Okay.
Hello loggers and welcome to this section of the course.
This section of the course is on VPC.
Now it is super important to understand BPC is inside out both in real life and going into your exam.
You're going to get at least five to 10 questions on V.P. C's as well as BPC architectures public and
private subnets et cetera et cetera.
Now the easiest way to learn BPC is to go ahead and build our own.
So that's what we're going to be doing in this section of the course.
Before you go and do your exam and I mean literally on the day of doing the exam or the day before doing
the exam you should be able to build out your own VPC from memory if you can do that.
Then you'll be able to pass the certified Solutions Architect associate exam.
So the question has to be asked what is a VPC.
And basically just think the VPC as a virtual data center in the cloud.
Amazon's virtual private cloud Amazon BPC lets you provision a logically isolated section of the Amazon
Web Services cloud where you can launch NWS resources in a virtual network that you define and you have
complete control over your virtual networking environment including selecting your own IP address ranges
creation of subnets and configuration of route tables as well as network gateways and you can easily
customize the network configuration for your Amazon virtual private cloud.
For example you can create a public facing subnet for your web servers that has access to the Internet
and then you can place your backend systems such as your databases your application servers in a private
facing subnet with no internet access.
So in doing that you web servers are exposed to the Internet but your sensitive application and database
servers are not exposed to the Internet and you can leverage multiple layers of security including security
groups as well as network access control list to help you control access to Amazon easy to instances
in each subnet and additionally you can create hardware virtual private no work or VPN connection between
your corporate data center and your VPC and leverage the adobe US cloud as an extension of your corporate
data center.
So why don't we go ahead and have a look at what a VPC looks like.
Okay see here's a diagram of a VPC so this red line represents a region.
So this is ust E1 and inside this region we have our VPC.
And on the outside of our VPC we have two ways of connecting into it.
We have an Internet gateway and a virtual private Gateway and both of these connections go to our router
or router in our VPC.
I'm going to call it router because that's what Americans call it and the router then directs traffic
to our different route tables and then our route tables will then direct traffic through our network
ACL so this is our first line of defense.
These also acts like firewalls very much like security groups.
But if you remember from the easy to spot of course we looked at security groups and they were state
for network ACLU a state list.
They allow you to do allow rules as well as deny rules and you can block specific IP addresses on your
network ACL.
We then move over to security groups which are state full and that acts as a further line of defense
against our easy two instances.
And then here we have two different subnets.
We have a public subnet so Internet traffic is accessible or the internet is accessible for any easy
two instances in our public subnet.
And then we have a private subnet.
And this simply means that our easy two instances cannot access the Internet on their own and you can
still connect into these easy two instances.
But the way you would do that is you would go through here all the way into your public subnet and then
you would assess Hage directly from an instance in here to an instance there.
So that's the way you would access it.
We're going to have a look at how that works and in Australia we call those jump boxes and the rest
of the world we call it bastion hosts so bastion hosts is just an easy to instance in a public subnet
that you then use to connect to NBC to instance in a private subnet.
So this is all a VPC is it's a collection of Internet gateways route tables network ACL security groups
easy to instances and then of course your public subnets and your private subnets.
Now you will note here this IP address is 10 dot o dot 1.0 and this one here is 10 dot dot 2.0.
So there are completely different subnets and the Internet Assigned Numbers Authority actually has three
different sets of IP addresses that are reserved for private IP address ranges.
So these are these are arrangers that are available on private networks they're not available on public
networks and the first is 10 dot dot dot.
Oh and this is a 10 slash 8 prefix.
Now Amazon don't allow slash 8 are the largest subnet that you can have inside of VPC is a slash 16
and will come and have a look at that in a second.
We then could also use the IP address range 1 7 2 sixteen dot dot.
This goes all the way up to 1 7 2 dot 31 dot 255 dot 255 this is a slash 12.
And then we have the most famous which you probably used to from your own home networks which is 1 9
2 1 6 8 0 0 0.
And this goes all the way up to 1 9 2 1 6 8 2 5 5 dot 255.
And this is a slash 16 prefix.
Now if you don't know what that means I want you to go over to your browser.
So this is a Web site I like to use it's called cider Dot.
X Y Z.
So if you just type this into your browser cider Dot.
X Y Z.
You'll be able to create subnets in here.
So if we're going to use 10 dot dot dot o and we're going to use a slash 16 straight away it's going
to tell us what our first ip address is what our last IP address is how many available IP addresses
that it gives us and also give us the subnet mask.
And we're going to be using this throughout the rest of the course because this is the largest subnet
that you can use within your VPC.
And it's also the most commonly used amongst corporate networks we're gonna use 10 dot dot dot sixteen
and then we'll go up for every subnet.
So this could be our public subnet.
And then 10 dot dot 1.0 could be our our private subnet et cetera et cetera.
Likewise you can go up here and change this to slash 24 and you can see the first ip the last IP and
then Hi how many IP addresses are available in a slash 24 subnet we can go all the way up to a slash
28 slash 28 is the smallest subnet that you're allowed to have within Amazon BPC and again you don't
need to understand any of this going into the certified solutions architect associate exam.
However going into the certified advanced networking specialty exam you will need to be able to do some
netting you'll be need to be able to calculate the first ip address the last IP address and then how
many IP addresses are in that subnet.
And we do cover up how to calculate these values in the certified advance networking specialty course.
So if you do have the time after doing a certified Solutions Architect associate and you really enjoyed
the BPC section definitely check that course and that certification out it is one of the most valuable
certifications in tech right now because it is one of the hardest to get.
So don't worry if this diagram still looks a bit scary like with anything with AWP is the best way to
learn it is to go ahead and start building out your own BPC and that's exactly what we're going to do
in the next lecture.
So what can we do with the VPC.
Well we can launch instances into a subnet of our choosing.
So we can choose our own subnet address ranges.
We're going to sign custom IP address ranges in each subnet which is what I just said we can configure
route tables between our subnets we can create Internet gateways and attach it to our VPC and we get
much better security controls over our AWOL resources and we can assign security groups to individual
instances but we can also have subnet network access control lists or AC ls as well.
And we're going to look at how we can use those and election coming up soon all the rest of the sections
of the course we have been using our default VPC and what we're going to do in the next lecture is we're
going to create our own custom BPC and you might be wondering what the difference is between default
BPC and a custom BPC.
Well the default VPC is super user friendly allows you to immediately deploy instances you don't need
to know anything about networking to be able to provision and easy to instance in the AWP as console.
So that's why Amazon give us a default BPC they're trying to make it easier for our developers to use
AWOL us and all subnets in a default VPC have a route out to the Internet.
That means they're all Internet accessible and each easy to instance has a both a public and private
IP address.
So those are the main differences if you do delete a default VPC you can recover it now so it's not
a problem if you do delete it try not to delete it though in the next lecture what we're going to do
is create a custom BPC we can also do VPC pairing which we're going to look at later on in this section
of the course.
This allows you to connect one VPC with another via down direct network route using private IP addresses
and instances behave as if they were on the same private network and you compare these pieces with other
AWB accounts as well as with other VPC is in the same account and pairing as always in a star configuration.
This means you have one central BPC that peers with for others you can't do transitive pairing you might
be wondering what does that mean.
You can also peer between regions as well now.
So you can have one VPC in one region and you can have another VPC in another region and you can peer
across regions.
So do bear that in mind as well.
So let's have a look at what transitive pairing means.
So let's look at VPC b c VPC CB is paired with VPC a.
So the instances in this VPC can talk to the instances in this BPC.
Likewise the instances in BPC can talk to the instances in the IPCC.
However in order for VPC B to talk to VPC C it can't go through VPC instead what you have to do is you
have to do a another peering connection directly between VPC b and v.
So transitive pairing just means you can't peer through one BPC to another.
You must set up a new peering relationship.
And again we're gonna have a look at VPC pairing in this section of the course.
So don't worry if this has overwhelmed you a little bit.
It's like anything with AWP as the easiest way to learn about VFX is to go ahead and create your own
and get your hands dirty.
That's what we're gonna do in the next lecture.
So just remember the following I want you to think of VPC as the logical data center in AWP as it consists
of WS so Internet gateways or virtual private gateways for VPN and then route tables network access
control lists subnets and then security groups one subnet always equals one availability zones to ten
dot dot 1.0 will be in us e one a for example 10 dot dot to dot o might be an us e one B etc. So to
be clear you cannot have a subnet stretched over multiple Availability Zones.
However you can have multiple subnets in the same availability zone.
So when we say 1 subnet equals one availability zone all they mean there is you cannot have one subnet
spread across multiple Availability Zones.
B can definitely have multiple subnets in one availability zone so I hope that makes sense.
Remember that security groups are state full and network access controllers are stateless that basically
just means with network access control list that you can add deny rules as well as allow rules.
And when you open up a port on inbound it doesn't automatically open up a port on outbound you have
to go in and add that in as well.
And also remember with VFX you cannot have transitive pairings so if you have VPC a who needs to talk
to VPC B who then talks to VPC C VPC a has to if VPC wants to talk to BPC you have to create appearing
connection between the two.
So that's it for this lecture everyone in the next lecture what we're gonna do is we're gonna go in
and get our hands dirty and we're gonna build our own custom BPC it's gonna be super hands on you're
going to have lots of fun so if you've got the time please join me in the next lecture.
Thank you.