Okay hello clunkers.
And welcome to this lecture.
This is the final lecture in the VPC summary section of the course.
Congratulations you've done really really well to get this far.
Hopefully you have a deep understanding of the species now and I would honestly go back and until you
can build a VPC from memory with both public and private subnets as well as with VPC endpoints and Nat
gateways to all you can do it all by memory I would not go and sit the exam so long as you can do all
this by memory.
You will almost certainly pass the AWB certified Solutions Architect associate course.
And also if you can build out of VPC from memory you're going to kill any job interview because you
know exactly what to do.
So let's start with VPC overviews and remember the following.
So we thought of the VPC as the logical data center in AWP us and it consists of Internet gateways or
virtual private gateways route tables network access control lists subnets and security groups.
Remember that one subnet OIS equals one availability zone.
And remember that security groups are state for network access control is a state less so.
So with our security group all we need to do is go and open up a portal might be port 80 or port 22
and we didn't need to worry about our outbound traffic it was all automatic with network access control
this we have to do both inbound and outbound.
Also remember that you can't do transit of peering with VPC.
They need to be appeared on a one to one basis and you can peer between regions.
So we then went on to build out a very first BPC.
And when we created our VPC it created a default route table.
It created a default network access control list and it created a default security group.
It won't create any subnets nor will it create a default Internet gateway.
And just remember that US is one eh in your AWB account can be a completely different availability zone
to us.
E one a in another eight of those accounts are the valid the availability zones are randomized between
AWB accounts.
Remember that Amazon always reserves five IP addresses within your subnets.
I remember that you can only have one Internet gateway per VPC can't just go in and add multiple Internet
gateways VPC you can only have one.
Also remember that security groups cannot span V.P. seas.
We then went on to learn about net instances.
So when creating a nest instance you always disable the source and destination check on the instance
net instances must be in a public subnet and there must be a route out of the private subnet to the
net instance in order for this to work and the amount of traffic that a net instance can support depends
on the instant size and if your bottle necking what you need to do is you need to go in and increase
the size of the net instance and you can create high availability using auto scaling groups multiple
subnets in different availability zones and then a script to automate fail over and net.
Instances are always behind a security group.
To be honest you don't really want to use Net instances in the real world you pretty much always want
to use a Nat gateway.
And just remember how a Nat Gateway works.
Essentially you've got your instance here.
It has a root in its root table to the NAT gateway and then that Gateway has a route out to the Internet.
And so when your instance runs a yum update it's going to the NAT gateway and then traversing out to
the instance and also note that your NAT gateway is not behind a security group exists on its own terms
of NAT gateway redundancy is available inside the availability zone it's preferred by the enterprise.
It starts at 5 gigabits per second scales currently to 45 Gigabits per second.
Probably scale even more in the future.
You don't need to worry about patching Nat gateways and they're not associated with any security groups
and it's automatically assigned a public IP address.
And when you add your NAT gateway Just remember to update your route tables it has a route out to an
Internet and you don't need to worry about disabling source destination checks on a Nat gateway.
Also remember that if you have resources in multiple Availability Zones and they shared the one NAT
gateway in the event that that NAT gateway availability zone goes down resources in the other Availability
Zones are going to lose Internet access.
So just by having a single NAT gateway you do not have high availability to create an availability zone
independent architecture.
What you have to do is create a NAT gateway in each availability zone and configure your rooting to
ensure that resources use the NAT gateway in the same availability zone in which they're in.
Also remember moving on to network AC ls so your VPC automatically comes with the default ACL and by
default it allows all outbound and inbound traffic.
You then can create custom network ACL and by default when you do this each custom network ACL denies
all inbound and outbound traffic until you go in and add rules and each subnet in your VPC must be associated
with a network ACL.
And if you don't explicitly associate a subnet with a network ACL then the subnet is automatically associated
with the default network ACL and you can block IP addresses on specific ports using network ACL as you
can never do this using security groups.
Remember that you can associate a network ACL with multiple subnets however a subnet can be associated
with only one network ACL at a time and when you associate a network ACL with a subnet.
The previous association is removed.
Remember that network ACL is contain a numbered list of rules and these are evaluated in order starting
with the lowest number first.
And you remember if we had no allow and then a deny at the allow is going to trump the deny because
it's evaluated first.
So you must always if you're going to deny something you must put it in front of your allow role network.
ACL is have separated inbound and outbound rules and each rule can either allow or deny traffic.
You can't do that with security groups and network ACL is a stateless so responses to allowed inbound
traffic are subject to the rules for outbound traffic and vice versa.
Moving onto Albee's and VPC is just remember that you need a minimum of two public subnets to deploy
an Internet facing load balancer VPC flow logs we learnt that you cannot enable BPC flow logs that appeared
with your VPC unless the pier VPC is in your account you cannot tag a flow log and after you've created
a flow log you cannot change its configuration for example you can't associate a different IAM role
with the flow log.
Remember that not all IP traffic is monitored with flow logs so traffic generated by instances when
they contact the Amazon DNS server is not going to be logged.
If you use your own DNS server however then all traffic to that DNS server is going to be logged.
Traffic generated by a Windows instance for Amazon Windows license activation is not going to be monitored
traffic to and from 1 6 9 2 5 4 that 1 6 9 2 5 4 for your instance metadata and user data is not going
to be monitored.
And then DHS IP traffic is not going to be monitored as well.
And traffic to the reserved IP addresses for the default VPC route will not be monitored as well bastions
just remember what a bastion is and how it works.
So we've got our instance in a private subnet if it wants to connect out to the Internet it's going
to do that using a net instance on that gateway.
If however we want to assess hate Shen or IDP into our instances in our private subnet we do that via
a bastion host.
And sometimes these are called Jump boxes as well.
So just remember that a NAT gateway or Nat instance is used to provide Internet traffic too easy two
instances in private subnets a bastion is used to securely administer easy to instances using SSA show
IDP and like I said bastions are called Jump boxes in Australia and you cannot use a NAT gateway as
a bastion host.
Moving on to direct connect.
Just remember what it is.
It directly connects your data centre to AWB and its use of for high throughput workloads.
A lots of network traffic or where you need a stable and reliable and secure connection and then finally
we move on to VPC end points and BBC endpoints enable you to privately connect your VPC to supported
AWB services and BPC endpoint services powered by private link without requiring an Internet gateway
net device VPN connection or AWB Direct Connect connection and instances in your VPC do not require
public IP addresses to communicate with resources in the service traffic between your VPC and the other
services does not leave the Amazon Network.
So this is what it looks like we've got our instance.
It then connects to our VPC Gateway which then connects on to our AWB services.
So this could be S3 or dynamo D.B. and there's two types of VPC end points who've got into interface
and points and that has a whole bunch of different services that you can connect into but then we've
got our gateway endpoints and our gateway endpoints are only support to services S3 and dynamo DP So
that is it for this lecture guys you've done so well getting to the end of this section of the course
hopefully you've had lots of fun seriously before you go and sit your exam make sure you can build out
a VPC from memory.
This includes public subnets private subnets it includes Nat gateways as well as using BPC endpoints
as well if you can do all that from memory then you are almost certain to pass your exam.
So that is it for the end of this section of the course in the next section of the course we're going
to look at high availability we're going to look at different architectural styles and then we're going
to move on to application services and then finally we're going to move on to Sevilla.
So if you've got the time please join me in the next section.
Thank you.