IP Networking in AWS - Speaker Deck

Slide 1

Slide 1 text

IP Networking in AWS Mark Wolfe @ Versent

Slide 2

Slide 2 text

Welcome • @wolfeidau on Twitter • https://github.com/wolfeidau • APN Ambassador @ Versent

Slide 3

Slide 3 text

IP Networking in AWS? • Most common type is IPv4 addressing • VPC requires at least one CIDR • CIDR (Classless Inter-Domain Routing) • More Efﬁcient use of IPv4 address space • Uses private RFC 1918 ranges

Slide 4

Slide 4 text

Before we Start • Keep it simple • Plan for the future, don't build the future now • Build only what you need • Lay the ground work for a solid AWS network

Slide 5

Slide 5 text

What do I need? • Keep a register of IPv4 range allocations • https://spritelink.github.io/NIPAP/ • DNS, using route53 • Secrets, using AWS Secret Service and SSM • X509 certiﬁcates, using AWS Certiﬁcate manager

Slide 6

Slide 6 text

Opensource • Start with Open Source, peer reviewed designs • https://github.com/widdix/aws-cf-templates • Comes with great documentation! • Great baseline / checklist • Another grab bag of templates by AWS • https://github.com/aws-samples/startup-kit- templates

Slide 7

Slide 7 text

VPC with private and public subnets in two Availability Zones https://templates.cloudonaut.io/en/stable/vpc/

Slide 8

Slide 8 text

What makes a VPC? • Made up of AWS Resources • Subnets • Routes • Security Groups • Internet Gateways (IGW) • VPNs • VPC Endpoints • More every reinvent..

Slide 9

Slide 9 text

Just Getting Started? • VPC Fundamentals and Connectivity Options (NET201) by Gina Morris • https://www.youtube.com/watch?v=jZAvKgqlrjY

Slide 10

Slide 10 text

Onto the New Stuff

Slide 11

Slide 11 text

VPC Peering

Slide 12

Slide 12 text

Transit Gateway • Dynamic and static layer 3 routing between Amazon Virtual Private Clouds (VPCs) and VPN • VPN connections between your AWS Transit Gateway and on-premises gateways using VPN • AWS Transit Gateway provides monitoring via cloudwatch metrics / logs

Slide 13

Slide 13 text

No content

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

Transit VPC? • This option is best suited for customers with the following use case/ requirements: • AWS resources in spoke VPCs need access to a wide variety of on- premises infrastructure • The required on-premises resources are extremely difﬁcult to replicate or proxy (e.g., proprietary mainframe protocols) • They are implementing a hybrid architecture with complex network- routing requirements • Their security or compliance programs require additional network- based monitoring or ﬁltering between AWS and on-premises resources • Day 1 CloudFormation support!

Slide 16

Slide 16 text

Learn More! • Introducing AWS Transit Gateway (NET331) • https://www.youtube.com/watch?v=yQGxPEGt_-w • Advanced VPC Design and New Capabilities for Amazon VPC (NET303) • https://www.youtube.com/watch?v=fnxXNZdf6ew • NOTE: This talk covers new Client <-> VPC VPN support!

Slide 17

Slide 17 text

AWS Resource Access Manager • Create resources centrally • Govern consumption of shared resources • View usage details for shared resources • This covers: • Subnets!? • Resolver Rules • License Conﬁguration • Transit Gateways

Slide 18

Slide 18 text

Shared VPCs • Share one or more subnets from a central shared service account • Enable other accounts to launch compute resources into that VPC • Windows • I need active directory, along with a raft of other centralised services to support a domain joined ﬂeet of servers • “Security” software with a centralised controller

Slide 19

Slide 19 text

Private Link • create your own application in your VPC and conﬁgure it to be imported like any other endpoint service. • Requires an NLB to front your service • Supports overlapping IPv4 ranges between servers and consumers • Managed workﬂow for sharing / requesting access to a VPC Endpoint using this service • This allows VPCs to be totally hidden from the consuming services • DNS is kinda magic*

Slide 20

Slide 20 text

Private Link

Slide 21

Slide 21 text

In Summary • IP Networking in AWS is constantly changing, always review the manual. • Watch reinvent VPC introduction videos each year at least, refreshing knowledge is key. • Keep things as simple as possible but no simpler • Use off the shelf patterns as a starting point, standing on the shoulders of giants.

Slide 22

Slide 22 text

Questions • https://www.versent.com.au • https://www.stax.io/ • We are hiring! • wolfeidau on twitter / GitHub

Slide 23

Slide 23 text

Links • https://www.keycdn.com/support/what-is-cidr • https://aws.amazon.com/answers/networking/aws-multiple-vpc-vpn- connection-sharing/ • AWS Security Hub https://aws.amazon.com/security-hub/ • Images from: • https://unsplash.com/@marcojodoin • Marc-Olivier Jodoin • https://unsplash.com/@adele_payman • Adele Payman