Okay.
Hello cloud and welcome to the very last.
Hands on lecture in the BPC section of the course we're going to learn all about VPC end points and
in the next lecture we're gonna go in and summarize everything that we've learnt about BPC D.
So here is the age old question what is a VPC end point.
So VPC end point enables you to privately connect your BPC to supported AWP services and VPC endpoint
services powered by private link without requiring an Internet gateway and Nat device a VPN connection
or an AWP Direct Connect connection instances in your VPC do not require public IP addresses to communicate
with resources in the service so traffic between your VPC and other services does not leave the Amazon
Network.
So it's a way of traversing your traffic without having to leave the Amazon Network.
You don't need to go over the Internet and points of virtual devices and they are horizontally scaled
redundant and highly available VPC components that allow communication between instances in your VPC
and services without imposing availability risk or bandwidth constraints on your network traffic.
And there's basically two types of VPC endpoints we have our interface endpoints.
We have our gateway endpoints and in this lab what we're going to do is we're going to create an S3
Gateway endpoint we'll have a look at how we're going to do that a bit later.
At first we should just talk about an interface endpoints.
This is an elastic network interface or an EMI with a private IP address that serves as an entry point
for traffic destined to support us destined to a supported service.
So the following services are supported.
I'm not going to read them all but basically a whole bunch of services are supported and there's probably
going to be more and more added throughout 2019 and 2020.
Again don't worry you're never going to be quizzed on this as to which services are supported but what
you need to know is you basically attach an EMI to an easy to instance and that will essentially allow
you to communicate to these services using the Amazon internal network.
They don't need to then traverse the Internet and then Gateway endpoints are very similar.
They look just like Nat gateways essentially and they're supported for S3 and dynamo DB currently and
so what we're going to do is we're going to go ahead and create a gateway endpoint.
So right now this is what our VPC environment looks like we've got an easy to instance in a private
subnet.
We've got one in a public subnet.
Our private subnet when it wants to communicate to S3 it basically traverses through the NAT gateway
and then goes outside of the AWOL network and then uses basically the S3 public endpoints and that is
how it would copy a file.
What we're going to do is we're going to change this architecture.
We're going to get our instance to send our files to a VPC Gateway and then that Gateway is then going
to send that file to our S3 bucket and it will not leave the Amazon Network.
So let's go ahead and see how we can set this up.
You will need to log into the obvious console before we go over to services will just go down to identity
access management and security and compliance.
And I want you just to make sure that you've got a role which allows you to talk to S3.
Now for some reason I must have deleted it at some point.
I'm gonna go ahead and create the roll see if you can create it yourself from memory so I'm gonna use
the easy to service.
I'm gonna go ahead and go next and then I'm going to go for S1.
Then I'm gonna type S3 in here.
So on S3 full access and then I'm gonna go ahead and hit next tags I don't really need and then I'm
gonna call this S3 admin access.
This will allow easy to to call S3 on my behalf.
I'm gonna go ahead and create the roll.
So I've now created that role.
The next thing we're gonna do is we're going to go over to E2 and we're going to add this role to our
instance that's in our private subnet.
So we're gonna do it to my DB server and we're just gonna go over and go to instant settings and change
the attach replace Amaro and then I'm just going to add in S3 in there and I'm gonna go ahead and hit
apply.
So that has now applied.
Now I do have a couple of network AC ls network access control this can be difficult to manage.
So what I'm just gonna quickly do is just go down to my network ACL so I need to find my VPC and then
I'm gonna go over to my network ACL so I'm just going to quickly move my subnet to my default network
ACL so we've got this Web network ACL gonna click on my default subnet.
So this is my main or default subnet for this VPC.
I'm gonna go to my subnet associations and we're going to edit this and I'm gonna go ahead and add this
subnet into it as well and I'm gonna go ahead and click edit.
So now it's I've only got one subnet that I have to worry about.
I don't have to worry about all my different inbound and outbound rules.
I'm just doing that to make this lab a little bit easier.
So now that we've done that what we're going to do is we're going to SS H in to the easy two instances
in our private subnet and I'm gonna go ahead and try and create a file and just copy it to an S3 bucket.
So let's go ahead and grab the IP address.
So I need to SS H into my public one and then I'm going to SS H from my public one over to my private
ones.
I'm just going to grab this IP address there and see if you can remember.
Mine just ends in two three five.
So here I am.
I'm in my downloads directory I'm going to SSA.
Easy too.
And then hyphen user.
And then at I'm copying and pasting my my public IP address in there and then I'm going to use my key
pair.
And so there we go of connected to elevate my privileges to root.
And I'm gonna go ahead and clear the screen.
Now I should still have my private key in here which I do from the few lectures ago and then I'm going
to SS Hage using AC to hyphen user.
And then at.
And then I'm going to do my private IP address so dot Oh Dot two and then I think it was dot two three
five.
Your private IP address will be different so make sure you remember what it is and then I'm going to
do my private key paired up PM.
And there we go.
Going to elevate my privileges to route and to clear the screen then I'm just gonna type AWP s S3 L
S and I should be able to list all my buckets in there and you can see that I can do that and what I
could do is I could create a file so I could just say let's say echo and then test dot I would just
say test and I'm going to output that to test dot text T.
And again if I hit Ellis We can see that that file has been created and then I could do Adobe s S3 and
then copy and then test dot t x t and then I want to do that to my bucket and I'm going to do it to
the a cloud guru and then it's 2019 and then it's Ryan and then Kronenberg and then it's pi three point
one 4 one and that has now copied it over to my S3 bucket and just a test that that work.
Let's go over to S3 and see that we can see that file.
So it's in here and there we go test dot text he has just been placed in there.
So the next thing we're gonna do is we could go in and just delete our Nat gateway or what we could
actually do is just remove the root and that's essentially the same as deleting it because it's got
no root to our NAT gateway.
So I'm just gonna go over to my root table and what I want to do is I want to grab my main root table
and click in here and you can see here we've got our route out to our NAT gateway and what we want to
do is you want to go in and see it hit edit routes and we're going to delete that.
So essentially that is now saying we have no route out to our NAT gateway.
If I go back over to my easy to instance some back in that private easy to instance I'm gonna go ahead
and clear the screen just so it's easier to see by now type Adobe S S3 L S nothing's going to happen
because it has no way it has no route out to the Internet because we've deleted that from our main root
table.
So what we're gonna do now is we're gonna go in and add in our own VPC end point some back in the VPC
dashboard you'll be able to go over to endpoints and we're gonna go ahead and create an endpoint and
we can you can do these different service categories so you can do it by service you can do it find
services by name or an AWOL market place and what you can do is if you just go down to type.
You can see here that's that's dynamo database so that is the dynamo DB Gateway and I want this one
I want the Amazon S three Gateway and then in here it's asking me which VPC I'd like to do this for
I'm going to do it for my a cloud guru VPC and then it's going to ask which route to table you want
to do it too.
I'm going to do it to my main route table so I'm going to click it in here and the policy we're going
to do full access and then we're just gonna go ahead and hit create end point and that has now created
our VPC endpoint and you can see that it's all ready available now.
Full disclosure I went over and clicked on my route table and I didn't when I clicked on my main route
I couldn't actually see the route in there.
It took about probably about five minutes for the route to go in and be set up automatically.
So you do just wait a little bit.
The VPC end points provisioned immediately but the updating to the route table can take a little bit
of time since you do see that route in there.
Feel free to go over to your easy to instance some back in my easy to instance if I type in database
s three Ls it just looks like it's going to time out and it's really a it's actually just really annoying
and I don't know why they do this but we'd need to add in another flag now.
So we need to say we s s three L S and then we need to specify the region that we're in.
So I'm in us e to because I'm in the Ohio region and then that will go ahead and list my buckets.
So if you do type Adobe s s three l s and it's just hanging.
It's not because you don't have a connection it's just that you have to specify the region that you're
in.
So now I am able to see all my buckets and I'm not leaving the AWOL network.
I'm doing it through my VPC end point.
So onto my exam tips just remember what a VPC endpoint is it enables you to privately connect your VPC
to supported AWOL services and there's an awful lot of them and VPC endpoint services powered by private
link without requiring an Internet gateway Nat device VPN connection or AWOL direct connect connection.
And just remember there's two types of VPC and points there's interface end points and then there's
Gateway endpoints and Gateway endpoints are currently supported for S3 and dynamo DP So that is it for
this lecture guys you've done really really well.
We're at the end of the Vive c section of the course.
Hopefully you've learnt an awful lot in the next lecture we're just going to summarize everything that
we've learnt and then we're ready to move on to high availability so if you've got the time please join
me in the next lecture.
Thank you.