Welcome back to Backspace Academy. In this lecture on virtual private cloud or 2
VPC we're going to build on what we already know about VPC so we've 3
launched an ec2 instance inside of a VPC we've done that before 4
so now we'll look at the different options that are available for us for 5
connecting into that VPC well then look at how we can make sure that if we're 6
running a web server on ec2 how to make sure that that is actually accessible 7
over the wider Internet and finally we'll finish up by talking about the 8
security features of virtual private cloud. Here we have a diagram of the AWS cloud 9
and as we know the AWS cloud is divided up into multiple regions 10
across the globe and we also know that each one of these regions is divided up into 11
availability zones and those availability zones are physically isolated 12
from each other and what that enables us to do is that we can 13
distribute our our architecture across multiple availability zones and by doing 14
that we are going to achieve high availability because you've one 15
availability zone goes down the other availability zone will continue to 16
operate and our infrastructure located in that availability zone will continue 17
to operate as well we also know that the number of 18
availability zones in regions varies, US East has a lot of them whereas Mumbai 19
has only a few, we should also know that we can create a virtual private cloud 20
within a region and that virtual private cloud is our own private space within 21
the AWS cloud now when we previously launched an ec2 server or web server and 22
we had the WordPress application on that that was launched within the default VPC 23
we didn't create that VPC and so every time an account is created a 24
default VPC in each region is also created for us we don't have to worry about that 25
but we can also create additional virtual private cloud so we can have 26
additional private spaces within the AWS cloud if we every desire and it is also 27
something that you should be doing because it does provide some very good 28
advantages from a security perspective we should also know by now that a VPC 29
contains a subnet and we need to have at least one subnet to launch an ec2 30
instance but we can have multiple subnets and we can have those in 31
multiple availability zones and by doing that we can launch ec2 instances into 32
multiple subnets across multiple availability zones and that means that 33
if one of those subnets goes down or availability zones goes down the other 34
availability zone and its subnet that contains those ec2 instances will 35
continue to operate and again when we did our WordPress application we 36
launched that into a subnet and that subnet was a default public subnet that 37
had been created for us by AWS previously but again we can create 38
additional subnets or additional VPC's and subnets if we so desire if we are 39
launching a web server for example if we're launching a WordPress application 40
and we want that to be accessible to the wider public on the Internet 41
we need to have an internet gateway at our VPC that allows that to happen and 42
that will be a scalable it's redundant and it's a highly available VPC 43
component so you don't need to worry about having multiple internet gateways 44
you just need to create an Internet gateway and you need to create a route 45
from that through to a subnet and we'll talk more about that in the next slide 46
if you're looking for a secure connection to your enterprise you can 47
set up a virtual private network and that will consist of a virtual private 48
gateway on the AWS side and it will consist 49
of a customer gateway on the customer side and that will create a VPN 50
connection and it's a dual tunnel connection so it has redundancy built in 51
there and so the VPG is the VPN concentrator on the Amazon side of the 52
VPN connection and the customer gateway is a physical device or software 53
application on the customer side of that connection so that's not the only two 54
options that we have for connecting to a VPC we also have AWS direct connect and 55
that is a physical fiber-optic high-speed connection from an enterprise 56
to AWS and it's normally used by large organizations that require very large 57
throughput through two AWS so there are a number of key requirements that we 58
need for internet connectivity so again for example we've got our WordPress 59
application that we're running on an ec2 instance and we want to make sure that 60
people on the Internet the wider internet not a private Internet can 61
access that ec2 web server the first thing that we need to make sure of is 62
that that ec2 instance has a public IP address so if it doesn't have a public 63
IP address it will not be found on the wider Internet so it means to have that 64
to be found the VPC must have an Internet gateway otherwise there is no 65
way for the wider Internet to connect to that VPC and finally we need a route 66
that is defined in a route table and that will define the route from the 67
subnet that our ec2 instance is inside to that internet gateway, 68
so we're not going to talk a lot about route tables but you just need to understand that for 69
that traffic to route through your V PC it needs to be defined otherwise it will 70
just not happen so we have a number of features 71
available within VPC to create high security so we have security groups and 72
they are firewalls and they operate at the instance level so we define a 73
security group for an individual instance and that is stateful so if 74
traffic and what what we mean by stateful and stateless stateful is when 75
traffic that comes in to an instance with a security group that return 76
traffic from that request is allowed if it's if it's not then that's called 77
state less but stateful it allows returned traffic from a request that was 78
allowed in through your infrastructure we also have network access control lists 79
and they can act as a second layer of defence, so if you don't touch them 80
then they will allow traffic in but you can also let them up as a second layer 81
of defence and they operate at the subnet level, so the network access control lists 82
will operate across all instances that are located within a 83
subnet and those are stateless so just because a request is allowed in doesn't 84
mean that the return from that request is allowed back out again so they are 85
stateless so you need to have both input and output control this set up and 86
finally we've got flow logs and they will capture information of requests 87
going in and out of your your VPC and that will be forwarded through to 88
cloudwatch logs which you can use for alerting you can use it for analysis as 89
well so let's have a look at that so we've got how our instances here in 90
subnet number one and they are referencing or associated to a security 91
group but if we look at subnet number two we can see that the we have multiple 92
security groups so those security groups they operate on the instance so if 93
you've got multiple secure multiple instances you can have multiple security 94
groups and so what that will do that group will allow requests to come in or 95
deny requester to come in but if the request is allowed in then the return 96
will also be allowed out and so that's what we mean by it is state form and it 97
operates at the instance level then we've got network access control lists 98
so if they're left alone they'll just allow traffic coming in and out but you 99
can set up deny and allow rules that will control that even further and it 100
provides a second layer of Defense for you but with network access control is 101
just because something is allowed in through an allow rule doesn't 102
necessarily mean that it is allowed back out again so it is stateless so if 103
something is allowed in we need to have another rule that allows it to come back 104
out again so all of this traffic needs to find its way from the internet 105
gateway through to the subnet and that is where the router comes in and so we 106
need to tell the router by putting an entry in our route table that defines 107
the route from our internet gateway through to our subnet and that's what we 108
talk about when we say a route table entry and without that we cannot have 109
Internet connectivity so that brings us to the end of this lecture on VPC it's 110
a very high-level one you don't need to go into a lot of detail being a either a 111
cloud practitioner or a developer you just need to know the high-level stuff 112
around a VPC and what you need for connecting to a VPC I look forward to 113
seeing you in the next lecture