Internet Gateway (IGW) - An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between instances in your VPC and the internet. It therefore imposes no availability risks or bandwidth constraints on your network traffic. Only one internet gateway can exist per VPC
Virtual Private Gateways - Allows you to peer your local network with a VPC
Egress-Only Internet Gateway - Prevents IPv6 based internet resources from connecting into a VPC while allowing IPv6 traffic to the internet
Route Tables - A route table contains a set of rules, called routes, that are used to determine where network traffic from your subnet or gateway is directed.
Network ACL
Default ACL comes with each VPC and allows all inboud and outbound traffic
Custom ACL’s deny all inboud and outbound traffic by default
Each subnet must be associated with an ACL, if one is not explicitly attatched the default ACL is applied
ACL’s allow you to block IP Addresses
A single ACL can be attatched to multiple subnets
Each rule is numbered, rules are evaluated in order
Inbound and Outbound rules are separate
Subnets
A single subnet cannot span multiple AZ’s
A public subnet always has atleast one route in its table that uses an IGW
AWS reserves the first 4 and the last IP for each subnet’s CIDR block
Security Groups
All inbound traffic is blocked by default
All outbound traffic is allowed by default
Changes take effect immediatley
Unique to each VPC
multiple groups can be assigned to a single instance
multiple instances can be assigned to a single group
Can specify allow rules but not deny rules
NAT Instances - provide internet access
Must be in public subnet
Disable source/destination check on the instance
Must be route to private subnet for instances there to be able to use it
If there is a bottleneck consider making the instance larger
Can be HA if it is in an Autoscaling Group and failover is scripted
Uses security groups
Cannot be used as a bastion
NAT Gateways - provide internet access
Redundant within a single AZ
5Gbps to 45Gbps
Does not use security groups
No need to patch or disable source/destination checks
Automatically gets public IP
If using multiple AZ’s put a NAT Gateway in each AZ with appropriate routing to ensure availability
Flow Logs
Log traffic within a VPC
Cannot enable flow logs for peered VPC’s unless those VPC’s are in your acconut
Flow logs cannot be tagged
Internal DNS Traffic is not logged
Traffic generated for windows license validation is not logged
Traffic to/from 169.254.169.254 is not logged
DHCP Traffic is not logged
Can be generated at the network interface, subnet, and VPC levels
VPC Endpoints - allows traffic to AWS services to stay within AWS. Endpoints are virtual, horizontally scaled, and highly available
Interface Endpoint - API Gateway, Cloudformation, Cloudwatch, CodeBuild, Config, EC2 API, ELB API, Kenisis, KMS, SageMaker, Secrets Manager, STS, Service Catalog, SNS, SQS, Systems Manager, Endpoints in another AWS account
Gateway Endpoints - DynamoDB, S3
Facts
No Transitive Peering
Security Groups are stateful, Network ACL’s are stateless
When creating a custom VPC a Route Table, ACL, and Security Group are all automatically created
A VPN connection consits of a customer gateway and a virtual private gateway
By design Amazon DNS ignores requests coming from outside a VPC