Okay.
Hello lagers and welcome to this lecture and this lecture we're going to look at part two to creating
your own custom BPC.
So so far we've created a VPC we've got a public subnet.
We've got a private subnet.
We've got instances in both.
But right now all we can do is assess each in to our public instance in our public subnet.
We have no way of communicating to our private instance.
So let's go ahead and figure out how we can do that.
Some back in the adobe case management console.
And if I just go over to services and go over to ACTU and we can see that I've got two running instances
I've got one in my public subnet which is this one my web server and us e to A.
And I've got one in my private subnet my database server.
And it does not have a public IP address.
What it does have however is a private IP address.
Now if I tried to assess each into it from my web server it's not going to work and the reason for that
is they're in two separate security groups and by default the security groups do not allow access to
each other.
So what we might want to do is go ahead and create a new security group because this is my database
server.
We should probably have a database Security Group says go ahead and create a database security group.
We're going to call it my D.B. SMG and I'm going to put it into my custom VPC and I'm going to add some
rules in here.
So the first rule I'm going to add is I'm going to allow all ICMP traffic because I want to be able
to ping it.
And in here we need to put in our source now our source we can either put outsider address range or
our security group.
So I am going to do it using outsider address range.
So we want 10 dot 0 1 dot o Ford slash 24.
And I'm going to copy this into my clipboard.
I want this security group to allow everything in my public security group to communicate to it.
So I'm going to allow ICMP and then also going to go down and I'm going to allow Heathrow GDP.
I'm just going to paste this in here then I'm also going to go in and I'm going to allow Let's go in
and allow Heathrow TTP yes.
So again I'm going to replace this value and just allow it through my public subnet.
And then finally I'm going to go down to my sequel and Aurora and I'm gonna go in and paste that in
there.
This is allowing each GDP.
Hey Steve.
Yes.
Oh we've got SS h the most important one because we want to be able to SS H in some spaces in there
so we've got each GDP CPS might seek or SSA each.
And we're also allowing it to do pings using ICMP.
So let's go ahead and hit create and it's going to ask us for a security group a description so just
paste that in there as well and go ahead and hit create that has now created a new security group my
database security group which is in my default VPC.
Next thing I want to do is just go over too easy to and I want to move my D.B. server I want to go ahead
and change to networking and we're going to go ahead and change security groups and I'm going to basically
add my D.B. and remove it from my default security group.
And there we go.
I'm gonna go ahead and hit add so that has now moved my security groups.
Let's.
Let's go down here and grab this private IP address.
I'm just going to copy that into my clipboard and then what we want to do is we want to SSA reach into
our public web server so SSA reached in from the last lecture and then all I'm going to do it's gonna
type in Ping and I'm gonna paste in the private IP address and you can see that is now pinging.
So I am now able to communicate from my public web server to my private web server.
The next thing we might want to do is if we just clear the screen we want to SS h over to our public
private web server now to do that.
What we're going to need to do is put our somehow access our key in order to do that.
So I'm going to put the private key on this web server.
Normally you would never do this in production what you would do is use a bastion host and we're gonna
look at Bastion hosts later on in this section of the course.
But just to keep things simple we're all learning about VPC is what I'm going to do as I'm going to
open up my private key and I'm going to copy it into my clipboard.
So I mean my downloads directory here's my private key in here I'm just gonna go ahead and hit open
I'm going to open this with a text editor and you can see it in here and I'm just going to copy it into
my clipboard and then in here I'm just gonna do nano my private and then key dot p. m..
So creating a file I'm going to paste it in here and then I'm gonna go ahead and hit control X hit yes
and then enter and then I'm gonna see h moderate to four hundreds.
So my private key pair we type in L as you can see it in there grab your private IP address to your
database server and then all you want to do is type SSA H easy too and then hyphen user.
And then at.
And then the private IP address then minus I.
And then my Peavey key top PM type.
Yes in here and there you go you are now SS reached in to your data server which is then a private subnet.
So essentially SSA reaching into your public server and then SSA reaching into your private server.
Now there's a much more secure way to do this using bastions because the last thing you want to do is
be saving private keys on your public web servers.
I mean what would happen if they got hacked.
Just gonna go ahead and elevate my privileges to route clear the screen.
Now what do you think would happen if we ran a yum update.
This is in a private subnet.
Don't forget this is gonna take a little bit of time but it's gonna completely fail and time out.
And that's because we're in a private subnet that has no route out to the Internet.
But at the same time how are we going to do a yum updates how are we going to go in and installs software
we want to maybe go in and install my cycle.
This is a database server after all how do we do that.
So that's what we're going to look at in the next lecture.
We're going to look at net instances versus net gateways are net instances are fairly out of date but
they still do come up in the exam.
I had a question on them just two weeks ago when I did my exam and that has now failed.
So that's what we're going to cover off in the next lecture.
Net instances versus net gateways.
If you've got the time please join me in the next lecture.
Thank you.