In this video, we're going to learn about two new components
called security groups and internet gateways.
A security group is like a traffic cop that controls the inbound and
outbound of network packets. For example, you can
set a rule that allows SSH connections into
your Linux virtual server.
Security groups are also stateful. This means
they only allow traffic from already established connections.
Because security groups control inbound and outbound traffic
you can use allow and deny rules to give you
a finer grain control when securing your instance.
Internet gateways are a highly available AWS
resource that enables internet access for your
VPC.
You only need one internet gateway per VPC and
a support both ipv4 and IPv6 addresses.
Our plan is to look at the security groups in a gateways
inside the AWS console.
We will go over where they are at how to
find them and what attributes they possess. Once we
were done in the browser. You will head back over to your
terminal and will open up the security group and internet gateway terraform
files.
Our goal like before is to put together what
we learn in the AWS console and how it maps to our infrastructure
files.
Okay, let's get started.
Okay back in the AWS console and our security
group and our internet gateway are
both under the VPC umbrella like our other components. So we
are going to just go over to VPC here.
Click it go to the main VPC page, which you
should be familiar with by now and if we
look down here on the left bottom pain, we can see security groups right
under the security tab. I'm right on the security drop-down and
so give that a click.
Okay. So here we are on the security groups overview page. This
has all the security groups that are in this account right
now. There's only one because it's the default one that Amazon created
when our account was set up. So this is
our default Security Group. You can think of it that way.
So if we start over here, we have our details tab.
We have inbound rules outbound rules and tags.
The Details page here is a little bit bear not much
really going on except you can see the security group ID and it's
the default VPC Security Group. That's probably that's
all really important here on this front page when we
get into it. Let's get into the inbound rules and up on rules where I think it's a little
bit more interesting.
A rule has these attributes laid out here and their name is
a security group.
Let me why this so it's easier for everybody to see here. This
is a security rule ID IP version type protocol
Port range and a source.
so
to have a inbound rule you must complete some
of these things and obviously you can see IP IP version
is not filled out. That would be the ipv4 IPv6.
There's no name because it's
the default one and here the type is all traffic.
The protocol is all meaning TCP or UDP.
And the port range is all meaning any port that
is coming into this as
long as this source of the packet is
coming from this Security Group. So with this basically
does it says any virtual instances that are associated
with the security group. They could pass traffic
back and forth to each other so inbound traffic
can come to them from only within the security group.
So let's go over and click over here. Before we go
look at outbound rules. If you needed to make any edits to
this any of the rules, you can go over here
and click the edit inbound rules as well as if
you were creating a new Security Group, you can use the orange
create button at the top like we have any other components and
then the delete or edit onto
the actions dropdown. Okay without the
way let's go back to outbound rules.
So the outbound rules meaning any packet that
is leaving the security group heading somewhere else.
That's what these rules govern and as you can see here, the
rule is just like the inbound rules has the same attributes. You
need except this one. You can see that we
set ipv4 is in the IP version. This
is being explicit saying that any ipv4
packet.
any type of traffic
any protocol TCP UDP and any port range if
it's headed for our 0.0 / 0
destination, which is that catch all meaning
anywhere out in the internet.
Will allow this rule allows this to happen if this
rule wasn't here then outbound would not happen. And so
if you were on your virtual instance, there was no outbound rule
for your Security Group. You would not be able to go out and let's
say run your package update on Lennox. So
if you're on Debian or Ubuntu you would run app get update it would not
work because your virtual instance would not be able to head out.
All right. So there's a quick brief overview of
security groups in the AWS console. Obviously,
we're gonna create our own a little bit later, but I
wanted you to get a good view of it as when we
get to terraform files. We'll see some of where this comes into play. Okay
from here, let's jump over internet gateways
and it's if you go back over the left pain, you'll see internet gateways here.
Let's go ahead and click it and go to internet gateways and
this is gonna be probably the most plain
component. We're gonna look at
Because it really isn't much going on here Amazon really
obvious skates, a lot of what's going on behind the
scenes. So there really isn't many options or many settings
we can play with here. So but if you look the internet gateway ID
igw Dash the characters just like
the other components we can see here. The state is
attached meaning that it's it's running on in
for this VPC and you can see the VPC ID, which
is the default VPC that Amazon created for us that's really
about it to talk about internet gateways except for
the main point is that you need an internet
gateway in your VPC. If you want your virtual instances
to be able to get out to the internet without
that they do not know how there's no route. There's
no way for them to get out to the Internet. So just
keep that in mind. If you ever do this without terraform you're
doing this by hand you obviously just like all the
components you have your create internet gateway button up
here. You also have the drop down where you can manage or
delete or detach this internet gate.
All right, so that is going to be cover our brief overview
here in the AWS console for both the
security group in a Gateway. Let's go ahead and jump back in
the terminal and then let's go look at the terraform files that
make this up and we'll start to be able to piece together some of
these options you see in the console versus what we see in
the terraform file.
Okay, so we're still in this lab terraform subdirectory.
Of the cloned repository in the prerequisites. So
make sure that you obviously have that still we're
gonna open up our first file which is security underscoregroup.tf.
And let's go inside. So as you can see this resource
from line two to line 33 is a lot larger than
the other resources that we've worked with so far and this is
because this multiple options for these inbound and outbound rules.
You can obviously have many rules to one one
Security Group and so here
we've got two inbound and one outbound
and we'll go over those in a second but
Same resource declarations. You've seen in others except here.
Obviously, we're using the security group library to create a
security group.
I called this resource allow SSH and HTTP.
No reason for that except I
wanted to be descriptive of what ports were actually opening up into
our instance.
Same thing here with lines three and four just the name and description.
As always we go to associate this network component with
the VPC. We want it to be in.
Okay, so line 7 through 12 controls our egress or
this is our outbound and what the front
port and 2 Port online 89 do it basically
says whatever Port is coming from the packet
is originating from and what?
Port the packet wants to go to
with the zeros here. We're just saying we don't care any
port is okay for this rule.
The problem line 10 the protocol which is
negative one means.
All protocols TCP UDP, it doesn't
matter.
and here again online 11, you see
the cider blocks and you see the string representation of the
0.0 / 0 that we've seen multiple times now, which
represents
any address all addresses basically not
in the VPC. And so what this
egress rule basically says, like what we talked about in the
review in the console is that
any packet destined on
one of the virtual service that's destined for out on the internet allow
that to happen. And you know, of course we want that's
a good thing.
So let's talk about the two Ingress rules here
and Ingress means inbound. So right now
you can see lines 14 and through 20
and 22 to 20. They're very similar right except
for the descriptions and the front port and
2 Port so here in SSH because
we want to be able to SSH into our
virtual instance once we spin it up because in other
videos we're gonna actually run some do some tasks and talk about
Administration and other Cloud native stuff on
that host. So we need to be able to get into the host
and that's what this Ingress rule does.
It allows us to SSH into this host on
the TCP protocol since that is obviously what
SSH uses and line 19's. Probably
one quick note here. We're using the zero dot
zero slash zero string representation here of
any IP address.
And that is okay for this demo or lab, but if you had something
more secure or time or sensitive you might want to put an
IP address in there that you know of and then that way that would
lock this down to say only allow an SSH connection
from a specific IP address to this VPC.
And so that's important to note. But obviously
like I said for this demo lab, we're completely fine.
Okay, so the second Ingress rule what we're doing
here is the front port and two port instead of 22. We're
doing Port 80 and if you're familiar with Port 80,
it is the common HTTP port and this
will use this in a later section, but
I wanted to get it in here now, so we didn't have to go back and
do it. Once we had everything set up. Obviously HTTP
uses the TCP protocol and
here online 27 when we do the Zero from
any IP address, this is okay because we want anybody to
be able to hit this web service or whatever. That's what's
running on this other end on Port 80.
The next thing we should get to is the tags and
the name as we always do we want to give them something memorable
and for us to remember be able to identify and
here we just do name and then we do the same thing that we
kind of did for the name in the description above that is
our security group. We can
go ahead and close this file and get out of it.
So let's go ahead and look at the internet gateway.
terraform file igw.tf
and we'll open that up. And as you saw in the
idea was console. It's pretty bare. Like it was up there.
There's not many options here. The biggest thing it has
to be associated with the VPC and line three does that
for us? I named this just lab igw and
you can see we set our name tag as well. So all
right, we'll move on from this file as
well. Go ahead and close that now we're done here.
Okay, so we're done with the looking at the terraform files for
for these two file for these two components. So let's go
back over and let's just do a recap of what we've done
so far.
All right. So in this video you learned about
security groups and some of its features like being able to allow or
deny traffic to an ec2 instance.
You also learned how internet gateways provide access to the internet.
You also learned how internet gateways provide access to the internet and its
relationship within a VPC.
Finally, we looked at both the terraform
files that would create your security group and your internet gateway for
your lab.
in the next video, you will learn all about the final component in
our Cloud lab called elastic cloud computing or
better known as ec2. Alright. See you soon.