Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
AWS VPC PrivateLink를 이용한 네트워크 구성 전략 (Network Architecture using AWS PrivateLink) - 당근 SRE 밋업 1회
Search
Byungjin Park
August 27, 2021
Programming
1
520
AWS VPC PrivateLink를 이용한 네트워크 구성 전략 (Network Architecture using AWS PrivateLink) - 당근 SRE 밋업 1회
AWS PrivateLink 서비스를 활용하여 해결할 수 있는 네트워크 문제들에 대해 살펴봅니다.
Byungjin Park
August 27, 2021
Tweet
Share
More Decks by Byungjin Park
See All by Byungjin Park
HashiConf 2023 를 다녀와서 (HashiConf 2023 Experience)
posquit0
0
78
모던 테라폼 (Modern Terraform)
posquit0
1
700
테라폼으로 ECR 관리하기 (How to Manage ECR with Terraform)
posquit0
0
850
GitHub 엔터프라이즈 어카운트 소개 및 엔터프라이즈 서버 구축 경험
posquit0
1
290
확장 가능한 테라폼 코드 관리 (Scalable Terraform Code Management)
posquit0
2
1k
AWS Config의 멀티 어카운트 적용 (feat. Terraform)
posquit0
1
150
Managing Kong API Gateway with Terraform
posquit0
1
1k
HashiCorp 한국 사용자 모임 소개
posquit0
1
220
[GDG DevFest Seoul 2017] JAMstack이 GitHub와 CloudFlare를 만날 때 고성능 웹 어플리케이션 호스팅은 무료가 된다
posquit0
1
170
Other Decks in Programming
See All in Programming
小さな開発会社を作った理由
polidog
0
1.9k
DynamoDB コスト最適化っぽいことの基本 with Terraform
kuro_kurorrr
2
250
コード生成を伴うLLMエージェント - 2024.07.18 Tokyo AI
smiyawaki0820
11
4.1k
君たちはどうコードをレビューする (される) か / 大吉祥寺.pm
utgwkk
15
8.5k
CSC307 Lecture 14
javiergs
PRO
0
220
Advanced App Shrinking Techniques
cbeyls
2
150
ぼっちを避けて楽しむためのアノテコノテ / Various Tips and Tricks to Avoid Loneliness and Have Fun
nrslib
3
1.7k
DDDを志して3年経ったら「DDDの皮を被ったクリーンアーキテクチャ」になった話【デブサミ2024夏】
texmeijin
1
620
CSC307 Lecture 09
javiergs
PRO
1
500
I/O Extended Android in Korea 2024 ~ Whats new in Android development tools
pluu
0
250
Folding Cheat Sheet #7
philipschwarz
PRO
0
150
Xcode 16のPreviewModifierと@Previewableを活用した効率的なプレビュー方法の考察
ojun9
2
160
Featured
See All Featured
Stop Working from a Prison Cell
hatefulcrawdad
266
20k
Done Done
chrislema
179
15k
Design by the Numbers
sachag
277
18k
From Idea to $5000 a Month in 5 Months
shpigford
377
46k
The Art of Programming - Codeland 2020
erikaheidi
48
13k
The Cult of Friendly URLs
andyhume
75
5.9k
ParisWeb 2013: Learning to Love: Crash Course in Emotional UX Design
dotmariusz
105
6.8k
Facilitating Awesome Meetings
lara
46
5.8k
5 minutes of I Can Smell Your CMS
philhawksworth
200
19k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
smashingmag
248
20k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
16
1.6k
It's Worth the Effort
3n
181
27k
Transcript
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. Network Architecture using AWS VPC PrivateLink AWS VPC PrivateLinkܳ ਊೠ ֎ਕ ҳࢿ ۚ ߅ ߽ (Byungjin Park) · ۽٘ (Claud) · Site Reliability Engineer @ Ӕಕ Ӕ SRE স 1ഥ Aug 26, 2021
speaker ߊ ࣗѐ Byungjin Park · posquit0.com · posquit0 Copyright
© 2021 All Rights Reserved. ߅߽ / @posquit0 / ۽٘ (Claud) (അ) Site Reliability Engineer @ Ӕಕ () Director of Infrastructure Division @ ࢎܻই () Software Architect @ ১פযझ () Co-founder & Software Engineer @ ۖ Ҵઁ೧ఊഥ DEFCON CTF ࠄࢶ 6ഥ ೞद ೠҴ ࢎਊ ݽ ೠҴ য়ࣗझ GitHub 10,000ѐ ࢚ झఋܳ ߉ ۽ં
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. intro
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. Ӕಕ Ӕ݃ ਃ ࢎਊੋ җ ز֎࢚ӂ ࠛಞೣਸ ೧ѾೞҊ ೧ਃ. Ӕ݃ ۖಬ ղ Ӕݠפܳ ഝਊೠ рಞ ࣠Ә ઁҕ ز֎࢚ӂীࢲ Ӕಕ рಞѾઁ ઁҕ Ӕಕח Ӕ݃җ ߹ب ߨੋਵ۽ Әਲ਼ ۄࣃझ ஂٙ ରܳ ೯ ী যਃ. Әਲ਼ ࢲ࠺झ ী AWS ۄ٘ܳ ࢎਊೞӝਤೠ ୶о ର ೯ Әਲ਼хةӏ ߂ Әਲ਼ӂ ۄ٘ ࢲ࠺झ ਊ о٘ ١ ஹۄझ ળࣻ ਃ
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. Әਲ਼স ֎ਕ ࠁউ ݎ ܻ࠙ Client VPN MFA In-transit Encryption ݎ ো҅ mTLS Site-to-Site VPN Auditing ਊࢶ োѾ Firewall ৻ࠗ ੋఠ֔ ాઁ
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. Әਲ਼স ֎ਕ ࠁউ ݎ ܻ࠙ Client VPN MFA In-transit Encryption ݎ ো҅ mTLS Site-to-Site VPN Auditing ਊࢶ োѾ Firewall ৻ࠗ ੋఠ֔ ాઁ
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. AWS VPC ࢚ ݎ ো҅ ޙઁ ݾী ٮۄ ܻ࠙ ػ ৈ۞ VPCܳ যڌѱ োѾೡ ࣻ ਸө? ѐߊо VPC Private ী Ӕೡ ࣻ ب۾ ઁҕೞ۰ݶ? AWS VPCীࢲ ੋఠ֔ਸ ాೞ ঋҊ S3, ECR, KMS ١ ࢲ࠺झܳ ഐೡ ࣻ হਸө? ࢎޖप ֎ਕ৬ AWS VPCܳ উೞѱ োѾೞҊ रؘ? ৻ӝҙҗ दझమ ো҅ܳ ೧ঠೞחؘ যڌѱ ೞ?
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. AWS VPC ࢚ ݎ ো҅ ޙઁ ݾী ٮۄ ܻ࠙ ػ ৈ۞ VPCܳ যڌѱ োѾೡ ࣻ ਸө? ѐߊо VPC Private ী Ӕೡ ࣻ ب۾ ઁҕೞ۰ݶ? AWS VPCীࢲ ੋఠ֔ਸ ాೞ ঋҊ S3, ECR, KMS ١ ࢲ࠺झܳ ഐೡ ࣻ হਸө? ࢎޖप ֎ਕ৬ AWS VPCܳ উೞѱ োѾೞҊ रؘ? ৻ӝҙҗ दझమ ো҅ܳ ೧ঠೞחؘ যڌѱ ೞ? AWS PrivateLink !!
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৻ӝҙ दझమ ো҅ ߑߨ AWS VPC <=> AWS VPC ࢚ടੋ ҃ AWS VPC <=> ৡۨझ ࢚ടੋ ҃ AWS VPC Peering / AWS PrivateLink / AWS Site-to-Site VPN / AWS Transit Gateway Software VPN AWS Direct Connect / AWS Site-to-Site VPN / AWS Transit Gateway Software VPN
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. concept
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. AWS PrivateLink A highly available, scalable technology that enables you to privately connect your VPC to supported AWS services, services hosted by other AWS accounts (VPC endpoint services), and supported AWS Marketplace partner services. AWS VPC৬ ࢚ ࢲ࠺झ р উೠ োѾਸ ਤೠ ӝࣿ Ҋоਊࢿ (High Availability) ߂ ഛࢿ (Scalability) ઁҕ ਗೞח ࢚ ࢲ࠺झ - AWS ࢲ࠺झ (S3, ECR, KMS ١) - ܲ AWS ҅ ࢚ীࢲ ઁҕೞח ࢲ࠺झ (VPC Endpoint Service) - AWS ݃ۨझ ࢚ ց ࢲ࠺झ
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. PrivateLink ҳࢿਃࣗ AWS PrivateLink Endpoint Endpoint Service Interface Endpoint Gateway Endpoint Gateway Load Balancer Endpoint (ࢲ࠺झ ࣗ࠺) (ࢲ࠺झ ઁҕ)
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ѱਝ ূ٘ನੋ (Gateway Endpoint) ۄ ӏਸ ాೠ AWS ࢲ࠺झী ࢎࢸ Ӕ AWS Managed Pre fi x Listܳ ਊೞৈ ۄ ӏ ҙܻ ೧ ۄ ӏ ਊػ ࢲ࠳֔ী݅ PrivateLink ਊ AWS S3 / DynamoDB ࢲ࠺झ݅ ਗ Ӓ৻ ࢲ࠺झח ਊࠛо ܻࣗझ ଼ਸ ా೧ ࣁೠ Ӕઁয оמ ূ٘ನੋ ଼ / S3 ߡఉ ଼ ١ ഝਊ оמ
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ੋఠಕझ ূ٘ನੋ (Interface Endpoint) ֎ਕ ੋఠಕझܳ ా೧ ࢎࢸ IP ࠗৈ ࢚ ࢲ࠺झী ೠ ENIܳ ਗೞח ࢲ࠳֔ী ࢤࢿ (Multi-AZ ਗ) নೠ ࢚ ࢲ࠺झী ೧ ਊ оמ 90ѐ ࢚ AWS ࢲ࠺झ ਗ ূ٘ನੋ ࢲ࠺झܳ ా೧ ܲ AWS ҅ ࢲ࠺झ োѾ ਗ AWS ݃ۨझ ࢲ࠺झ ਗ ࠁউӒܛҗ NACLਸ ా೧ ࣁೠ Ӕઁয оמ ENI ࠁউӒܛ ߂ ೧ ࢲ࠳֔ NACLਸ ా೧ IP Ӕઁয ূ٘ನੋ ܻࣗझ ଼ ౠ AWS ࢲ࠺झٜ݅ ਗ ূ٘ನੋ بݫੋ ߂ ࢎࢸ بݫੋ ਗ AZ ߹ بݫੋ ߂ ࢲ࠺झ بݫੋ ӝࠄ ઁҕ / ࢎࢸ بݫੋ (ࢶఖ)
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ূ٘ನੋ ࢲ࠺झ (Endpoint Service)
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ূ٘ನੋ ࢲ࠺झ (Endpoint Service) ܲ AWS ҅ীѱ ࢲ࠺झ ઁҕ ݾ ࢲ࠺झ ઁҕ(Service Provider) : ֎ਕ ۽٘ߖ۠ࢲ(NLB) ѱਝ ۽٘ߖ۠ࢲ(GWLB)ী ೞৈ ূ٘ನੋ ࢲ࠺झ ࢤࢿ ࢲ࠺झ ࣗ࠺(Service Consumer) / Principal : ੋఠಕझ ূ٘ನੋ ѱਝ ۽٘ߖ۠ࢲ ূ٘ನੋ ࢤࢿ ࢎࢸ بݫੋ ઁҕ оמ ࢲ࠺झ ࣗ࠺о PrivateDNS ӝמਸ ഝࢿചೡ ҃ ೧ ࢎࢸ بݫੋਸ оמ بݫੋ ࣗਬӂ ੋૐ ਃ *.company.com җ э ৬ੌ٘٘ بݫੋ ೲਊ
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. problem solving
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. য়݃ (द) AWSীࢲ EC2 ӝ߈ਵ۽ ࢲ࠺झ ࢲ࠺झ ਕ۽٘ח Private ࢲ࠳֔ীࢲ VPC ৻ࠗ AWS ࢲ࠺झ(KMS, ECR, Secrets Manager) ਊ
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ “ੋఠ֔ ݎਸ ాೞ ঋҊ AWS ࢲ࠺झ৬ ాन೧ঠ פ.”
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ ੋఠಕझ ূ٘ನੋ ࢤࢿ - AWS ࢲ࠺झ৬ ాन NAT GWܳ Ѣ ঋҊ ࢎࢸ IP۽ ాन - ѱਝ ূ٘ನੋח S3, DynamoDBী ೧ࢲ݅ ҳࢿ оמ - ূ٘ನੋ ࢤࢿ द PrivateDNS ӝמ ഝࢿച - PrivateDNSܳ ഝࢿചೞ ঋਵݶ п ࢲ࠺झ(KMS, ECR ١)৬ ాन द ূ٘ನੋ URL ਃ $ aws secretsmanager list-secrets —endpoint-url https://vpce-xx.secretsmanager.us-west-2.vpce.amazonaws.com
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ PrivateLink ਊ PrivateLink ਊ റ
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 2. AWSܳ ਊೞח ৻ӝҙҗ दझమ ো҅ “৻ӝҙ APIܳ ਊೞҊ פ. ೧ APIח хೠ ؘఠо য়оӝ ٸޙী ࠁউ ਃפ. ݅ড Ҕب AWS ࢚ী ࢲ࠺झܳ ۄݶ?”
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 2. AWSܳ ਊೞח ৻ӝҙҗ दझమ ো҅ (VPC Peering) VPC ࠁ ֢ ࢲ࠳֔ ױਤ োѾ ਬز IP ജ҃ীࢲ Ӕઁযо ө۽ ۄ ప࠶ / NACL ҙܻ ग
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 2. AWSܳ ਊೞח ৻ӝҙҗ दझమ ো҅ (PrivateLink) VPC ࠁ ֢ೞ ঋ ࢤࢿػ ENI ࠁউӒܛਸ ా೧ Ӕઁয ۄ ప࠶ / NACL ҙܻ ग হ
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. troubleshooting
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. NLB Multi-AZ ग ࢲ࠺झ ઁҕ AWS az1 / az2 / az3 оਊ ࢎਊ పझਊ ਕ۽٘ܳ ASG۽ 1 ҳࢿೞਵա az3ী ߓನؽ ࢲ࠺झ ࣗ࠺ AWS az1 / az2 оਊ ࢎਊ PrivateLink ࢲ࠺झ ઁҕо NLB Cross-zone Load Balancing ӝמਸ ࠺ഝࢿചೠ ҃ ࢲ࠺झ ઁҕ az3 ਕ۽٘ী ې ׳غ ঋই Empty reply from server য়ܨ ߊࢤ => নஏ AZܳ ࢎী ੜ Ҋ۰ೞѢա, ۽झ ઓ ӝמ ഝࢿച ਃ
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. NLB Multi-AZ ग
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “ৈ۞ VPCо ೧ ࢲ࠺झী Ӕ೧ঠ ೠݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “VPC Peeringਵ۽ ೧Ѿೡ ࣻ ঋਸө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग VPCী ENIо ࢤࢿغয VPC ࢎࢸ IPܳ ೡ ߉ ࢚కۄ ాन оמ But, ੋఠಕझ ূ٘ನੋо ઁҕೞח ূ٘ನੋ بݫੋҗ ࢎࢸ بݫੋ ࢎਊ ࠛо “VPC Peeringਵ۽ ೧Ѿೡ ࣻ ঋਸө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “Ӓր п VPC݃ ࠂਵ۽ ٜ݅ө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग Ә ޙઁ ೧Ѿ оמ But, ࢜۽ VPCо ҅ࣘ ٜ݅য ٸ݃ ҙܻ ࠗ / ҙܻನੋо ݆ইઉ ഛࢿ ڄয “Ӓր п VPC݃ ࠂਵ۽ ٜ݅ө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “PrivateDNS بݫੋݺਸ Route53 Private Hosted Zoneਸ ਊ೧ ഐझೠݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “PrivateDNS بݫੋݺਸ Route53 Private Hosted Zoneਸ ਊ೧ ഐझೠݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৡۨझ بݫੋ ग “ৡۨझ ࢚ীࢲب بݫੋ Ӕ ਃೞݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৡۨझ بݫੋ ग “Route53 Inbound Resolverܳ ా೧ DNS ਃਸ ನਕ٬೧ࠁ!”
summary ࣁ ਃড Byungjin Park · posquit0.com · posquit0
Copyright © 2021 All Rights Reserved. AWS PrivateLinkܳ ࢎਊೞݶ ݎ ো҅ী য উೞҊ ഛࢿ ח ֎ਕ ҳࢿਸ оઉ т ࣻ যਃ. AWS PrivateLink ࢲ࠺झ ઁҕ AZ ҳࢿҗ NLB Cross-zone Load Balancing ২࣌ਸ ೧ঠ ೧ਃ. PrivateLinkܳ ৈ۞ VPC৬ ৡۨझী ా ਊೞҊ रݶ Route53 ӝמਸ ഝਊೡ ࣻ যਃ. ݄݃ਵ۽…
ࣻಣੋ ࣗా — ә X / যܴ / न܉৬ ج
/ ైݺೠ ࠁ ҕਬ ਯҗ ଼ — מز সޖ ࣻ೯ / ਯ ౸ױ ૌѩѱ ࢿ — աࠁ ڪযդ زܐ / ਕ / ૌѢ ࢎਊ ब ࢎҊ — ࢎਊ о ୭ࢶ / ࢎਊ৬ ࢲ োѾ recruiting ୡӝ ݯߡ۽ ೣԋ ೡ ѐߊܳ ইਃ Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All Rights Reserved. ࣁೠ ղਊ daangn.teamਸ ߑޙ೧ࣁਃ! :) Ѿઁ/ ࢲߡ ѐߊ (Java, Kotlin) Ӕಕ рಞѾઁ ࢲ࠺झ ѐߊ ݠפ ࢲߡ ѐߊ (Java, Kotlin) Ӕݠפ ߂ ਬ ҙܻ ࢲ࠺झ ѐߊ ؘ࠳২झ ূפয(?) 4࠙ӝ ਊ য় ܻח ۧѱ ੌ೧ਃ ഌఖ ߂ ࠂ ਬ۽ ോо / ਬো ృӔ ߂ ఖӔޖ / धࢎ ߂ নೠ рध ઁҕ झగ٬ ؘझ or ೲݢ۞ ઁҕ / بࢲ ҳݒ ߂ Үਭ࠺ ਗ
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. End of Document Visit my AMA (https://github.com/posquit0/ama) for any question!