What is an EIP?
An Elastic IP address is a static IPv4 address designed for dynamic cloud computing. By using an Elastic IP address, you can mask the failure of an instance or software by rapidly remapping the address to another instance in your account. An Elastic IP address is allocated to your AWS account, and is yours until you release it.
An Elastic IP address is a public IPv4 address, which is reachable from the internet. If your instance does not have a public IPv4 address, you can associate an Elastic IP address with your instance to enable communication with the internet. For example, this allows you to connect to your instance from your local computer.
What is a VPC endpoint (vpce)?
An endpoint allows instances in a subnet to access services outside the subnet. These services are either AWS services such as a S3 or Dynamodb or other services you may have created yourself.
What is an Internet Gateway (igw)?
An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet.
An internet gateway serves two purposes: to provide a target in your VPC route tables for internet-routable traffic, and to perform network address translation (NAT) for instances that have been assigned public IPv4 addresses. An Internet Gateway allows resources within your VPC to access the internet, and vice versa.
What is a NAT gateway?
You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the internet or other AWS services, but prevent the internet from initiating a connection with those instances.
It allows resources in a private subnet to access the internet (think yum updates, external database connections, wget calls, OS patch, etc). It only works one way. The internet at large cannot get through your NAT to your private resources unless you explicitly allow it.
- Security Groups cannot be associated with a NAT Gateway
- You’ll need one in each AZ since they only operate in a single AZ
How many IGWs per VPC?
Only one can be associated with each VPC
How many NAT gateways in a Region?
One per AZ - for redundancy
Relationship between a VPC/IGW/NAT/SUBNET?
An IGW is per VPC and it allows internet traffic to and from the VPC.
A NATGW is deployed in a public subnet inside the VPC
Instances in the public and private subnets can route traffic to the NATGW from their respective subnets
The NATGW routes traffic to the Internet via the IGW attached to the VPC
NATGWs are AZ resilient - HA inside an AZ (but if whole AZ fails then it would fail)
What is a Route table?
A route table contains a set of rules, called routes, that are used to determine where network traffic from your subnet or gateway is directed.
- Your VPC has an implicit router
- Each subnet in your VPC must be associated with a route table
- You can explicitly associate a subnet with a particular route table, otherwise, the subnet is implicitly associated with the main route table.
- A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same subnet route table.
Difference between IGW and NATGW?
- IGW allows trafficto be initiated from the internet into your VPC and vice-versa, by default
- NATGW allows traffic to be initiated only one way - from subnet to Internet - not the other way round
What CIDR notation should you choose when creating a VPC?
- A large enough address range to support the needed subnets
- Any CIDR range between /16 and /28 can be chosen.
source: LinkedIn Learning
Can subnets span AZs?
No
Can VPCs span AZs?
Yes - since VPCs can comprise of multiple subnets and each subnet could be in its own AZ theoretically.
Source: myself
Manage by DNS - explain this?
Do not be IP-aware, rely on DNS as much as possible.
Source: LinkedIn Learning
What is a Transit Gateway?
AWS Transit Gateway connects VPCs and on-premises networks through a central hub
What is the difference between NACL and Security Groups?
- NACLS has explicit ALLOW and DENY rules and are stateless
- SGs DENY everything by default, needs ALLOW rules
- SGs evaluate all the rules in them before allowing a traffic whereas NACLs do it in the number order, from top to bottom.
- NACLs are used where resources are not involved and subnets are involved
- When SGs are supported on a resource use SGs (reduces number of rules and complexity)
What is a Security Group?
- They are firewall rules attached to an instance (ENI)
- They can only ALLOW and not explicitly DENY traffic. - Anything not ALLOW’ed is DENY’ed.
- Separate INBOUND and OUTBOUND rules can be specified.
- They are stateful - if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules.
- Responses to allowed inbound traffic are allowed to flow out, regardless of outbound rules.
- Security group rules enable you to filter traffic based on protocols and port numbers.
How many SGs per instance?
Can have up to 5. Can be increased upon request.
What is VPC Peering?
- A way to connect two VPCs
- is not transitive (A->B, B-> C does not imply A->C)
What is a Gateway Endpoint (GWE)?
A private connection between a VPC and an AWS resource like S3 or DynamoDB. Only S3 and DynamoDB use GEs. All other AWS services use Interface Endpoints.
What is AWS PrivateLink?
AWS PrivateLink provides private connectivity between VPCs and services hosted on AWS or on-premises, securely on the Amazon network. By providing a private endpoint to access your services, AWS PrivateLink ensures your traffic is not exposed to the public internet
What is an Interface Endpoint?
An interface endpoint is an elastic network interface with a private IP address from the IP address range of your subnet. It serves as an entry point for traffic destined to a supported AWS service or a VPC endpoint service
It is not HA since it is associated with the subnet unlike a GWE which is HA and associated with the VPC, so put IEs in every AZ you have
IEs use DNS, not simple routing (like a GWE) to resolve to the private IP of the IE which then routes the traffic to the AWS service you are trying to reach to
What is a Virtual Private Gateway (VPGW)?
The VPN concentrator on the Amazon side of the Site-to-Site VPN connection. You use a virtual private gateway or a transit gateway as the gateway for the Amazon side of the Site-to-Site VPN connection.
What are Flow Logs?
It is for capturing networking traffic metadata in your network, they don’t capture data (ie not a packet sniffer)
- Apply them at VPC level
- apply at subnet level
- NIC level
- not real time
- can be used to log to S3 or CW
What does enableDnsHostnames do?
If set to true, gives instances DNS names
