Do you know the main components of the AWS virtual private cloud? Well, by the end of
this short AWS VPC tutorial, you definitely will. Hi, I'm Michael Gibbs, and I've been working in
technology for 25 years and I'm here today to help you learn cloud computing. Please subscribe
to my channel and hit the bell to be informed of free cloud computing videos every Wednesday.
So let's begin by defining the AWS virtual private cloud, usually referred to as VPC.
So what the VPC actually is, is it's a private virtual network
inside of Amazon's network. And since it's a private network, you're logically separated
from the other VPCs that are also residing on the AWS network, as well as Amazon's own
internal network. So that means other people can't see your data. It means there's no problem with
IP addressing. You can use a certain level of IP addresses in your VPC and another VPC on the AWS
cloud could also use the same addresses because they're constrained inside of their logical VPCs.
So what are the key components of a VPC?
Well, there's several components, we'll cover the primary ones in this video.
The first and key component is the VPC routing table. The next component is an internet gateway.
The third component will be NAT gateways. And after that, we'll have VPC endpoints, VPC peering,
and we'll talk about security groups and access lists just a little bit.
So the first thing we'll talk about when it pertains to the VPC is routing and routing tables.
So the VPC actually comes with its own high availability virtual router.
And the virtual router for those that are not routing and switching people like me,
basically is a computer with multiple interfaces and this computer has a logic in it that will
determine how to get traffic from point A to point B. And whether that traffic be on the internet,
whether that traffic be in your data center, or whether that traffic be in another part of
the AWS network, anytime you get off of a local land, you're going to need a router
to actually make those forwarding decisions. So therefore each VPC comes with a virtual router.
Now the next component is something called an internet gateway. And if you have your systems
on the AWS network, if you want to connect them to the internet, and I mean truly connect them,
you're going to have to use an internet gateway. Now, what I mean by truly connecting your systems
to the internet is you want them to be completely exposed. So for example, if a system needs to be
completely on the internet, it's going to have to go through an internet gateway and it's going
to need a public IP address and a gateway is going to need a public IP address as well.
And you basically set up an internet gateway in the following manner. You attach an internet
gateway to your VPC. From there, you create a default route pointing to the internet gateway
and you assign the IP address to the gateway. And then from there you configure the security
because once you're on the public internet, your systems can be attacked quite easily.
Now that's for true internet connectivity, meaning data going in and data going out of the servers.
Now, in many cases, you have systems that actually need to access the internet, but they don't need
to be reachable from the internet. And that's the second component of a VPC called the NAT gateway.
And what NAT does, for those that are not networking people, is it takes one network
address and it translates it into another network address. And NAT could be useful during periods of
migration from an organization purchases another organization that are using the same IP addresses.
You need to do something because systems with the same IP address can't communicate.
Or in this case, the reason you're using a NAT gateway is because you want to take a system
and connect it to the internet. And by using a NAT gateway, you can have private IP addresses
on all your systems, which means they're not reachable from the internet, but they can still
reach out to the internet to pull back patches and software updates and the such. So when you use
a NAT gateway without an internet gateway, your systems will be able to reach out to the internet
and bring back data, but the internet will not be able to reach to them.
So let's talk about the next component of the VPC and that's elastic IP addresses.
So any system that needs to be reachable from the internet in some way, shape or form is
going to have to have a public IP address. Now it doesn't have to be on the web server per se,
it could be on an elastic load balancer, but it has to be understood that if a system is going
to be reachable from the internet, you must have a public IP address. And there's not a whole lot
of public IP addresses available so what Amazon does is they maintain a pool of IP addresses.
Now these are called elastic IP addresses, and it's great because when the customer needs
a public address, they take an address from the pool of elastic IPs and they use it for as long
as they need. And as soon as the organization is done using the elastic IP address, meaning maybe
that server's out of commission or they needed it for a temporary period of time, that elastic
IP address is then returned to the pool and then Amazon can then use that for another customer.
This system works great and that way you can have private IP addressing on the inside of your
network and you can have public IP addresses as needed and there's no challenges or registration
to get your IP addresses because you're getting them directly from Amazon since they own them.
Now, the next concept is an endpoint and what an endpoint really is, is it's the ability to
use the Amazon network to connect to another Amazon service or another Amazon customer's VPC.
And we'll talk about the kind of endpoints in a minute, but just understand that endpoints are
so you can traverse the AWS network instead of the internet. So if you did not have an endpoint
for example, and you wanted to connect your VPC to S3, your organization would have to go out to the
internet and then on the internet come back into the AWS network. And that would be problematic
for a few reasons. One is you're paying for internet access so you definitely don't want
to do that. But more importantly, the internet is going to be much slower than the AWS network.
Now there's a lot of reasons for that as it pertains to internet gateway speed,
but the other component is Amazon manages the AWS network, which means they can have
strict quality control and quality of service guarantees. But when it goes to the internet,
you may have a guarantee of your speed to the internet, but your internet connection
will have to go through multiple internet service providers in most cases to get to its destination
and no one can guarantee that. So the endpoint is a way to get guaranteed performance as well
as high security traversing the AWS network to either other partners or other AWS services.
Now that I've talked just a little more about endpoints, especially since we have a lot of
viewers that are actually working on Amazon certified solution architect certifications,
we're going to take the endpoint and break it down to the two types. So there's an interface
endpoint, which is realistically an elastic network interface that uses a private IP
address from the VPC's pool. And the organization uses this endpoint as an entry point from their
organization to a supported service. And this is actually using the AWS private link service. And
supported services could include almost anything on the AWS cloud or other VPCs.
Now that's different than a gateway endpoint, which is a private endpoint that provides very
high security access to an AWS service. And what happens is it places a route in the VPC's
routing table for traffic destined to that service. And you typically do something like
this with S3 or DynamoDB, but it could also be used with VPC peering as well.
Now, the last two components of the VPC are the network access list and security groups. And we've
done another video for anyone that's interested on the difference between network access lists
and security groups. But in this particular case, I just want to let you know that a network access
list is very similar to an access list that's on a router, it's stateless.
Access lists have to be put in terms of inbound and outbound terms because they are stateless
and network access lists are attached to the subnet. I'm going to repeat that again.
Access lists are attached to the subnets. So they're about keeping traffic out of a subnet.
The next part of the security component of the VPC is a security group. And a security group is
basically a host based firewall. And security groups are stateful and security groups are
attached to a server or a service. So while the network ACL keeps traffic out of this subnet,
the security group keeps traffic that you don't desire outside of a system like an EC2 instance.
Please download the free AWS certified solution architect professional practice exam.
The link is in the description below. If you've enjoyed this video, please like this video
and subscribe to my channel so I can produce more free content on cloud computing for you.
Thank you so much for watching. I look forward to seeing you in the next video. Take care.