If you've ever wanted to learn about AWS VPC endpoints, then this video's for you.
Hi. I'm Michael Gibbs, and I'm the founder and CEO of Go Cloud Architects. And today
we're going to be discussing VPC Endpoints. So before we begin discussing VPC endpoints,
a little quick refresher on what is a VPC? Especially because there's a little bit of
confusion out there we find with new students when it pertains to learning VPCs and VPC networking.
So a VPC, realistically speaking, is a virtual private data center. And I know people often
call it a virtual private network, but for those of us that have a networking background,
a virtual private network is effectively creating a network over a public network and then
encrypting it with IPSec or a VPN tunnel. That's where we would think of a virtual private network.
But in this case, you're not just getting a network from AWS, you're getting a data center
and the ability to your computing systems, your storage systems, your security systems. So that's
much more of a data center. So we like to think of a VPC as a virtual private data center. Now, as
you can see in this graphic, what happens is when you're using the AWS cloud, you're using their
infrastructure and it's a shared infrastructure. But even though you're on a shared infrastructure
and all of their customers are on that same shared infrastructure, they're logically separated.
So it's kind of like a virtual private network and
a virtual private data center. And even though they're in a public environment,
they're logically isolated and therefore they're effectively private environments.
So let's talk about what VPC endpoints are. And VPC endpoints are really a means of connecting
a VPC to another AWS service over the AWS network or even another organization or
another VPC over the AWS network. And that's how they're going to enable you to do things.
Now, if you are not going to use a VPC endpoint, you'd actually have to go over the internet.
And we're going to show that in a graphic in about a moment. But in this particular case,
the reason you want to use the private connectivity is with AWS your internet
connections are of limited speed. And you have to pay for data that goes out and then in back.
And since you're going to have to go pay to send your data to the internet, and it's a public
internet and your elastic network interfaces are limited to a certain speed or in your
internet gateway, the internet is going to be the slowest way to do it. But it's not just that,
if you purchase a Gigabit connection, for example, to the internet you have a Gigabit to the internet
but that doesn't mean the internet has a gig of available bandwidth to you to your destination.
And that doesn't mean that all the service providers along the way don't have congestion.
So with the internet, performance is not guaranteed. You can guarantee when you can get
to the internet, but anything can happen on the internet. But with a private line,
and in this case with the VPC endpoint, we're going to be using a private network.
You can guarantee performance, one Gigabit a second is one Gigabit a second.
You can guarantee latency, and that you can guarantee that there won't be any variations
in latency or jitter which can severely affect voice or video applications. So
when you're dealing with a private network you're going to get better performance,
lower latency. You're going to get higher security. Yes, you can encrypt your topic
on the internet and it is very secure. But if it's private, it's even more
secure and you could even encrypt your data over a private network and further secure it.
And it's actually going to be cheaper to you to not reverse to the public internet because you're
going to be charged for that. And it's going to be cheaper and faster and better. So anytime in
technology when you can achieve better, faster and cheaper, it's a definite solution for you. So
without an endpoint, as you can see in this graphic I've got my VPC
and on my VPC I want to connect to S3. So without an endpoint you can see I'm going
up, I'm crossing the internet and I'm going back into S3.
Now, in this particular case, I actually set up endpoint communication. So with endpoint
communication it's going to go directly from my VPC to S3 through that endpoint and that
kind of private line kind of service. But it's not private link, but it's like a private line
for those networking people that are used to that. So endpoints are going to be these
super highly available, highly redundant, scalable entry points into a service. And
what happens is there's going to be multiple of these that are going to be redundant.
So when you're connecting to an endpoint, it's going to be a logical device. It's going to be
highly reliable. And there's two kinds of endpoints, and they're going to be gateway
endpoints and interface endpoints. And they're somewhat different and there's a lot of confusion
around them so that's why we did this, we're going to explain this very clearly to you.
A gateway endpoint is a high speed,
high security connection to an AWS service. But its connection to DynamoDB or Amazon S3.
That's really where you're going to be using this. And the way this works is you're going to
create the endpoint, connect to the endpoint and it's going to place a route in the routing
table to reach whatever's on that endpoint. And that's how it's going to work, it's going to be
in your VPC routing tables. And what that's going to do it's going to, as we talked about not going
over the internet, it's going to allow private access to say S3 or DynamoDB from your VPC.
Let's talk about Amazon S3 endpoints because they're the ones that are very often made and
there's a lot of confusion around this. So what's going to happen is when you create
an endpoint for S3, you're going to set up a prefix list, and VPC endpoint are kind
of created. So you've got this prefix list, and what's going to be there, it's going to
be the route that's in your routing table so you can point to whatever the resources are.
And it's not going to look like a traditional route in the routing table. It's not going to
be like we've got a subnet. And if it would be a default route you'd have
0.0.0.0/0. That would be a route you would typically see. This thing is going to look
like a pl- and you're going to have a whole bunch of numbers or letters. But the point is,
it's going to look a little different but it's really a route to the service.
And it's just going to work via traditional routing. So looking in this environment,
if you look in this graphic what you can see is we've got a VPC with two subnets. And in one of
the subnets, what we've done is we've created an endpoint pointing to S3. And you can see
in the routing table of this particular subnet that you have not only the generic route for
the VPC, that's your site or range, which is going to be local. You're going to have the
directly connected subnet which is what you're using in the VPC which is going to be local.
You're going to have a route to the internet gateway because there's an internet gateway and
that's going to be your default route. And you're also going to have the prefix list that's attached
that basically is your route to your S3 bucket. And that's how you're going to connect internally.
Now, what's really great about these kinds of endpoints is you're connecting your network
to the alternative network. So let's say for example, I have a traditional, well,
a somewhat traditional environment meaning I've got a data center, but I'm also using the cloud.
And we find many organizations have a multi-cloud environment
or a hybrid cloud environment. And this is a hybrid cloud environment.
And it's great because it enables the organization to leverage their assets
that they've purchased from technology and offload certain things to the cloud to give
them control of what they need versus outsourcing all from maybe offloading or disaster recovery.
And this could be a transition plan or this could actually be required by their organization.
Maybe they're a finance company and they need super low latency. And just the time that it would
take to go back and forth to the cloud, those few milliseconds might affect an application. And this
is not normal environment, in certain environments you always design your data centers and your cloud
environments based on your business's needs. So in this case, we've got our corporate data center
which has got a VPN connection to our VPC, and our VPC is connected via an endpoint to an S3 bucket.
Now, my corporate data center can actually access the data and the S3 bucket over our encrypted
connections, which is great. The way it's going to work is you're going to get a DNS name for the
bucket and you're going to reach these things. You're going to tell your corporate DNS server
how to reach the S3 bucket by placing an entry in there. And then all of your devices in your
corporate data center can reach the S3 bucket. And this is a great, fast, secure way to do things.
So let's talk about gateway enpoints security. Most people will tell you that, you'd set up
your endpoint policies and that'll secure, and that's true. You can set up great IAM policies,
and that's a great way to secure. But here's where it gets better,
because you're using routing, you can use routing to seriously enhance your security posture.
So if you don't have a route to a service, you can't reach it, you can hack it.
So what you can do is you can limit the routing information to the only subnets that will have the
routing information to reach the S3 bucket, for example, will be those that need it.
And therefore, all the other subnets in your organization won't be able to reach it just
because they don't have a route in the routing table. So this is things that people typically
don't remember unless they're coming from a routing perspective like me or a network
engineering perspective. If you don't have a route, you can't reach it. And if you can't
reach it, you just can't hack it. So in this case, you can actually limit your routing information.
And by using route filtering, you can make sure that only the people that need to access it are
even able to long before you get to IAM. Now the next type of endpoint we're going to talk about
is called an interface endpoint. And an interface endpoint is a way to connect to different types of
AWS services such as the Ec2 systems manager, Kinesis or the Elastic Load Balancer APIs.
But it's also a way to connect to external services hosted by AWS partners.
And it's also a way to connect VPCs to other VPCs that's different as well. But typically, you're
going to use this environment to connect to a VPC and a service VPC. And this is different than a
gateway endpoint because there's not really going to be a route on the routing table. What's going
to happen here is you're going to create this interface endpoint, and it's really effectively
like an elastic network interface in your VPC. And it's going to use your private addressing scheme.
And even though it's using your private addressing scheme,
if you're connecting to another organization that's using the same private addressing
scheme, it's not going to be a problem because the way these interface endpoints are set up
is they assume that there'll be addressing overlap and they automatically use that.
So this is a way to connect to another organization and not have to worry about
the IP address conflict between your organization and the external service.
So when you create these interface endpoints, AWS is going to generate an
endpoint specific DNS name. And that way you connect to the endpoint via its DNS name. Now,
the way these interface endpoints are connected is through something called
the private link. And a private link is kind of like a virtual private line over the AWS network.
And it uses the elastic network interface, and it really restricts all traffic between
the VPC and the customer service. So it's a great way to limit the traffic between them.
Now, you can see in this diagram here that we've got a VPC that's related to
the service provider and on the left side of this diagram,
we've got the customer. And the customer is connecting to their service provider
via the interface endpoint, which is using the private link for communication back and forth.
So think of it this way,
interface endpoints are effectively an elastic network interface in your VPC.
And you're going to use these to connect to AWS services or services hosted by other customers
or in the marketplace. And you're going to use a private address from your private address pool,
but it's not going to be a problem because when you're connecting to the external service provider
none is automatically used. And let's talk about the difference because you could use VPC
peering to connect a VPC and another VPC service provider, but there's some subtle differences.
When you do VPC peering between organizations
effectively, full access is there. Full routing information that is necessary to reach the other
side is exchanged. So in this particular case, the way you would control things is through
IAM policies and IAM roles and cross account rules and other IAM methodologies when you're
dealing with crossing things across accounts through VPC peering. But with private link,
you can basically only set up the link for whatever subnet or services necessary.
And you can filter these things ahead of time. So it's not like you could
even use the services to, the services would even be there to use in IAM policy and then block it
next. The service just won't be there. So private link is going to be a very scalable solution.
And with VPC peering, you can do a moderate number of connections. It can always change but
the last time I checked it was 125 connections that you could do with the VPC peering.
But the private link is much more scalable.
You're going to be able to achieve maximum throughput and still with thousands
of links. And what's going to happen is, the throughput will be achieved by setting load
balancers prior to your servers. But you've got very fast links and you can use low balance with
highest performance servers. So going to get much better performance and scalability with private
link as opposed to VPC peering. And with VPC peering, if two organizations are using the same
IP address space, they're not going to be able to talk to each other.
Whereas when you're using private link it's automatically using none, so you don't even have
to worry about the addressing schemes. So now you know the differences between interface endpoints,
gateway endpoints and VPC peering versus private link. We hope you've enjoyed this video very much.
Please remember we have an AWS Certified Solutions Architect Associate ebook.
All you need to pass the AWS Certified Solution Architect exam, it's available completely free.
The link is in the description below. We also do weekly mentoring for free every Monday
at 2:00 PM Eastern time, we invite people in for 90 minutes. We let them bring us any questions
as it pertains to the AWS Certified Solution Architect exam. Someone may have a question on
say, the difference between an NACL and a security group, they bring it to us, we answer them live.
We do this because we know sometimes when you're studying its hard to know everything,
and we want to do everything we can to help you pass you're Certified Solutions Architect
Associate exam, the AWS Certified Solution Architect Professional exam or any exam
that's part of your certification journey into cloud computing. Thank you so much for watching
this video. We look forward to seeing you in a new video next week. Take care.