Content Domain 3: Cloud Technology and Services

Task Statement 3.5: Identify AWS network services

Let's get started with the fifth task statement and talk about AWS network services and controlling and optimizing access and communication. Again, before we jump into this lesson in the AWS networking services, I always recommend fundamentals, especially for networking fundamentals. Everything you do in AWS uses networking. When you communicate with AWS, when you create connections between your on-premises environment in AWS, and so on. This is why a solid network design is the foundation of any environment. However, designing and configuring your foundation for networking is different in AWS than it is for on-premises. Amazon Virtual Private Cloud, or Amazon VPC, helps you to control access to your resources. It is a virtual private cloud, so basically it is your very own data center in the cloud. You can provision your own Amazon VPC in a logically isolated section of AWS and launch different resources and create your own Virtual Private Network. You have complete control over this virtual networking environment, and this even includes choosing your own IP address ranges, creating your own subnets, and configuring access with your route tables and network gateways. An Amazon VPC offers multiple different layers of security, network access control lists, and security groups that you can configure to control who and what is allowed to access resources inside your Amazon VPC. So again, an Amazon VPC is a virtual private network, and it is a service that we use to create private networks in AWS, and our private services will run from this Amazon VPC. You can also connect your Amazon VPCs from your AWS private network to your on premises for a hybrid environment, or you can connect to other cloud platforms when you're creating a multi-cloud environment. When you create an Amazon VPC, it is in one Region and in one AWS account, so this makes an Amazon VPC a regional service, and VPCs operate resiliently by operating in multiple Availability Zones in a specific Region. By default, your Amazon VPC is isolated and private until you explicitly grant public access, but there is one exception, and you need to know this for your exam, and that is the default Amazon VPC. There are two types of Amazon VPCs in AWS, the default VPC, and you can have only one default Amazon VPC per Region, and also custom Amazon VPCs. Custom Amazon VPCs are configured by you and you are responsible for all of the configurations, and by default they are isolated and private. Default VPCs are created by AWS when you create your AWS account, and AWS sets up the configuration for you. Each default VPC comes with one VPC CIDR range, which is a given range of IP addresses, and this VPC CIDR defines the start and end range of the IP addresses that this default Amazon VPC can use. So, everything inside your Amazon VPC uses the CIDR range. All communications to the Amazon VPC will need to use the VPC CIDR, and outgoing communications will be from this VPC CIDR. All default Amazon VPCs are configured in the same way, and with your Amazon VPC, you can divide your network across the Availability Zones for resilience so you can subdivide your Amazon VPC into subnets, and subnets is short for sub-network. Each default Amazon VPC is configured to have one subnet located in each Availability Zone of that Region, and each subnet in your default Amazon VPC uses part of the IP address range of the VPC CIDR. If one of your Availability Zones fails, then that subnet in that failed Availability Zone will also fail. But with the default Amazon VPC, you have other subnets in other Availability Zones that are still operating. So ensure you know how an Amazon VPC can help you to control access to your resources. First, you should understand that every Amazon VPC has a VPC router that is highly available, and it moves traffic from somewhere to somewhere else, and it runs in all of your Availability Zones that your Amazon VPC uses. This VPC router has a network interface in each subnet in your Amazon VPC and uses the Network+1 address. Again, this is part of the fundamentals of networking you should understand at a high level. You never need to worry about this VPC router. It just works and it is managed by AWS and it routes traffic between subnets in your Amazon VPC. You can control this router a bit by creating route tables and associate the route table with the subnet and then add rules to allow traffic in and out of your subnets. Each Amazon VPC has a main route table associated with your subnets, so if you do not explicitly associate your new route table with your subnet, then the Amazon VPC will use the main route table, and a subnet can only have one route table associated with it at a time, but you can use one route table for many different subnets in your Amazon VPC. Let's also talk about the internet gateway. Your Amazon VPC can only have one internet gateway at a time, and for your default Amazon VPC, the internet gateway is already attached. The internet gateway is a regional resilient service. It is highly available and it sits on the edge of your Amazon VPC and the AWS public zone and the internet, and manages traffic between your Amazon VPC, the AWS public zone, and the internet, and the reason that we only have one public route table is that the internet gateway is per Amazon VPC. So one internet gateway works across all Availability Zones. If you create a new internet gateway, you must attach it to the Amazon VPC. It is not automatically attached. Then you need to add a route to your route table to allow traffic to and from the internet gateway. And if we add an internet gateway route to a subnet, then that becomes a public subnet because it now has access to the AWS public zone and the open internet. Another way to control access is to use network access control lists, which is a type of security filter like a firewall which can filter traffic as it enters and leaves a subnet. Network ACLs are attached at the subnet level, and by default a default network ACL is created for your default Amazon VPC and is associated with all the subnets by default. Remember, network ACLs are used for traffic entering or leaving a subnet because network ACLs are associated with the subnet and not the resources. Network ACLs only manage traffic that is crossing the subnet boundary. Back to fundamentals. Network ACLs are stateless. We covered this under domain 2, but remember, stateless means if you add a rule for inbound traffic, then you must also add the same rule for outbound traffic. Network ACLs only see the traffic going one way. So if you allow an inbound rule, you must also allow an outbound rule so your network ACL will explicitly see that that traffic that was allowed inbound is also allowed out. Network ACLs see the traffic as two separate streams. So you must have two rules, one rule for each stream. Security groups are another security feature of AWS, only, unlike network ACLs, they are not attached to the subnet. Security groups are attached to the elastic network interface of the AWS resources in the subnet. They also work differently from network ACLs. Security groups sit at the boundary per se of the instance instead of the subnet. Security groups also have inbound and outbound rules, but security groups are stateful. Remember, stateful means that if traffic is allowed in, then that traffic is automatically allowed back out. Security groups see both the inbound and outbound traffic as part of the same stream. Let's also cover another fundamental and talk about Network Address Translation, also known as NAT. NAT is the process of giving a private resource outgoing access to the internet. An example is the internet gateway. The internet gateway performs a type of NAT called static NAT. The internet gateway allocates a resource with a public IPv4 IP address so when the data or packets leave that resource and pass through the internet gateway, the internet gateway switches the source IP address from the private IP address to the public IP address and then sends that packet on. When the packet returns, it switches the destination address from the public IP address back to the private IP address. So NAT gives a private CIDR range outgoing internet access and also to the AWS public zone. And when private resources initiate traffic with the NAT gateway, they can receive responses back in. But outside traffic from the internet cannot initiate traffic inbound. So you can use NAT gateway to allow private resources access to the internet or AWS public zones. Well, why might a private service need access to the internet? Well, the most common reason is for software updates. Let's move on and talk about communication in your Amazon VPC. VPC peering is a way to link multiple Amazon VPCs together and allows direct communications between two isolated sites using their private IP addresses. VPC peers can span AWS accounts and also Regions, and the data shared is encrypted using the AWS global infrastructure. VPC endpoints are gateway objects we create inside your Amazon VPC, sort of like an internet gateway and NAT gateways to allow instances inside and Amazon VPC to connect with AWS public services without the need of a gateway. There are two types of endpoints that we need to know for the certification exam, gateway endpoints and interface endpoints. A gateway endpoint is used for AWS public services. Remember, some AWS services are public services and they sit inside the AWS public zone. And sometimes we want to connect to these public services like S3 or DynamoDB from a private instance or subnet that does not have access to the internet and does not have a NAT gateway set up. Interface endpoints are used for everything else, and you have to pick the correct endpoint depending on the AWS service. Interface endpoints use DNS, not routing with a prefix list, and are for all other services besides S3 and DynamoDB. Let's also mention AWS PrivateLink, which is a VPC endpoint service. PrivateLink solves the problems of needing to expose an application to other Amazon VPCs in other AWS accounts, and it does not require VPC peering or other gateways. You can also create your own hardware virtual private network or VPN connection between your on-premises data center and your Amazon VPC and use AWS as an extension of your current data center or current environment. Remember from an earlier lesson this is called a hybrid environment. AWS has a service called AWS VPN, and it is a service where you can configure a hardware VPN, which is a highly available virtual private connection between your Amazon VPC and on-premises networks. VPNs use the public internet as a transit route for your on-premises and Amazon VPC. VPNs offer a fully encrypted route from wherever your on-premises network is located to your Amazon VPC. We also have another option to connect your on-premises networks and your Amazon VPC, and that is AWS Direct Connect. Direct Connect is a dedicated physical connection between your on-premises network and AWS. for the exam, remember that dedicated is a keyword for Direct Connect. A VPN connection is a virtual private connection over the public internet. Direct Connect is a physical piece of fiber running between your on-premises network and AWS's network. It is a physical or cross-connect connection between an AWS router and another router. And AWS has a number of Direct Connect locations that are distributed globally. Another fundamental needed for this exam is DNS, Domain Name System. Amazon Route 53 is AWS's managed DNS product, and it essentially helps with two things. First, you can register domains, and second, Route 53 can host zones on managed nameservers. Amazon Route 53 is a global service with one single database, and it is replicated between Regions, making it a globally resilient service. This means that it can tolerate the failure of one or more Regions and continue to operate. DNS is a service used to help discover other services on the internet, and it translates addresses from the language that computers understand to the language that humans understand and then back again. So if we wanna go to amazon.com(opens in a new tab), we type in amazon.com(opens in a new tab), but computers use IP addresses. So DNS translates our words into IP addresses and then finds that location. It then sends that location back to us and translates IP address back to the words that we can understand. Amazon Route 53 has routing policies that can help ensure high availability and resilience too, such as failover, weighted, and latency routing policies. And then of course, this task statement also covers edge services such as CloudFront and Global Accelerator, which we've already talked about. For the exam, ensure you know how to take advantage of the features, controls, and configurations to build privacy and security into your environments. Know what you can do to provide connectivity to your Amazon VPCs from the internet or from your on-premises location, and when to use VPN, Direct Connect, and Amazon Route 53 for different use cases. Let's get started with the sixth task statement and talk about AWS storage services.