In this theoretical tutorial you will learn everything you should know about Amazon VPC or AWS VPC. I am sure you will have no further question on AWS VPC after going through this detailed guide.
Why not dive in right now.
Table of Content
- What is VPC or an Amazon VPC or what is a VPC?
- VPC CIDR Range
- What is AWS VPC Peering?
- What is AWS VPC Endpoint?
- What are VPC Flow logs?
- Knowing AWS VPC pricing?
- AWS CLI commands to create VPC
- Defining AWS VPC Terraform or terraform AWS VPC Code
- How to Publish VPC Flow Logs to CloudWatch
- Create IAM trust Policy for IAM Role
- Creating IAM Policy to publish VPC Flow Logs to Cloud Watch Logs
- Create VPC flow logs using AWS CLI
- Conclusion
What is VPC or an Amazon VPC or what is a VPC?
Amazon Virtual Private Cloud allows you to launch AWS resources in a isolated and separate virtual network where you are complete owner of that network.
In Every AWS account and in each region, you get a default VPC. it has a default subnet in each Availability Zone in the Region, an attached internet gateway, a route in the main route table that sends all traffic to the internet gateway, and DNS settings that automatically assign public DNS hostnames to instances with public IP addresses and enable DNS resolution through the Amazon-provided DNS server.
Therefore, an EC2 instance that is launched in a default subnet automatically has access to the internet. Virtual Private cloud contains subnets that are linked or tied to a particular Availability zone.
If you associate an Elastic IP address with the eth0 network interface of your instance, its current public IPv4 address (if it had one) is released to the EC2-VPC public IP address pool.
The Subnet and VPC are assigned with IP range also known as CIDR_range which define the network range in which all resources will be created.
You also need to create Route tables that are used to determine the network connectivity of your VPC with other AWS services such as:
- Peering connection means connection between two VPCs such that you can share resources between the two VPCs.
- Gateway endpoints:
- Internet Gateway connects public subnets to Internet
- NAT Gateway to connect private subnets to internet. To allow an instance in your VPC to initiate outbound connections to the internet but prevent unsolicited inbound connections from the internet, you can use a network address translation (NAT) device.
- NAT maps multiple private IPv4 addresses to a single public IPv4 address. You can configure the NAT device with an Elastic IP address and connect it to the internet through an internet gateway
- But if you think non default subnets those are private want to connect them to internet then make sure by attaching an internet gateway to its VPC (if its VPC is not a default VPC) and associating an Elastic IP address with the instance.
- VPC Endpoints connect to AWS services privately without using NAT or IGW.
- Transit Gateway acts as a central device or epicentre to route traffic between your VPCs, VPN connections, and AWS Direct Connect connections.
- Connect your VPCs to your on-premises networks using AWS Virtual Private Network (AWS VPN).
VPC sharing allows to launch any AWS services in centrally managed Virtual Private Cloud. In this the account that owns VPC shares one or more subnet with other accounts (participants) that belong to the same organization from AWS Organizations.
- You must enable resource sharing from the management account for your organization.
- You can share non-default subnets with other accounts within your organization.
- VPC owners are responsible for creating, managing, and deleting the resources associated with a shared VPC. VPC owners cannot modify or delete resources created by participants, such as EC2 instances and security groups.
If the tenancy of a VPC is default, EC2 instances running in the VPC run on hardware that’s shared with other AWS accounts by default. If the tenancy of the VPC is dedicated, the instances always run as Dedicated Instances, which are instances that run on hardware that’s dedicated for your use.
VPC CIDR Range
- CIDR stands for Classless Inter Domain Routing (CIDR ) Notation.
- IPv4 contains 32 bits.
- VPC IP CIDR ranges is in between /16 to /28
- Subnet CIDR range is also in between /16 to /28
- You can assign additional private IP addresses, known as secondary private IP addresses, to instances that are running in a VPC. Unlike a primary private IP address, you can reassign a secondary private IP address from one network interface to another.
- The allowed block size is between a
/16netmask (65,536 IP addresses) and/28netmask (16 IP addresses)
| 10.0.0.0 – 10.255.255.255 (10/8 prefix) | 10.0.0.0/16 |
| 172.16.0.0 – 172.31.255.255 (172.16/12 prefix) | 172.31.0.0/16 |
| 192.168.0.0 – 192.168.255.255 (192.168/16 prefix) | 192.168.0.0/20 |
- You can associate secondary IPv4 CIDR blocks with your VPC
- VPCs that are associated with the Direct Connect gateway must not have overlapping CIDR blocks
What is AWS VPC Peering?
A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them privately. Resources in peered VPCs can communicate with each other as if they are within the same network. You can create a VPC peering connection between your own VPCs, with a VPC in another AWS account, or with a VPC in a different AWS Region. Traffic between peered VPCs never traverses the public internet.
What is AWS VPC Endpoint?
VPC Endpoints connect to AWS services privately without using NAT or IGW.
What are VPC Flow logs?
To monitor traffic or network access in your virtual private cloud (VPC). You can use VPC Flow Logs to capture detailed information about the traffic going to and from network interfaces in your VPCs.
Knowing AWS VPC pricing?
There’s no additional charge for using a VPC. There are charges for some VPC components, such as NAT gateways, IP Address Manager, traffic mirroring, Reachability Analyzer, and Network Access Analyzer.
AWS Cli commands to create VPC
aws ec2 create-vpc --cidr-block 10.0.0.0/24 --query Vpc.VpcId --output text
Defining AWS VPC Terraform or terraform AWS VPC Code
You can deploy VPC using Terraform as well with just few lines of code. To understand Terraform basics you can refer.
The below Terraform contains resource block to create a Amazon VPC with cidr_block as “10.0.0.0/16” in the default tenancy with tags as “Name” = “main”.
resource "aws_vpc" "main" {
cidr_block = "10.0.0.0/16"
instance_tenancy = "default"
tags = {
Name = "main"
}
}
How to Publish VPC Flow Logs to CloudWatch
When publishing to CloudWatch Logs, flow log data is published to a log group, and each network interface has a unique log stream in the log group. Log streams contain flow log records. For publishing the logs you need:
- Create an IAM role. To know how to create a role refer here.
- Attach a IAM trust policy to an IAM role.
- Create a IAM policy and attach to an IAM role.
- Finally create the VPC flow logs using AWS CLI
Create IAM trust Policy for IAM Role
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "vpc-flow-logs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
Creating IAM Policy to publish VPC Flow Logs to Cloud Watch Logs
The policy below VPC flow logs policy has sufficient permissions to publish flow logs to the specified log group in CloudWatch Logs
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams"
],
"Resource": "*"
}]
}
Create VPC flow logs using AWS CLI
aws ec2 create-flow-logs --resource-type Subnet --resource-ids subnet-1a2b3c4d --traffic-type ACCEPT --log-group-name my-flow-logs --deliver-logs-permission-arn arn:aws:iam::123456789101:role/publishFlowLogs
Conclusion
Now that you should have a sound knowledge on what is AWS VPC.
DevOps Automateinfra Learning 