Instructor: Okay. So now let's have a look at
VPC endpoints.
So let's consider Amazon DynamoDB as a service.
So Amazon DynamoDB is a public service on the AWS.
And so therefore, your instances can access DynamoDB
directly through the public web.
So, an Institute instance in a public subnet, for example,
can talk to the internet gateway,
the internet gateway will route the request
to the public endpoint of DynamoDB.
And this works fine.
And if you want to have a private instance,
it could go through the NAT gateway,
then through the internet gateway,
and then to DynamoDB, this works fine as well.
But these services in AWS,
you know, they live within the AWS cloud.
So there should be a better way of accessing them,
which you access them privately.
And the answer, our VPC endpoints.
So VPC endpoints are private endpoints within your VPC
that allow you to initiate a private connection
to the AWS services.
So for example, here in my private subnets,
my EC2 instance can connect to the EC2, VPC endpoints
and then to CloudWatch or Amazon S3,
or whatever you want using a VPC endpoint.
But all this without traversing the public internet.
So, how does that work?
Well, if we consider VPC endpoint also,
they're called private link.
They're powered by private link.
So let's consider SNS again.
So we have two ways of accessing Amazon SNS
just to make sure you really understand.
The first one is to go through a NAT gateway.
So from a private subnet to a NAT gateway,
to an internet gateway, to Amazon SNS,
which costs you a lot of money because the NAT gateway has
an hourly cost and then you need to set it up and all goes
through the public internet.
So there is definitely not the best network performance or
the option Two, is to create a VPC endpoint
and then connect your EC2 instance, with the VPC endpoints,
all the way to Amazon SNS
and all the traffic stays private within the network of AWS.
So all services in AWS have a public URL, right?
But the VPC endpoints will allow you
to connect to these services using a private network
instead of using the public internet.
They're redundant and the scale horizontally,
So there is no scaling concerns to have.
And they remove all the need to have an internet gateway or
NAT gateway to access AWS services,
which can be some good cost savings.
In case of issues with VPC endpoints,
you need to make sure that DNS setting resolution
in your VPC is activated,
and also check the route tables in your VPC
because you must modify them as we'll see in the hands-on
to make this work.
So there are two types of endpoints in AWS.
There is the interface endpoints,
and there is the gateway endpoints.
So the interface endpoints will provision an ENI.
An ENI is an elastic network interface,
hence the name interface endpoints.
And an ENI is a private IP address.
And then this IP address will be an entry point into
a service of AWS.
So because it's an ENI,
then you must attach a security group
and ENI supports most AWS services.
So let's take an example.
Here, we have Amazon SNS.
We're going to create a VPC endpoint of type interface,
which is going to create an ENI within our private subnets.
And then our EC2 instance can connect to the ENI
if the security groups, rules allow,
and then from the ENI to Amazon SNS.
So this is cool because here the security is using
security groups and you just need you to make sure that,
you have control over the security groups
to access Amazon SNS.
Now gateway endpoints, provision a gateway.
And these gateways are a bit more complicated because they
must be used as a target in a route table.
And gateway endpoints where only two services
you need to remember,
they support Amazon S3 and DynamoDB.
That's it.
So in the gateway endpoints,
then the VPC endpoints needs to be routed
from the private subnets and then into
Amazon S3 or DynamoDB.
And we'll see how to do this in the hands-on
in the next lecture.
So that's it for this lecture.
I hope this makes sense,
and this should make a lot more sense in the next one.
So I will see you in the next lecture.