Welcome to another episode of "Back To Basics."
I'm Nitin Eusebius, a senior solution architect with AWS.
Today, I will be talking about basics of AWS IoT Core data,
VPC Endpoints, and connectivity patterns.
I collaborate with many customers
who want to connect their physical devices in the field,
to AWS IoT Core data privately, such as private APNs or VPNs.
For example,
customers collecting data from machines in a connected factory
may not want to expose the local factory network to the internet
for security or safety reasons.
So let's get started to see some of the reference patterns
of using private connectivity to AWS IoT Core data
using VPC Endpoints.
You will start with your AWS IoT Core data,
which is integrated with AWS PrivateLink,
enabling you to create private IoT Core data endpoints
in your virtual private cloud or VPC,
which is a virtual network dedicated to your AWS account,
using Interface VPC endpoints powered by AWS PrivateLink.
AWS PrivateLink is an AWS technology
that enables private communication between your VPC and AWS services,
such as AWS IoT Core,
by using private IP addresses that are not reachable
from the public internet,
and do not require an internet gateway on NAT devices to access.
For each subnet that you specify from your VPC,
it creates an endpoint network interface or ENI in the subnet
and assigns it a private IP address from the subnet address range.
Then you will extend the private connectivity
all the way to your on premises network
using VPN or Direct Connect Private VIF.
AWS Direct Connect is a network service
that provides an alternative to using the internet
and enables customers to have low latency, secure and private connection to AWS.
Now that we have a reference pattern
on how to do a private connectivity with AWS IoT Core data,
let's go a little bit deeper to see how to do hybrid DNS resolution
with Amazon Route 53 Resolver Endpoints.
So how does it actually work?
Let's take an end to end look.
Amazon Route 53 Resolver Endpoints
enables you to do hybrid DNS resolution to and from your on premises network.
In this reference architecture,
we have selected one subnet per Availability Zone
to achieve high availability
when creating VPC endpoints for AWS IoT Core data.
For example, a device located in the corporate data center
needs to resolve an AWS IoT data endpoint domain name.
The AWS IoT device data endpoint supports a publish/subscribe protocol
that is designed for the communication needs of an IoT device.
It sends the query to its preconfigured DNS Resolver.
The DNS resolver in the corporate data center
has a conditional forwarder rule that points any DNS query
for AWS IoT data endpoint DNS domains
to the Amazon Route 53 Resolver Inbound Endpoint.
The forwarded query
arrives at Amazon Route 53 Resolver Inbound Endpoints
to either AWS Direct Connect,
or an AWS site to site VPN, as noted before.
All inbound DNS queries will flow through this VPC
on the way to Resolver.
To improve reliability,
Resolver requires that you specify two IP addresses for DNS queries.
We recommend that you specify IP addresses in two different Availability Zones.
The Amazon Route 53 resolver inbound endpoint
send the query to VPC + 2 Resolver within the VPC.
Because DNS VPC is associated with Amazon Route 53 private hosted zone,
of AWS IoT data endpoint,
the default DNS server will be able to resolve this domain
to the VPC endpoint.
For security,
send VPC interface endpoint with security groups
and network ACLs on endpoint elastic network interface,
and controlling access to AWS IoT Core data
or VPC endpoint by using VPC condition context keys.
In this episode,
we explored how to use IoT Core data VPC Endpoints
with some reference end-to-end architecture.
We also saw best practices of doing hybrid DNS resolutions
using Amazon Route 53 Resolver Endpoints
and security best practices.
Check out the links below for more details.
See you next time.