‫Okay, so now let's talk about
‫how we can establish connectivity between VPC
‫and other structures.
‫So, the first thing is called VPC peering.
‫So say you have two virtual private clouds,
‫they're either in two different accounts
‫or in two different regions,
‫and you wanna connect together as if they're
‫part of the same network.
‫So we want to connect to VPC, privately
‫using V network from AWS.
‫And it's going to make them behave
‫as if they were in the same network.
‫So we have VPC A and VPC B,
‫and if you want to have them talk to one another,
‫we need to establish a VPC peering connection from A to B,
‫very simple.
‫To make sure that these VPC can be connected,
‫you need to make sure that the IP ranges,
‫that is defined for each VPC are not overlapping.
‫Because to be able to address network to another VPC,
‫you need to talk to an IP address,
‫and so if obviously the network ranges overlap,
‫then the network doesn't know where to go.
‫So to connect to VPC,
‫you need to make sure that the IP addresses range
‫it operates on are different and not overlapping.
‫And VPC peering connection is not transitive,
‫so it must be established for each VPC
‫that needs to communicate with one another.
‫What I mean is that, if we connect VPC C,
‫through a VPC peering connection between A and C,
‫B and C cannot talk to each other,
‫there is no transitivity in the VPC peering.
‫That means that if I want to establish connectivity between
‫VPC B and VPC, then I need to create
‫its own VPC peering connection between B and C.
‫That's what it means for VPC peering
‫so, as you add more and more VPC,
‫you need to add more and more peering connections.
‫Okay, that's number one.
‫Number two, VPC Endpoints,
‫which is going to be very important going into this exam.
‫So, Endpoints allow you to connect to AWS services,
‫using a private network
‫instead of using the public Internet network.
‫So something you maybe didn't know is that
‫all the AWS services are public, okay,
‫and so anytime your EC2 instances, for example,
‫use VAWS services, they talk publicly to AWS,
‫but sometimes your EC2 instances
‫are not connected to the public subnets,
‫and therefore you want to have them access privately
‫your AWS services, so this is the VPC Endpoints.
‫So this gives you enhanced security
‫and lower latency to access AWS services.
‫So let's take an example,
‫We have a private subnet and an EC2 instance in it,
‫and he wants to access Amazon S3 and DynamoDB,
‫which are outside of the VPC into the public realm.
‫Then we can create a VPC Endpoint gateway,
‫and this is only for S3 and DynamoDB.
‫So, Endpoint gateway and we'll see what S3 and DynamoDB
‫are in this course obviously, that's up.
‫You're EC2 instance, talks to that VPC Endpoints
‫and has access to S3 and DynamoDB privately,
‫as you can see the traffic does not go through
‫the Internets.
‫And then, for the VPC Endpoint interface,
‫that's the rest of the service,
‫and it's only used within your VPC,
‫so that means that we can create, for example,
‫a VPC Endpoint interface in your private subnet
‫and through that invoice interface with an ENI
‫we have private access to CloudWatch.
‫So VPC Endpoints are really, really helpful
‫anytime you need private access from within your VPC
‫to an AWS service, Okay, that's what you need to remember.
‫The other exams need to know
‫the difference between gateway and interface,
‫I don't believe you need to know it
‫for the certified developer exam,
‫but know that anytime the exam is asking you
‫to privately connect to an AWS service,
‫then VPC Endpoint is going to be the way.
‫Okay, so now, how do we establish connectivity
‫between your On-premises Data Center,
‫so that could be your office building, for example.
‫and your cloud VPC.
‫So the first way it's called Site-to-Site VPN,
‫to connect an on premises VPN appliance to AWS,
‫the connection will be automatically encrypted,
‫and will go over the public Internet.
‫So in this example,
‫we establish a VPN Virtual Private Network
‫between your On-premises Data Center
‫and your VPC and that goes over the public Internet.
‫That's very easy to set up very quick,
‫You can set up in matter of minutes
‫and there you go, you have a private connection
‫or an encrypted connection sorry,
‫over the public Internet to your VPC.
‫The other option is direct connect.
‫It achieves the same purpose,
‫it's to establish a connection between
‫your On-premises Data Center and your VPC,
‫but this time, it is a physical connection.
‫So that means that the connection is going to be private
‫it will not go over the public Internet,
‫is going to be secure and fast.
‫And it goes over the private network,
‫and because it is a private line to your VPC,
‫it takes at least a month to establish
‫because there is some work that needs to happen
‫to have a private connectivity to AWS.
‫So, this is called direct connect
‫and this is the private route.
‫So we can see, both the VPN and Direct Connect
‫achieve the same purpose, but with different manners
‫and different timeline.
‫Note, that if you use site-to-site VPN,
‫or Direct Connect, both these things cannot access
‫the VPC Endpoints that we've discussed from before, okay,
‫VPC Endpoints are just to access AWS services privately
‫within your VPC, not by connecting your
‫On-premises Data Center.
‫which is something you should be aware of
‫going into the exam.
‫Okay, so that's it for connectivity of your VPC
‫in terms of external VPC peering
‫VPC Endpoints such as VPN and Direct Connect,
‫I hope that was helpful
‫and I will see you in the next lecture.