWS assign to you for Global Accelerator?
2
(Note you can also bring your own static IPs!)
How do you control traffic in AWS Global Accelerator?
Use traffic dials. This is done within an endpoint group
What is a VPC Endpoint?
A VPC Endpoint enables you to privately connect your VPC to supported AWS Services and VPC endpoint services powered by PrivateLink without requiring an internet gateway, NAT device, VPN Connection, or Direct Connect Connection
What are the two types of VPC Endpoints?
- Interface Endpoints
- Gateway Endpoints
For what services are VPC Gateway Endpoints supported?
- Amazon S3
- DynamoDB
Suppose you want to peer a VPC with tens or thousands of other customer VPCs. What is the best way to accomplish this?
AWS PrivateLink
Does AWS PrivateLink require VPC Peering?
No.
There’s no NAT, no route tables, no IGWs, etc.
What is required to use AWS PrivateLink?
- A Network Load Balancer on the service VPC
- An ENI on the customer VPCs
What is AWS Transit Gateway used for?
- It allows you to have transitive peering between thousands of VPCs and on-premises data centers
- Think simplify network topology
- Always works on a hub-and-spoke model
Can you use AWS Transit Gateway across multiple regions?
Yes
Can you use AWS Transit Gateway across multiple accounts?
Yes
Do AWS Transit Gateways work with Direct Connect?
Yes
When using AWS Transit Gateways, how can I limit how VPCs talk to one another?
Use route tables
What is the ONLY AWS Service that supports IP Multicast?
AWS Transit Gateway
What is the use case for AWS VPN CloudHub?
- Connecting multiple sites, each with a VPN Connection, together over a hub-and-spoke model
- It operates over the public internet, but all traffic between the customer gateways and the VPN CloudHub is encrypted
When using VPCs, will private IPs or public IPs produce a lower network cost? Why?
private IPs are less expensive than public IPs, because private IPs use the AWS Backbone Network
In general, does AWS charge you more/less/or the same for communicating between VPCs in different AZs within the same region vs. communicating between VPCs in different regions?
communicating between VPCs in different AZs in the same region is less expensive than communicating between VPCs in different regions.
How can you use VPCs and cut all network costs? What is the problem with that approach?
- Use private IP addresses
- group all EC2 instances in a single AZ
- This is a problem because it leaves a single point of failure
What is the definition of a public subnet?
One that has at least one route in its routing table that uses an IGW
Does VPC peering support edge to edge routing?
No
