VPC - sergeyzolotukhin/learn-java-gradle GitHub Wiki
- gateway
-
- an internet gateway
-
- Transit Gateway
-
- NAT gateway (private / public connection)
-
- Public subnets
-
- private subnets One subnet can be at one AZ
-
- public IPv4 - public dynamic IP (changed when restart)
-
- Elastic IP - public dynamic IP (limit 5 per account)
-
- private (internal) IP address - private IP (dynamic ??? )
Security groups and NACLs act as virtual firewalls.
- security groups - A security group acts as a virtual [firewall for EC2 instances] to control the inbound and outbound traffic based on some defined rules. It ensures [instance-level security].
- NACL Network Access Control List - NACL stands for Network Access Control List, and it [controls the traffic to or from a subnet] according to some defined rules
A [security group] controls the traffic that is allowed to reach and leave the resources that it is associated with
When you create a VPC, it comes with a [default security group]
You can create additional security groups for a VPC, each with their own [inbound and outbound rules]. You can specify the source, port range, and protocol for each [inbound rule]. You can specify the destination, port range, and protocol for each [outbound rule].
The [security group] acts as a virtual [firewall]. by default, all inbound is disabled by default, all outbound is allowed take effect immediately security group is stateful !!!
security group <--many-to-many--> EC2 instance
NACL is stateless !!! Default NACL allow all Custom NACL denies all Each subnet should have NACL , only one is allowed We can block IP addresses via NACL - not a security groups. Rules checked in ordered way, start from lowest Ephemeral ports !!!
It allow access to AWS services (S3 for example) from private network (directly without internet)
It allow connect one VPC to another Transitive peering is not supported We can not overlapping CIDR address ranges
It allow connect one VPC to another required Load Balancer on service VPC required Elastic Network Interface on client VPC
https://www.youtube.com/watch?v=jo3X_aay4Vs&ab_channel=BeABetterDev
record type A C NS