Welcome back.
Today we are going to discuss the methods
we use to secure our VPC in a as cloud in this venue.
We are going to look to BBC networking and security.
Let us first discuss the internet gateway
we know from previous a class that a roundtable enables
our easy to instances in a private, subnet
and public subnet to communicate with each other.
If the two in the private subnet
wants to communicate with the AC two in the public subnet,
the local target in the roundtable carries the message
between them.
Also,
if they see two in the public, subnet wants to communicate
with the internet, it must uses a service called an internet gateway.
An internet gateway is a scalable, redundant and highly available
VPC component that allows communication between instances
in your BBC and the internet.
What if our easy to in the public subnet wants to access the internet?
To do this, we need a service called Nat Gateway.
So we understand that, and
that Gateway enables your instances in the public subnet
to access the internet and to be accessed from the internet.
But what if an end user wants to communicate
directly with you at instances in the private subnet?
It will not be allowed, but the instances we have
in the private subnet,
they might need to do a software update or download a security patches
to enable those resources to access the internet.
You can do this by adding a component called
Nat Gateway to your VPC.
When you create an art gateway, you must specify
the public subnet in which then that gateway should reside.
You must also specify an elastic IP address
to associate it with your net gateway.
After you create another gateway, you must update the roundtable
that is associated with one or more of your private subnet
to point internet bound traffic to then add Gateway so that instances
in your private subnet can communicate with the internet.
Now, let us understand how we can add the security layers
to a lot of ABC.
But before that, we need to understand
how communication actually works in computer network.
In computer networks, a computer is able to access a web
server resources using a model called the client server.
The client initiated the request and the server respond
to this request by sending the message back to the client.
So, for example, an end user wants to access Amazon Dotcom website.
In this case, the client of the end user send a request
to the web server requesting a copy of the main page.
Then the Amazon Dotcom Web server received the request
and sends the client a copy of the main web site.
Now, in the previous example, we have one client
requesting one type of content, which is a web content.
But what if the client needs also to watch YouTube video
or send a new email or upload a file?
In this case,
the client computer must request the right content from the server,
and it must specify the right port number.
So if the client wants to view our content,
then he must send a request to port number 80.
If the client wants to view YouTube, it will be also sending
a request to Part 80 because YouTube is similar to Amazon.
Both are web servers.
If the client wants to send an email via Gmail,
he must send the request at 4025
because this is where the SMTP server operates.
If the client wants to upload
the file to Google Drive, then he will use his party 21,
which is the port allocated to file transfer protocol.
So in the client server model, each service, it has its own port number
and the different port numbers are standard and they do not change.
But why?
I'm telling you this for a simple reason.
If we built those services inside our VPC enable us.
We have to follow the same standard
and we use those reserved port numbers.
But how we can do this in the video as BBC, it is very simple.
We create a security group and the that security group.
We open the part that we need to accept the traffic in that port.
In this example,
we have an easy two instance running the Amazon dot com website.
So we need to open Port 80.
But how we can do that by enabling an inbound traffic
to reach the easy to, in essence, inside
your VPC, it is very simple.
By creating a security group and adding a specific rule
to open Port 80 to accept accepted traffic from anywhere,
a security group acts as a virtual firewall
for your instances, and it controls inbound and outbound air traffic.
Security groups act at the instance level, not add the subnet level.
Therefore, each instance in a subnet in your VPC
can be assigned to a different set of security groups.
Security groups have rules that control the inbound
and outbound traffic when you create a security group.
It has no inbound role is by default.
Therefore, no inbound traffic will be accepted
until you add a rule to accept that traffic at a specific port.
By default, a security group includes an outbound rule that allows
all outbound traffic to go from your easy to to the internet.
You can remove the rule and add an outbound rules that allow
a specific traffic only to go from your AC to to the internet.
Security groups are stateful, which means that
the state of information is kept even after a request is a process.
Also, when you open Port 80 inbound by default,
the reply port 80 will be open.
Similar to security rules, we can also control
the traffic at the instance level using any talk.
Access Control List and network access list is an optional layer
of security for your Amazon VPC.
It acts as a firewall for controlling it traffic
in and out of one or more subnets.
To add another layer
of security to your VPC, you can set up network access list.
And you specify rules to allow or deny a specific traffic, and its
work access list has a separate inbound and outbound rules.
And each rule can either allow or deny traffic.
Your visa automatically comes with a modifiable default
network access list.
By default, it allows all inbound and outbound IPV for traffic
and, if applicable, IPv6 traffic also.
So what is the summary
of the differences between security group and network access list?
Security Groups Act at the instance level, but Network Access List Act,
the subnet level security group support allow rules only.
You can deny a specific traffic and security group,
but network access list support both.
You can allow and deny specific traffic.
Security groups are stateful if you open port 80 inbound port
80 outbound is also open by default, but in networking access list.
Those are stateless, which means if you want to allow Port 80 inbound,
you have to add also another rule to allow Port
80 outbound for security groups.
All rules are evaluated before that decision
is made to allow traffic for network access.
List rules are evaluated in no order before the decision
is made to allow a traffic or to deny.
Let us now practice what we just learned trying to open a notepad
or a drawing a software like a draw that I wrote the link to use a drone
that I used to design a BBC will be in the description of this video.
You have a small business with a website
that is hosted on Amazon Easy to innocence service.
You have customer data that is stored on American database server.
You want to keep those data private, so you want to use Amazon VPC
to set up a VPC that meets the following requirements
your web server and database server must be in separate subnet.
The first address of your network must be ten 000.
Each subnet must have 256 total IPv4 addresses,
and your customers must always be able to access your web server
and your database server must be able to access the internet.
To make patch update, your architecture
must be highly available and use at least
one custom firewall layer.
And now try to practice what we have learned by building
a VPC in the management console of a WC.
So in this lab, your task is to create a VPC.
Then you create additional subnet similar to the diagram
you are seeing here,
and you want to configure around a table following the information
that you can see here in the slide
and you want to launch our observer innocence.
Now let me show you how you can build a VPC, a luncheon web server
using this demo successfully removed to go to the management console.
And then we go to the G.P.S..
And from the BBC
menu we have in the left navigation pie
with the first thing we need to do is to create an elastic IP.
So if you go here to the elastic IP.
Then you allocate
an elastic IP is going to be in the US East
because this is the region where I am now
on and OK, now we'll be able VPC.
But you could use is the BBC dashboard here
and from the BBC dashboard you will find.
So to create the BBC after we allocate the elastic IP,
we want to launch the BBC within the second option,
you can create the BBC with a single public subnet if you want.
But in this email,
I want to show you how to create a public and private subnet.
Similar to what we are going
to do in the lab, I'm going to call this animal.
Now this is going to be in the fascinating zone
for my public, public and private public, and I'm going to
give my nephew who is going to take the elastic
IP that I just taken, so I don't know.
Click on Create ABC.
Once this BBC everything, you can use it to launch a new
since the launch of a private investments in the private
or public with satellite in the public.
So my view
this is really, you know, so all in can do is to go.
And this that I did the right thing for in this visit,
so I'm going to go to the easy-to-use.
From the 82,
I'm going to lunch and see, for instance.
We go to extensive lunch, and in this sense,
the list, the best one, which is the Amazon Linux two, am I?
I'm going to kill the default configuration here.
I want to place this in my limo, VPC.
I want it to be in my public submit, not in my private subnet.
I want to enable also assigned public IP.
And here in the user data, I'm going just to paste a demo script
that I will leave inscription if you want to try this later on.
This is going to install a demo application
to test our configuration.
Add the storage tag for the comfier you can just send me right when.
And this
name is going to be with survey and selection of security.
This is going to be in line with security who?
I will add to it all history.
And this is going to be from anywhere.
Review and I'm going to launch it
with the people I have there.
And now they're on a lot.
Now, this should take a few minutes to be available.
No, this is impending a state.
Ridiculous, wait for this to be a better bill,
all we need to do is to copy the IP address, the public IP address,
and that we can see the DMA application.
Now the satellite is really cool and selected from the checkbox.
It will display the details of this web server, Adobe
the IP address and open the new cut and paste it.
You should be able to see the demo application.
So this is pretty much what you need to do in order to create.
Thank you for seeing this video and see you in the next one.