Cloud Networking

VPCs and subnets

VPCs are divided into subnets, public subnets are for servers that talk directly to the internet, they are akin to tradition DMZs. Private subnets are inaccessible from the Internet.

In the world of physical networking, every device has a routing table that tells it how to route outbound network packets.
But in VPC, routing tables are also an abstract entity that’s defined through the AWS web console or its command-line equivalent. Every VPC subnet has an associated VPC routing table. When instances are created on a subnet, their routing tables are initialized from the VPC template.

Instances in private subnets cannot be reached from the Internet even if they are assigned public IP addresses, confusing.

To understand the network routing for an instance, review the VPC routing table for its subnet than to look at the instance’s actual routing table. The VPC version identifies gateways (“targets”) by their AWS identifiers, which makes the table easy to parse at a glance.

Security groups and NACLs

Security groups are firewalls for EC2 instances. Security group rules dictate which source addresses are allowed for ICMP, UDP, and TCP traffic (ingress rules), and which ports on other systems can be accessed by instances (egress rules). Security groups deny all connections by default, so any rules you add allows additional traffic.

All EC2 instances belong to at least one security group, but they may be in as many as five (per interface).

Most security groups have granular inbound rules but allow all outbound traffi. This configuration is convenient since you don’t need to think about what outside connectivity your systems have. However, it’s easier for attackers to set up shop if they can retrieve tools and communicate with their external control systems. The most secure networks have both inbound and outbound restrictions.

Important

The more security groups an instance belongs to, the more confusing it can be to determine precisely what traffic is and is not allowed.
We prefer that each instance be in only one security group, even if that configuration results in some duplicate rules among groups.

Typical VPC SG

Privisioning

Anonymous

How do you know when to use Terraform and when to use the CLI? If you’re building infrastructure for a team or project, or if you’ll need to make changes and repeat the build later, use Terraform. If you need to fire off a quick instance as a test, if you need to inspect the details of a resource, or if you need to access the API from a shell script, use the CLI or GUI.