Fundamentals of AWS networking - SVC303 - Atlanta AWS Summit

1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Amazon VPC: Foundations, updates, and how you, too, can build your networking architectures on AWS Nick Matthews Principal Solutions Architect Amazon Web Services

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Let’s take a closer look AWS Region Availability Zone 2Availability Zone 1 Private subnet Private subnet Public subnet Public subnet VPC CIDR 10.1.0.0/16 + Expand + IPv6 Amazon VPC Amazon EC2 InstanceB 10.1.1.11/24 InstanceA 10.1.0.11/24 InstanceC 10.1.2.11/24 InstanceD 10.1.3.11/24 The internet Amazon S3 Amazon DynamoDB AWS Lambda Amazon SQS Amazon SNS AWS IOT

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T IP addressing Creating subnets Routing in a VPC Security VPC concepts and fundamentals DNS in-VPC with Amazon Route 53

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Choosing an IP address range for your VPC 172.31.0.0/16 Recommended: RFC1918 range Recommended: /16 (65,536 addresses) Avoid ranges that overlap with other networks to which you might connect

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T VPC subnets and Availability Zones 172.31.0.0/16 Availability Zone Availability Zone Availability Zone VPC subnet VPC subnet VPC subnet 172.31.0.0/24 172.31.1.0/24 172.31.2.0/24 eu-west-1a eu-west-1b eu-west-1c

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T IPv6 in your VPC • Can have a dual-stack VPC by adding an IPv6 CIDR • Fixed sizes for VPC and subnets: • /56 VPC (4,722,366,482,869,645,213,696 addresses) • /64 subnets (18,446,744,073,709,551,616 addresses)

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T VPC subnets and Availability Zones 172.31.0.0/16 Availability Zone Availability Zone Availability Zone VPC subnet VPC subnet VPC subnet 172.31.0.0/24 172.31.1.0/24 172.31.2.0/24 eu-west-1a eu-west-1b eu-west-1c 2600:1f16:14d:6300::/56 2600:1f16:14d:6300::/64 2600:1f16:14d:6301::/64 2600:1f16:14d:6302::/64 + Expand

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Routing in your VPC • Route tables contain rules for which packets go where • Your VPC has a default route table • But, you can create and assign different route tables to different subnets

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T “MyWebServers” security group “MyBackends” security group Allow only “MyWebServers” Security groups follow application structure Web Web Web Web App App App IGW

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Security groups versus NACLs Security group Network ACL Operates at instance level Operates at subnet level Supports allow rules only Supports allow and deny rules Is stateful: return traffic is automatically allowed regardless of any rules Is stateless: return traffic must be explicitly allowed by rules All rules evaluated before deciding whether to allow traffic Rules evaluated in order when deciding whether to allow traffic Applies only to instances explicitly associated with the security group Automatically applies to all instances launched into associated subnets Doesn’t filter traffic to or from link-local addresses (169.254.0.0/16) or AWS-reserved IPv4 addresses; these are the first four IPv4 addresses of the subnet (including the Amazon VPC DNS server)

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T VPC Flow Logs AZ 2AZ 1 • Visibility • Troubleshooting • Analyze traffic Amazon S3 Amazon CloudWatch Logs VPC Flow Logs

31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Internet connectivity Connecting to other VPCs Connecting to your on-premises network Connecting your VPC or not

33. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T NAT InstanceB 10.1.1.11/24 Instance BNAT-GW NAT-GW 0.0.0.0/0 AWS Region Availability Zone 2Availability Zone 1 Private subnet The internet Private subnet Public subnet InstanceA Public subnet Amazon S3 VPC CIDR 10.1.0.0/16 10.1.0.11/24 InstanceC 10.1.2.11/24 InstanceD 10.1.3.11/24 + Expand + IPv6 IGW 10.1.0.0/16 Local 0.0.0.0/0 IGW Destination Target 10.1.0.0/16 Local Destination Target EIP - 10.1.0.11 : 54.23.12.43 EIP - 10.1.1.11 : 54.19.12.23 Let’s take a closer look Amazon DynamoDB AWS Lambda Amazon SQS Amazon SNS AWS IOT

35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T VPC peering • Full private IP connectivity between two VPCs • Can peer VPCs across regions • VPCs can be in different accounts • VPC CIDR ranges must not overlap 10.0.0.0/16 10.2.0.0/16 10.1.0.0/16 10.3.0.0/16

37. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Establish a VPC peering: Accept request Step 1 Initiate peering request Step 2 Accept peering request 172.31.0.0/16 10.55.0.0/16

38. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Establish a VPC peering: Create routes Step 1 Initiate peering request Step 2 Accept peering request Step 3, 4 172.31.0.0/16 10.55.0.0/16 Traffic destined for the peered VPC should go to the peering, repeat for other VPC

40. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T VPN connectionCustomer gateway Amazon VPC Amazon VPC AWS Direct Connect Gateway VPC peering VPC peering VPC peering Amazon VPC Amazon VPCVPC peering VPN connection VPN connection VPC peering Before AWS Transit Gateway…

47. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Static routes per Amazon VPC route table 1,000* Amazon VPC peering connections per Amazon VPC 125 *Default is 50

48. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Transit Gateway Amazon VPCAmazon VPC Amazon VPCAmazon VPC Customer gateway VPN connection AWS Direct Connect Gateway (NEW) With AWS Transit Gateway …

49. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T B Local 0.0.0.0/0 Destination Target A B TGW C TGW 1 2 3 4 TGW Route Table(s) VPC A : Attachment 1 VPC B : Attachment 2 VPC C : Attachment 3 On-prem : VPN 4 RT1 RT2 On-Premises With AWS Transit Gateway …

50. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Attachment The connection from a Amazon VPC and VPN to a TGW Association The route table used to route packets coming from an attachment (from an Amazon VPC and VPN) Propagation The route table where the attachment’s routes are installed

51. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Llama TGW X Y TGW Route Table(s) Associations RT1 Z Propagations Pegasus from Y Llama from X Pegasus from Y Llama from X 10.1.0.0/16 Pegasus 10.2.0.0/16 Barry 10.3.0.0/16 Barry from Z Barry from Z Routes 10.2.0.0/16 via Y 10.1.0.0/16 via X 10.3.0.0/16 via Z 10.1.0.0/16 Local 0.0.0.0/0 TGW Destination Target 10.1.0.0/16 Local 0.0.0.0/0 IGW Destination Target 10.0.0.0/8 TGW

52. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Llama TGW X Y TGW Route Table(s) Associations RT1 Z Propagations Pegasus from Y Llama from X Pegasus from Y Llama from X 10.1.0.0/16 Pegasus 10.2.0.0/16 Barry 10.3.0.0/16 Barry from Z Barry from Z Routes 10.2.0.0/16 via Y 10.1.0.0/16 via X 10.3.0.0/16 via Z 10.8.0.0/16 10.9.0.0/16 10.8.0.0/16 via X 10.9.0.0/16 via X

53. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Llama TGW X Y TGW Route Table(s) Associations RT1 Z Propagations Pegasus from Y Llama from X Pegasus from Y Llama from X 10.1.0.0/16 Pegasus 10.2.0.0/16 Barry 10.3.0.0/16 Barry from Z Barry from Z Routes 10.2.0.0/16 via Y 10.1.0.0/16 via X 10.3.0.0/16 via Z 10.8.0.0/16 10.9.0.0/16 10.8.0.0/16 via X 10.9.0.0/16 via X Propagation turned off, you can still statically configure routes

58. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Maximum bandwidth per VPN connection 1.25Gbps *With ECMP, you can distribute traffic over multiple tunnels; e.g., 8 tunnels = 10 Gbps *

63. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T On premises IPsec Tunnel 1 - Primary IPsec Tunnel 2- Secondary Virtual private gateway VGW IPsec tunnel over the internet Customer gateway CGW The internet

64. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T On premises IPsec Tunnel 1 - Primary IPsec Tunnel 2- Secondary IPsec tunnel over the internet The internet Transit GW Customer gateway CGW

66. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Attachment to Amazon VPC TLS-based tunnel over the internet User with Open VPN Client Client VPN Endpoint Client The internet On premises Amazon S3 Amazon DynamoDB

68. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Customer or partner cage Service Provider Network AWS Direct Connect: What’s that? AWS Region On premises AWS Direct Connect location AWS cage Cross Connect 10.0.0.0/16 192.168.0.0/16 Private VIF Public VIF VGW

69. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Customer or partner cage Service Provider Network AWS Region On premises AWS Direct Connect location AWS cage Cross Connect 10.0.0.0/16 192.168.0.0/16 Private VIF Public VIF 10.2.0.0/16 VGW VGW Private VIF AWS Direct Connect: What’s that?

70. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Customer or partner cage Service Provider Network AWS Direct Connect Gateway AWS Region On premises AWS Direct Connect location AWS cage Cross Connect 10.0.0.0/16 192.168.0.0/16 Private VIF 10.2.0.0/16 VGW VGW O n e P r i v a t e V I F  M a n y V P C s AWS Direct Connect Gateway

71. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Customer or partner cage Service Provider Network AWS Region 1 On premises AWS Direct Connect location AWS cage Cross Connect 10.0.0.0/16 192.168.0.0/16 Private VIF 10.2.0.0/16 VGW VGW O n e P r i v a t e V I F  M a n y V P C s a c r o s s R e g i o n s AWS Region 2 AWS Direct Connect Gateway AWS Direct Connect Gateway

72. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Customer or partner cage Service Provider Network AWS Account 1 On premises AWS Direct Connect location AWS cage Cross Connect 10.0.0.0/16 192.168.0.0/16 Private VIF 10.2.0.0/16 VGW VGW O n e P r i v a t e V I F  M a n y V P C s a c r o s s a c c o u n t s AWS Account 2 AWS Direct Connect Gateway Multi Account DX Gateway NEW AWS Direct Connect Gateway

73. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Customer or partner cage Service Provider Network AWS Account 1 On premises AWS Direct Connect location AWS cage Cross Connect 10.0.0.0/16 192.168.0.0/16 Transit VIF 10.2.0.0/16 O n e T r a n s i t V I F  M a n y V P C s AWS Account 2 AWS Direct Connect Gateway Transit VIF with DX Gateway NEW AWS Transit Gateway AWS Direct Connect Gateway

79. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T L l a m a 10.3.0.0/16 P e g a s u s 10.2.0.0/16 B a r r y 10.1.0.0/16 I g u a n a 10.6.0.0/16 S t e v e 10.5.0.0/16 S u e 10.4.0.0/16 AWS Lambda Amazon EC2 Amazon RedshiftAmazon RDS Amazon EC2 Amazon EC2 Prod 1Dev Test Prod2 Prod 3 Prod 4

81. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T L l a m aP e g a s u s 10.2.0.0/16 B a r r y 10.1.0.0/16 I g u a n aS t e v eS u e AWS Lambda Amazon EC2 Amazon RedshiftAmazon RDS Amazon EC2 Amazon EC2 Prod 1Dev Test Prod2 Prod 3 Prod 4 Owner Participant Owner Participant Participant Participant

82. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Amazon VPC owners are responsible for creating, managing, and deleting all VPC level entities. Amazon VPC owners cannot modify or delete participant resources. Amazon VPC Owner

83. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Participants that are in a shared Amazon VPC are responsible for the creation, management, and deletion of their resources including Amazon Elastic Compute Cloud (Amazon EC2) instances, Amazon Relational Database Service (Amazon RDS) databases, and load balancers. However, they cannot modify any Amazon VPC-level entities including route tables, network ACLs, or subnets (or view/modify resources belonging to other participants). Amazon VPC Participant

84. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Why use Amazon VPC sharing? Pre se rv e I P sp a c e U se f e w e r I Pv 4 C I D R s I n t e rc o n ne c tiv it y N o V PC Pe e ri n g re q u i re d B i l l i n g a n d S e c u r i t y C o n t i n u e t o e n j o y s e g r e g a t i o n w i t h m u l t i p l e a c c o u n t s S e p a r a t i o n o f d u t i e s A c e n t r a l t e a m c a n c r e a t e a n d m a n a g e y o u r A m a z o n V P C S a m e A Z c o s t f o r d a t a t r a n s f e r i s n i l !

87. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T NAT InstanceB 10.1.1.11/24 Instance BNAT-GW NAT-GW 0.0.0.0/0 AWS Region Availability Zone 2Availability Zone 1 Private subnet The internet Private subnet Public subnet InstanceA Public subnet Amazon S3 VPC CIDR 10.1.0.0/16 10.1.0.11/24 InstanceC 10.1.2.11/24 InstanceD 10.1.3.11/24 + Expand + IPv6 IGWVPCE 10.1.0.0/16 Local 0.0.0.0/0 IGW S3.prefix.list VPCE-123 Destination Target 10.1.0.0/16 Local DDB.prefix.list VPCE-123 Destination Target EIP - 10.1.0.11 : 54.23.12.43 EIP - 10.1.1.11 : 54.19.12.23 Amazon DynamoDB VPCE = Virtual Private Endpoint (Type: Gateway)

89. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Amazon API Gateway AWS CloudFormation Amazon CloudWatch Amazon CloudWatch Events Amazon CloudWatch Logs AWS CodeBuild AWS Config Amazon EC2 API Elastic Load Balancing API AWS Key Management Service Amazon Kinesis Data Streams Amazon SageMaker Runtime AWS Secrets Manager AWS Security Token Service AWS Service Catalog Amazon SNS AWS Systems Manager NAT InstanceB 10.1.1.11/24 NAT-GW AWS Region Availability Zone 2Availability Zone 1 Private subnet Private subnet Public subnet InstanceA Public subnet VPC CIDR 10.1.0.0/16 10.1.0.11/24 InstanceC 10.1.2.11/24 InstanceD 10.1.3.11/24 + Expand + IPv6 22+ services now supported over AWS PrivateLink ec2.eu-west-1.amazonaws.com ENI1: 10.1.0.15 ENI2: 10.1.1.23 ec2.eu-west-1.amazonaws.com ENI1: 10.1.0.15 ENI2: 10.1.1.23 AWS PrivateLink can reach public services, privately from your VPC No routes needed! (almost) 10.1.0.0/16 Local Destination Target 10.1.0.0/16 Local Destination Target + More

92. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T And now, AWS PrivateLink for service providers Customer VPC Service Provider VPC Application, e.g. SaaS NLB AWS PrivateLink VPC Endpoint: vpce-2222.foo.amazon.com

98. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Client StateAWS’s Global Network Static Anycast IP’s Applications can keep state, with connections routed to the same endpoint, after initial connection Traffic routed through Accelerator traverses AWS global network (instead of the public internet) Global Accelerator uses Static IP addresses are a fixed entry point to your applications. These IP addresses are anycast from AWS edge locations

101. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T NAT InstanceB 10.1.1.11/24 Instance BNAT-GW NAT-GW 0.0.0.0/0 AWS Region Availability Zone 2Availability Zone 1 Private subnet VGW VPC Peering VPC Flow Logs VPN The internet Private subnet Public subnet InstanceA Public subnet Amazon S3 VPC CIDR 10.1.0.0/16 10.1.0.11/24 InstanceC 10.1.2.11/24 InstanceD 10.1.3.11/24 DXGW + Expand + IPv6 IGWVPCE 10.1.0.0/16 Local 0.0.0.0/0 IGW S3.prefix.list VPCE-123 On-premises VGW VPC-B PCX-123 Destination Target Intra or Inter region 10.1.0.0/16 Local S3.prefix.list VPCE-123 On-premises VGW VPC-B PCX-123 Destination Target AWS PrivateLink Service Provider VPC NLB On premises VPC-B EIP - 10.1.0.11 : 54.23.12.43 EIP - 10.1.1.11 : 54.19.12.23 Amazon DynamoDB AWS Lambda AWS Direct Connect Amazon SQS Amazon SNS AWS IOT Amazon CloudWatch AWS PrivateLink Transit GW Onpremises AWS PrivateLink Enabled Services Other Routes TGW Other Routes TGW Amazon S3 AWS Global Accelerator

Fundamentals of AWS networking - SVC303 - Atlanta AWS Summit

Esté a ler uma amostra.

Confira estes a seguir

Fundamentals of AWS networking - SVC303 - Atlanta AWS Summit

Mais Conteúdo rRelacionado

Diapositivos para si (20)

Semelhante a Fundamentals of AWS networking - SVC303 - Atlanta AWS Summit (20)

Mais de Amazon Web Services (20)