What is Amazon VPC in AWS?

Posted by Online it guru on February 15th, 2021

What is Amazon VPC in AWS?

Amazon Virtual Private Cloud (Amazon VPC) allows AWS services to be launched into a virtual network you have specified. With the advantages of utilizing the flexible architecture of AWS, this virtual network closely parallels a conventional network that you can run in your own data center.

VPC ideas from Amazon (AWS)

For Amazon EC2, Amazon VPC is the networking layer.

What is Amazon EC2?

For VPCs, the following are the main concepts.

• A virtual network

You can dedicate it to your AWS account, the Virtual Private Cloud (VPC).

• Subnet:

A range of VPC IP addresses.

• Path table:

A series of rules that are used to decide where network traffic is guided, called routes.

• Internet portal,

It is a gateway that you connect to your VPC to allow for connectivity between your VPC and internet services.

• Enables you to privately connect your VPC to PrivateLink-

It is powered enabled AWS services and VPC endpoint services without the need for an internet gateway, NAT computer, VPN connection, or AWS Direct Connect connection. Your VPC instances do not need public IP addresses to connect with service services. Traffic would not leave the Amazon network between your VPC and the other provider. See AWS PrivateLink and VPC endpoints for more detail.

• Block CIDR-Classless Inter-Domain Routing.

Allocation and path aggregation technique with an internet protocol address. See Classless Inter-Domain Routing on Wikipedia for more information.

Amazon VPC Accessing

With any of the following interfaces, you can build, connect, and manage your VPCs:

• AWS Management Console:

Offers a software GUI to view the VPCs that you can use.

• AWS CLI

Provides commands for a wide range of AWS utilities, including Amazon VPC, which is supported on Windows, Mac, and Linux. AWS Command Line Interface (AWS CLI).

• AWS SDKs

These have language-specific APIs and take care of many aspects of the connection, such as measuring signatures, handling retries of requests, and handling errors.

• Query API:

It provides low-level API behavior that you use HTTPS requests to call. The most straightforward way to enter Amazon VPC is to use the Query API. But it requires your application to manage low-level information, such as generating the hash to sign the file and managing errors.

Amazon VPC pricing (AWS)

For using a VPC, there's no extra fee. There are costs for the following VPC components: VPN connectivity from site to site, Private Link, Traffic Mirroring, and a NAT gateway.

VPC quotas from Amazon

There are quotas that you can have for the amount of Amazon VPC parts. For certain of these limits, you may seek a raise.

Compliance with PCI DSS

Amazon VPC facilitates the collection, storing, and delivery by a dealer or service provider of credit card information and has been validated as compatible with the Payment Card Industry (PCI) Data Protection Standard (DSS).

Gateways on the Internet

An internet gateway is a horizontally scaled, redundant, and highly accessible VPC portion. Thus, it allows communication between your VPC and the internet.

An internet gateway serves two purposes: to provide a destination for internet-routable traffic in your VPC route tables and to perform translation of network address (NAT) for instances that have been allocated public IPv4 addresses. See Allowing Internet Access for more information.

IPv4 and IPv6 traffic is enabled by an internet gateway. This does not cause accessibility threats or bandwidth limits on your network traffic. There's no extra fee in your account for using an internet portal.

Enabling Access to the Internet

For instances of a subnet in a VPC, you must do the following to facilitate access to or from the internet.

Build a link to the internet and connect it to your VPC.

Connect a path to the routing table of your subnet that guides internet-bound traffic to the gateway of the Internet.

Ensure all instances have a globally identical IP address in your subnet (public IPv4 address, Elastic IP address, or IPv6 address).

Ensure that the control lists and protection group rules for your network access allow the relevant traffic to flow to and from your case.

Subnets for public and private access

It's classified as a public subnet if a subnet is connected with a routing table that has a route to an internet gateway. It is classified as a private subnet if a subnet is connected with a routing table and does not provide a route to an internet gateway.

In the routing table of your public subnet, you can define the Internet gateway route for all destinations that are not specifically known in the routing table (0.0.0.0/0 for IPv4 or::/0 for IPv6). Alternatively, you should scope the path to a smaller set of IP addresses; for instance, the public IPv4 addresses of the public endpoints of your business outside of AWS, or the Elastic IP addresses of other instances of Amazon EC2 outside of your VPC.

NAT and IP-addresses

To allow IPv4 Internet contact, your instance must have a public IPv4 address or an Elastic IP address that is compatible with your instance's private IPv4 address. Only the private (internal) IP address space specified within the VPC and subnet is known in your case. Logically, the internet gateway supplies the one-to-one NAT on your instance's behalf, such that when traffic exits your VPC subnet and goes to the internet, the reply address field is set to your instance's public IPv4 or Elastic IP address, and not its private IP address.

Conversely, traffic bound for the instance's public IPv4 address or Elastic IP address has its destination address converted into the private IPv4 address of the instance before the traffic is sent to the VPC.

Your VPC and subnet must have an associated IPv6 CIDR block to allow IPv6 internet communication, and an IPv6 address must be allocated to your instance from the subnet range. IPv6 addresses are identical worldwide, and therefore public by nature.

The Subnet 1 in the VPC in the following diagram is public. A custom route table that points all Internet-bound IPv4 traffic to an internet gateway is connected with it. The case has an Elastic IP address that allows the internet to connect.

Using an online gateway

You should use a NAT system instead to provide Internet access to your instances without giving them public IP addresses. A NAT interface requires private subnet instances to connect to the internet. But it forbids hosts on the internet from connecting to the instances.

Subnet formation

To link to your VPC a subnet

At https://console.aws.amazon.com/vpc/., open the Amazon VPC Console.

Select Subnets, Construct a Subnet, in the navigation window.

Specify information of the subnet as needed

• Name tag:

Have a name for your subnet as an alternative. Using this produces a tag with a name key and the attribute you specify.

• VPC:

Pick the VPC that you're building a subnet for.

• Availability Zone:

Alternatively, select an Availability Zone or Local Zone where your subnet will be located or leave the No Choice default to let AWS choose your Availability Zone.

• IPv4 CIDR block:

Define an IPv4 CIDR block, e.g. 10.0.1.0/24, for your subnet.

• IPv6 CIDR block: (Optional)

If you have connected an IPv6 CIDR block with your VPC, pick Specify a custom IPv6 CIDR. Specify or leave the default value for the hexadecimal pair value for the subnet.

• Select Build.

Conclusion

The tasks listed on this page can be executed using the command line or an API. For more information on command-line interfaces, and for a list of API actions available you can go through the AWS Online Training.