Hey, everyone, and welcome back.
Now in today's video, we are going to discuss about VPC sharing in a class now at a high level overview.
VPC sharing allows multiple accounts to create their application resources, such as AC two instances,
ARDS and others into a centrally managed VPC.
So this can be better explained with this diagram.
On the left hand side, you have the account one, on the right hand side you have the account two.
Now account one has a specific private subnet where there are multiple set of easy to instances lambda
function and so on.
So using the VPC sharing feature, this specific private subnet can be shared to the account too as
well.
And the account too can also create the resources like AC two instances, lambda function, etc. in
this private subnet itself.
And since this is one single subnet, the easy two instances that are part of the subnet will be able
to communicate with each other privately as well.
So let's do one thing before we proceed further.
Let's go ahead and look into it practically now before we start with a practical.
So one thing to notice that this specific feature of VPC sharing is achieved using the resource access
manager.
So for today's video, I have two tabs that are open associated with a resource access manager.
One is associated with account, one, second is associated with the account.
Two Now in the Resource Access Manager documentation associated with shareable resources, there are
multiple resources that are available.
We are more interested into the VPC section and within here you have a column associated with can share
with accounts outside its organization and many of the resource types are know and IT states can share
this only within the address accounts within its own organization.
So if you go a bit down within the subnets, again it states can share with only eight accounts in its
own organization.
So you will not be able to share these subnets to the address accounts that are not part of the organization.
This is something to note when we discuss about Prefix List.
Prefix List it says can share with any accounts.
So whenever you want to share a resource through the Resource Access Manager, always verify to whom
it can be shared with.
Now for today's video, I have two tabs available and in both of them I have resource access manager
service open.
Now these two tabs are associated with two accounts.
First step is going to be the account, one where we'll be creating a subnet and then we'll be sharing
that subnet with the account two, which is based on the second tab over here.
So let's go ahead and quickly create a resource share.
Now, when you create a resource share and the resource type is subnets, you will see that there are
no subnets that are appearing over here.
And the primary reason for this is that the default VPC cannot be shared.
So what you'll have to do is you will have to create a custom VPC with a custom subnet and you can share
that resource type.
So let's do one thing first.
Let's go ahead and quickly create a new VPC.
So I'll create a VPC.
We'll be using this new VPC, create experience over here to quickly create a VPC for us.
And within the availability zone is one, public subnet is one.
No private subnets are required, no VPC endpoint is required.
So at the end we'll have one VPC with one subnet and that is quite good enough.
Once then you can click on Create VPC.
Great.
Our VPC is now created.
So let's quickly go back to the Resource Access Manager.
And within the source access manager.
One thing as we had seen for the subnets that it can only be shared with the accounts that are part
of your organization.
So one of the prerequisites here would be that you need to have the organization set up.
In fact, let me also quickly show you this.
I'll open up the organization console and you see I have organization that is available here.
So this is one of the prerequisites.
Once you have organization setup, you have to go to settings and you have to ensure that this enable
sharing with this organization is selected.
If it is not selected, just click here and click on Save Settings.
This is one important part to remember.
One of the primary advantage here is that you can share the resource without having to send and accept
the invite.
Otherwise, if you select another account that is beyond the organization's scope or the database,
account will have to accept that invite and so on.
And again, some resource type will not be able to share with accounts that are beyond the aid of this
organization.
So this is the second prerequisite.
Once this is done, you can go ahead and go to resources, click on Create Resource Share, let's call
it as public subnet share.
This time you will see that our subnet is appearing will select this.
Let's go a bit down.
Let's click on next.
So these are the associated permission.
We'll just click on next here.
And within this time you'll have to click on allow sharing only within your organization and within
what you can do.
You can click on either organization, you can display the organizational structure and you can select
one of the accounts, or there are multiple accounts.
Make sure you do not select the account where the subnet is already present because that will fail.
So I will select one of the accounts here that are part of my organization.
Once this is done, you see that it is also appearing within the selected principles.
I'll click on next within the review and Create will go a bit down and we'll click on Create Resource
Share.
All right, so once the resource share is created, always verify the status it is.
Associated, associated, associated.
Everything is green.
Sometimes you'll also see a red.
That means there are some mistakes that have been done.
Once this is done in the account too, if you go to the resource shares over here, you should see that
you have one share that is available.
So from the account two, let's go to the VPC console and see if we are able to see the shared VPC from
account one.
So at this stage, you see there are two pieces that are appearing.
Let's quickly go to the VPC here and this is the VPC that was shared.
If you'll quickly open this up, you see, this is the key idea.
And within this VPC, you can go ahead and create the resources.
Now, also note that one quick way to identify which is the shared VPC generally the VPC that is local
to the account, you will be able to perform a lot of operations like delete, VPC and so on.
But the shared VPC, this VPC, since it is shared to this account, you will not be able to perform
those operations related to delete VPC and so on.
All right.
So the permissions are restricted to the account that the VPC shared.
So once the VPC shared, let's quickly go to the EC2 service.
Will quickly launch a new instance in the name I'll account to.
Easy to highlight once this is done, let's go a bit down.
You can select the key name in case.
If you do not have a key, you can proceed without a key pair as well.
Let's go a bit down in the network settings here.
Let's quickly use the shared VPC area and there is only one subnet, so we'll use this one and auto
assign public IP in case if you'd like.
You can do that.
I'll just avoid it for the time being.
I'll click on launch instance.
Great.
Let's quickly open this up and you see our instance data is now running.
Now similarly in the account one as well, we'll go ahead and quickly create a new easy instance.
So I'll go to the easy to service.
Let's launch a new instance and then name.
I'll say account one.
Easy two will go a bit down.
We'll select the appropriate keeper in case if you have it, in case if you do not have, you can proceed
without keeper.
Within the network settings, you can click on edit.
You can select the custom VPC and you only have one subnet in case if you want to connect, you can
also assign a public IP associated with it.
And once this is, then you can launch the instance.
Great.
So let's quickly open this up.
And within our account one, AC two is running and is in the initializing stage.
And just to verify the subnets of both the AC two instances, you can quickly do that.
You can go a bit down.
You see the subnet ID ends with ADC and the instance in the account too as well if you will verify the
subnet.
Let's go a bit down.
It is also ending with ADC now from our account to one ESI two.
Let's go ahead and quickly connect to the instance from this easy to instance, we'll go ahead and try
to ping the account to AC two to verify if the connectivity is working.
So the private IP is ten 041 85.
So I'll say ping ten .0.4. 185.
At this stage, the ping is not really working.
This might primarily because of the firewall.
Let's go to security.
There is only one port that is allowed.
Let's open up the security group here.
We'll edit the inbound rules.
We'll add a new rule.
We'll say all traffic allowed from the VPC idea of ten.
In fact, let's quickly verify what was the exact idea.
So let's quickly go back to the VPC console.
So the the idea was ten 000 slash 16.
So I'll add it accordingly.
I'll say ten 000 slash 16.
All right.
I'll click on Save Rules.
So now from our terminal, you see the connection is working perfectly well and we are able to ping
the instance.
Let's do a control.
See?
Great.
So I hope with this you understood the basics of VPC sharing.
Now before we conclude, there are a few important things to note.
First one is that the VPC owners are responsible for creating, managing and deleting the resources
associated with the shared VPC.
So this resources includes subnets, root tables, network, ACLs and others.
This is something that we have seen that in the account.
Number two, when we tried various options like delete VPC, they were not really appearing, so only
the account owner will be able to delete the VPC.
Second is the VPC owner cannot modify or delete the resource created by the participants such as AC
two instances and Security Group.
For example, in the account.
Two, If someone creates the AC to instance in this shared subnet, the admin from account number one
will not be able to terminate them.
This is the second point and the third pointer as we have already seen, that the default subnets cannot
be shared.
Great.
So that's the high level overview about VPC sharing.
And with this will conclude today's video.