| Internet Gateway (IGW) |
Definition- Allows EC2 to communicate with Internet
- IGW provides a target in RT for Internet routable traffic
- Performs NAT for instances that have PUBLIC IPs
- Only 1 IGW can be attached per VPC and each IGW can only be attached to a single VPC
- HA + Redundant + Horizontally scaled → fault tolerant
NAT- EC2 in VPC are only aware of their PRIVATE IP
- Traffic
Instance --> Internet = IGW translates reply address to instance's PUBLIC IP or EIPInternet --> Instance = IGW translates dest address (PUBLIC IP) to the PRIVATE IP
- Creation
- Create public subnet with internet access
- attach IGW to VPC
- create RT rule for all non-local traffic:
0.0.0.0/0 -> IGW - configure SG & ACL to allow relevant traffic
- Enable EC2 to send/receive traffic from Internet (assign a Public IP or EIP)
|
| Egress Only Internet Gateway |
- Only used to enable outbound IPv6 traffic from the VPC
- Does not support NAT
|
| NAT Gateway (NAT-GW) |
Definition- Allows private subnets to indirect access to the Internet (by default, any instance launched in a PRIVATE subnet is not able to communicate with Internet through IGW)
- Allows OUTBOUND but prevents INBOUND (prevents unsolicited inbound connections but allow outbound connections for instances without a PUBLIC IP)
- Within a public subnet, in a specific AZ
- You cannot assign a SG to a NAT gateway
- HA + Single AZ
Setup- High-level
- The subnet's NACL applies, but NAT Gateways aren't in any security groups
- Has an EIP
- Connects to an IGW
- Process
- Configure RT of PRIVATE subnet to direct Internet-bound traffic to NAT-GW (
0.0.0.0/0 -> NAT-GW) - Allocate an EIP & associate it with the NAT-GW
 NAT-GW vs NAT Instances| Characteristics | NAT Instance | NAT-GW | | High availability | Use AutoScaling groups and multiple subnets | Deploy in each AZ and more than 1 private subnet | | Performance | Depends on the NAT instance type and size | It can scale up to 45 Gbps | | Maintenance | You need to manage SW updates/patches | Managed by AWS | | Type and size | You choose | Single offering | | Traffic monitoring | CloudWatch standard instance metrics | Predefined CloudWatch metrics for NAT gateways |
|
| VPC Peerings |
Definition- Connection between 2 VPCs (can be in different account, but same region)
- 1-to-1 relationship
- Does not support transitive routing
- Created through
request/accept protocol
Rules- Can't peer 2 VPCs with overlapping CIDR blocks
- Can't peer 2 VPCs in different regions
- Can't have more than 1 peering between some 2 VPCs (1-to-1 relationship)
Encryption- VPC peering connections in the same region do not use encryption, but the connections are labeled as private
- Cross-region connections use encryption and also use the AWS private network
|
| VPC Endpoints |
Definition- Creates a private connection between VPC & another AWS service
- Use a proxy to pass traffic to the service API endpoint, bypassing the AWS network entirely
- Without requiring access to the Internet or through a NAT/VPN/Direct Connect
- Currently supports S3 & Dynamo, and no cross-region
- HA + Redundant + Horizontally scaled → fault tolerant
Creation- Specify the VPC
- Specify the service (
com.amazonaws.<region>.<service>) - Specify the policy (full access or custom)
- Specify the RT (
SERVICE (destination) --> ENDPOINT (target))
Example - No Endpoint- all internet traffic is directed to IGW-1
- any traffic from the subnet that is destined for another service will be sent to the IGW
| destination | target | 10.0.0.0/16 | local | 0.0.0.0/0 | IGW-1 |
Example - With Endpoint- all S3 traffic is directed to the VPC Endpoint (in the same region)
- traffic for different regions goes through IGW-1
| destination | target | 10.0.0.0/16 | local | 0.0.0.0/0 | IGW-1 | pl-1A2B3 | VPCE-1 |
Policies- Endpoint policies: resource policies that constrain what service actions are possible via that endpoint
- S3 bucket policies can limit access to a specific endpoint or VPC using
aws:sourceVpce and aws:sourceVpc:
{ "Sid": "specific-vpc-endpoint",
"Condition": { "StringNotEquals": { "aws:sourceVpce": "vpce-1a2b3c4d" } } - Similarly can use
aws:sourceVpce in an identity policy for DynamoDB
Gateway Endpoint- Gateway in the VPC that you route to with a special-case entry in route tables
- S3 and DynamoDB only (they don't have interface endpoints) in the SAME region
- Not attached to a subnet
- See Choosing Your VPC Endpoint Strategy for Amazon S3 for selecting the right VPC endpoint type to access Amazon S3
Interface Endpoint (PrivateLink)- ENI with a private IP address
- Several services including EC2, ELB, SNS, CloudWatch, Systems Manager, and various Marketplace products
- Has an endpoint specific DNS hostname
- Private DNS allows you to use the normal hostname for the services, by creating a DNS zone in the VPC using Route53 that has a record for the service that resolves to the interface's private IP address
 |
| Transit Gateway |
- A hub that controls how traffic is routed among all the connected networks which act like spokes
- Instead of lots of (1:1) VPC peering relationships and lots of (1:1) VPN connections, connect each VPC to the single transit gateway and manage centrally
|
