Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
AWS VPC PrivateLink를 이용한 네트워크 구성 전략 (Network Ar...
Search
Byungjin Park
August 27, 2021
Programming
1
530
AWS VPC PrivateLink를 이용한 네트워크 구성 전략 (Network Architecture using AWS PrivateLink) - 당근 SRE 밋업 1회
AWS PrivateLink 서비스를 활용하여 해결할 수 있는 네트워크 문제들에 대해 살펴봅니다.
Byungjin Park
August 27, 2021
Tweet
Share
More Decks by Byungjin Park
See All by Byungjin Park
HashiConf 2023 를 다녀와서 (HashiConf 2023 Experience)
posquit0
0
84
모던 테라폼 (Modern Terraform)
posquit0
1
710
테라폼으로 ECR 관리하기 (How to Manage ECR with Terraform)
posquit0
0
860
GitHub 엔터프라이즈 어카운트 소개 및 엔터프라이즈 서버 구축 경험
posquit0
1
300
확장 가능한 테라폼 코드 관리 (Scalable Terraform Code Management)
posquit0
2
1.1k
AWS Config의 멀티 어카운트 적용 (feat. Terraform)
posquit0
1
160
Managing Kong API Gateway with Terraform
posquit0
1
1k
HashiCorp 한국 사용자 모임 소개
posquit0
1
230
[GDG DevFest Seoul 2017] JAMstack이 GitHub와 CloudFlare를 만날 때 고성능 웹 어플리케이션 호스팅은 무료가 된다
posquit0
1
180
Other Decks in Programming
See All in Programming
connect-go で面倒くささと戦う / 2024-08-27 #newmo_layerx_go
izumin5210
2
650
Increased Performance and Developer Productivity with Jakarta EE 11
ivargrimstad
0
360
サーバーレスで負荷試験!Step Functions + Lambdaを使ったk6の分散実行
shuntakahashi
6
1.6k
Pythonで改めて考える「クラス(class)」の使いどころ
os1ma
0
140
Ruby Parser progress report 2024
yui_knk
2
230
開発を加速する共有Swift Package実践
elmetal
PRO
0
420
The Sequel to a Dream of Ruby Parser's Grammar
ydah
1
220
How to Break into Reading Open Source
kaspth
2
210
エンジニア1年目で複雑なコードの改善に取り組んだ話
mtnmr
3
2k
仮想ファイルシステムを導入して開発環境のストレージ課題を解消する
segadevtech
2
550
Scala アプリケーションのビルドを改善してデプロイ時間を 1/4 にした話 | How I improved the build of my Scala application and reduced deployment time by 4x
nomadblacky
1
180
Kotlin 2.0が与えるAndroid開発の進化
masayukisuda
1
410
Featured
See All Featured
10 Git Anti Patterns You Should be Aware of
lemiorhan
653
58k
ParisWeb 2013: Learning to Love: Crash Course in Emotional UX Design
dotmariusz
109
6.9k
The Invisible Customer
myddelton
119
13k
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
29
2.2k
Gamification - CAS2011
davidbonilla
79
5k
Into the Great Unknown - MozCon
thekraken
29
1.4k
Design by the Numbers
sachag
277
19k
The Power of CSS Pseudo Elements
geoffreycrofte
71
5.3k
Java REST API Framework Comparison - PWX 2021
mraible
PRO
27
7.4k
The Mythical Team-Month
searls
218
43k
Building Better People: How to give real-time feedback that sticks.
wjessup
359
19k
Unsuck your backbone
ammeep
667
57k
Transcript
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. Network Architecture using AWS VPC PrivateLink AWS VPC PrivateLinkܳ ਊೠ ֎ਕ ҳࢿ ۚ ߅ ߽ (Byungjin Park) · ۽٘ (Claud) · Site Reliability Engineer @ Ӕಕ Ӕ SRE স 1ഥ Aug 26, 2021
speaker ߊ ࣗѐ Byungjin Park · posquit0.com · posquit0 Copyright
© 2021 All Rights Reserved. ߅߽ / @posquit0 / ۽٘ (Claud) (അ) Site Reliability Engineer @ Ӕಕ () Director of Infrastructure Division @ ࢎܻই () Software Architect @ ১פযझ () Co-founder & Software Engineer @ ۖ Ҵઁ೧ఊഥ DEFCON CTF ࠄࢶ 6ഥ ೞद ೠҴ ࢎਊ ݽ ೠҴ য়ࣗझ GitHub 10,000ѐ ࢚ झఋܳ ߉ ۽ં
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. intro
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. Ӕಕ Ӕ݃ ਃ ࢎਊੋ җ ز֎࢚ӂ ࠛಞೣਸ ೧ѾೞҊ ೧ਃ. Ӕ݃ ۖಬ ղ Ӕݠפܳ ഝਊೠ рಞ ࣠Ә ઁҕ ز֎࢚ӂীࢲ Ӕಕ рಞѾઁ ઁҕ Ӕಕח Ӕ݃җ ߹ب ߨੋਵ۽ Әਲ਼ ۄࣃझ ஂٙ ରܳ ೯ ী যਃ. Әਲ਼ ࢲ࠺झ ী AWS ۄ٘ܳ ࢎਊೞӝਤೠ ୶о ର ೯ Әਲ਼хةӏ ߂ Әਲ਼ӂ ۄ٘ ࢲ࠺झ ਊ о٘ ١ ஹۄझ ળࣻ ਃ
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. Әਲ਼স ֎ਕ ࠁউ ݎ ܻ࠙ Client VPN MFA In-transit Encryption ݎ ো҅ mTLS Site-to-Site VPN Auditing ਊࢶ োѾ Firewall ৻ࠗ ੋఠ֔ ాઁ
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. Әਲ਼স ֎ਕ ࠁউ ݎ ܻ࠙ Client VPN MFA In-transit Encryption ݎ ো҅ mTLS Site-to-Site VPN Auditing ਊࢶ োѾ Firewall ৻ࠗ ੋఠ֔ ాઁ
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. AWS VPC ࢚ ݎ ো҅ ޙઁ ݾী ٮۄ ܻ࠙ ػ ৈ۞ VPCܳ যڌѱ োѾೡ ࣻ ਸө? ѐߊо VPC Private ী Ӕೡ ࣻ ب۾ ઁҕೞ۰ݶ? AWS VPCীࢲ ੋఠ֔ਸ ాೞ ঋҊ S3, ECR, KMS ١ ࢲ࠺झܳ ഐೡ ࣻ হਸө? ࢎޖप ֎ਕ৬ AWS VPCܳ উೞѱ োѾೞҊ रؘ? ৻ӝҙҗ दझమ ো҅ܳ ೧ঠೞחؘ যڌѱ ೞ?
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. AWS VPC ࢚ ݎ ো҅ ޙઁ ݾী ٮۄ ܻ࠙ ػ ৈ۞ VPCܳ যڌѱ োѾೡ ࣻ ਸө? ѐߊо VPC Private ী Ӕೡ ࣻ ب۾ ઁҕೞ۰ݶ? AWS VPCীࢲ ੋఠ֔ਸ ాೞ ঋҊ S3, ECR, KMS ١ ࢲ࠺झܳ ഐೡ ࣻ হਸө? ࢎޖप ֎ਕ৬ AWS VPCܳ উೞѱ োѾೞҊ रؘ? ৻ӝҙҗ दझమ ো҅ܳ ೧ঠೞחؘ যڌѱ ೞ? AWS PrivateLink !!
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৻ӝҙ दझమ ো҅ ߑߨ AWS VPC <=> AWS VPC ࢚ടੋ ҃ AWS VPC <=> ৡۨझ ࢚ടੋ ҃ AWS VPC Peering / AWS PrivateLink / AWS Site-to-Site VPN / AWS Transit Gateway Software VPN AWS Direct Connect / AWS Site-to-Site VPN / AWS Transit Gateway Software VPN
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. concept
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. AWS PrivateLink A highly available, scalable technology that enables you to privately connect your VPC to supported AWS services, services hosted by other AWS accounts (VPC endpoint services), and supported AWS Marketplace partner services. AWS VPC৬ ࢚ ࢲ࠺झ р উೠ োѾਸ ਤೠ ӝࣿ Ҋоਊࢿ (High Availability) ߂ ഛࢿ (Scalability) ઁҕ ਗೞח ࢚ ࢲ࠺झ - AWS ࢲ࠺झ (S3, ECR, KMS ١) - ܲ AWS ҅ ࢚ীࢲ ઁҕೞח ࢲ࠺झ (VPC Endpoint Service) - AWS ݃ۨझ ࢚ ց ࢲ࠺झ
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. PrivateLink ҳࢿਃࣗ AWS PrivateLink Endpoint Endpoint Service Interface Endpoint Gateway Endpoint Gateway Load Balancer Endpoint (ࢲ࠺झ ࣗ࠺) (ࢲ࠺झ ઁҕ)
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ѱਝ ূ٘ನੋ (Gateway Endpoint) ۄ ӏਸ ాೠ AWS ࢲ࠺झী ࢎࢸ Ӕ AWS Managed Pre fi x Listܳ ਊೞৈ ۄ ӏ ҙܻ ೧ ۄ ӏ ਊػ ࢲ࠳֔ী݅ PrivateLink ਊ AWS S3 / DynamoDB ࢲ࠺झ݅ ਗ Ӓ৻ ࢲ࠺झח ਊࠛо ܻࣗझ ଼ਸ ా೧ ࣁೠ Ӕઁয оמ ূ٘ನੋ ଼ / S3 ߡఉ ଼ ١ ഝਊ оמ
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ੋఠಕझ ূ٘ನੋ (Interface Endpoint) ֎ਕ ੋఠಕझܳ ా೧ ࢎࢸ IP ࠗৈ ࢚ ࢲ࠺झী ೠ ENIܳ ਗೞח ࢲ࠳֔ী ࢤࢿ (Multi-AZ ਗ) নೠ ࢚ ࢲ࠺झী ೧ ਊ оמ 90ѐ ࢚ AWS ࢲ࠺झ ਗ ূ٘ನੋ ࢲ࠺झܳ ా೧ ܲ AWS ҅ ࢲ࠺झ োѾ ਗ AWS ݃ۨझ ࢲ࠺झ ਗ ࠁউӒܛҗ NACLਸ ా೧ ࣁೠ Ӕઁয оמ ENI ࠁউӒܛ ߂ ೧ ࢲ࠳֔ NACLਸ ా೧ IP Ӕઁয ূ٘ನੋ ܻࣗझ ଼ ౠ AWS ࢲ࠺झٜ݅ ਗ ূ٘ನੋ بݫੋ ߂ ࢎࢸ بݫੋ ਗ AZ ߹ بݫੋ ߂ ࢲ࠺झ بݫੋ ӝࠄ ઁҕ / ࢎࢸ بݫੋ (ࢶఖ)
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ূ٘ನੋ ࢲ࠺झ (Endpoint Service)
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ূ٘ನੋ ࢲ࠺झ (Endpoint Service) ܲ AWS ҅ীѱ ࢲ࠺झ ઁҕ ݾ ࢲ࠺झ ઁҕ(Service Provider) : ֎ਕ ۽٘ߖ۠ࢲ(NLB) ѱਝ ۽٘ߖ۠ࢲ(GWLB)ী ೞৈ ূ٘ನੋ ࢲ࠺झ ࢤࢿ ࢲ࠺झ ࣗ࠺(Service Consumer) / Principal : ੋఠಕझ ূ٘ನੋ ѱਝ ۽٘ߖ۠ࢲ ূ٘ನੋ ࢤࢿ ࢎࢸ بݫੋ ઁҕ оמ ࢲ࠺झ ࣗ࠺о PrivateDNS ӝמਸ ഝࢿചೡ ҃ ೧ ࢎࢸ بݫੋਸ оמ بݫੋ ࣗਬӂ ੋૐ ਃ *.company.com җ э ৬ੌ٘٘ بݫੋ ೲਊ
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. problem solving
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. য়݃ (द) AWSীࢲ EC2 ӝ߈ਵ۽ ࢲ࠺झ ࢲ࠺झ ਕ۽٘ח Private ࢲ࠳֔ীࢲ VPC ৻ࠗ AWS ࢲ࠺झ(KMS, ECR, Secrets Manager) ਊ
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ “ੋఠ֔ ݎਸ ాೞ ঋҊ AWS ࢲ࠺झ৬ ాन೧ঠ פ.”
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ ੋఠಕझ ূ٘ನੋ ࢤࢿ - AWS ࢲ࠺झ৬ ాन NAT GWܳ Ѣ ঋҊ ࢎࢸ IP۽ ాन - ѱਝ ূ٘ನੋח S3, DynamoDBী ೧ࢲ݅ ҳࢿ оמ - ূ٘ನੋ ࢤࢿ द PrivateDNS ӝמ ഝࢿച - PrivateDNSܳ ഝࢿചೞ ঋਵݶ п ࢲ࠺झ(KMS, ECR ١)৬ ాन द ূ٘ನੋ URL ਃ $ aws secretsmanager list-secrets —endpoint-url https://vpce-xx.secretsmanager.us-west-2.vpce.amazonaws.com
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ PrivateLink ਊ PrivateLink ਊ റ
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 2. AWSܳ ਊೞח ৻ӝҙҗ दझమ ো҅ “৻ӝҙ APIܳ ਊೞҊ פ. ೧ APIח хೠ ؘఠо য়оӝ ٸޙী ࠁউ ਃפ. ݅ড Ҕب AWS ࢚ী ࢲ࠺झܳ ۄݶ?”
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 2. AWSܳ ਊೞח ৻ӝҙҗ दझమ ো҅ (VPC Peering) VPC ࠁ ֢ ࢲ࠳֔ ױਤ োѾ ਬز IP ജ҃ীࢲ Ӕઁযо ө۽ ۄ ప࠶ / NACL ҙܻ ग
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 2. AWSܳ ਊೞח ৻ӝҙҗ दझమ ো҅ (PrivateLink) VPC ࠁ ֢ೞ ঋ ࢤࢿػ ENI ࠁউӒܛਸ ా೧ Ӕઁয ۄ ప࠶ / NACL ҙܻ ग হ
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. troubleshooting
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. NLB Multi-AZ ग ࢲ࠺झ ઁҕ AWS az1 / az2 / az3 оਊ ࢎਊ పझਊ ਕ۽٘ܳ ASG۽ 1 ҳࢿೞਵա az3ী ߓನؽ ࢲ࠺झ ࣗ࠺ AWS az1 / az2 оਊ ࢎਊ PrivateLink ࢲ࠺झ ઁҕо NLB Cross-zone Load Balancing ӝמਸ ࠺ഝࢿചೠ ҃ ࢲ࠺झ ઁҕ az3 ਕ۽٘ী ې ׳غ ঋই Empty reply from server য়ܨ ߊࢤ => নஏ AZܳ ࢎী ੜ Ҋ۰ೞѢա, ۽झ ઓ ӝמ ഝࢿച ਃ
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. NLB Multi-AZ ग
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “ৈ۞ VPCо ೧ ࢲ࠺झী Ӕ೧ঠ ೠݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “VPC Peeringਵ۽ ೧Ѿೡ ࣻ ঋਸө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग VPCী ENIо ࢤࢿغয VPC ࢎࢸ IPܳ ೡ ߉ ࢚కۄ ాन оמ But, ੋఠಕझ ূ٘ನੋо ઁҕೞח ূ٘ನੋ بݫੋҗ ࢎࢸ بݫੋ ࢎਊ ࠛо “VPC Peeringਵ۽ ೧Ѿೡ ࣻ ঋਸө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “Ӓր п VPC݃ ࠂਵ۽ ٜ݅ө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग Ә ޙઁ ೧Ѿ оמ But, ࢜۽ VPCо ҅ࣘ ٜ݅য ٸ݃ ҙܻ ࠗ / ҙܻನੋо ݆ইઉ ഛࢿ ڄয “Ӓր п VPC݃ ࠂਵ۽ ٜ݅ө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “PrivateDNS بݫੋݺਸ Route53 Private Hosted Zoneਸ ਊ೧ ഐझೠݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “PrivateDNS بݫੋݺਸ Route53 Private Hosted Zoneਸ ਊ೧ ഐझೠݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৡۨझ بݫੋ ग “ৡۨझ ࢚ীࢲب بݫੋ Ӕ ਃೞݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৡۨझ بݫੋ ग “Route53 Inbound Resolverܳ ా೧ DNS ਃਸ ನਕ٬೧ࠁ!”
summary ࣁ ਃড Byungjin Park · posquit0.com · posquit0
Copyright © 2021 All Rights Reserved. AWS PrivateLinkܳ ࢎਊೞݶ ݎ ো҅ী য উೞҊ ഛࢿ ח ֎ਕ ҳࢿਸ оઉ т ࣻ যਃ. AWS PrivateLink ࢲ࠺झ ઁҕ AZ ҳࢿҗ NLB Cross-zone Load Balancing ২࣌ਸ ೧ঠ ೧ਃ. PrivateLinkܳ ৈ۞ VPC৬ ৡۨझী ా ਊೞҊ रݶ Route53 ӝמਸ ഝਊೡ ࣻ যਃ. ݄݃ਵ۽…
ࣻಣੋ ࣗా — ә X / যܴ / न܉৬ ج
/ ైݺೠ ࠁ ҕਬ ਯҗ ଼ — מز সޖ ࣻ೯ / ਯ ౸ױ ૌѩѱ ࢿ — աࠁ ڪযդ زܐ / ਕ / ૌѢ ࢎਊ ब ࢎҊ — ࢎਊ о ୭ࢶ / ࢎਊ৬ ࢲ োѾ recruiting ୡӝ ݯߡ۽ ೣԋ ೡ ѐߊܳ ইਃ Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All Rights Reserved. ࣁೠ ղਊ daangn.teamਸ ߑޙ೧ࣁਃ! :) Ѿઁ/ ࢲߡ ѐߊ (Java, Kotlin) Ӕಕ рಞѾઁ ࢲ࠺झ ѐߊ ݠפ ࢲߡ ѐߊ (Java, Kotlin) Ӕݠפ ߂ ਬ ҙܻ ࢲ࠺झ ѐߊ ؘ࠳২झ ূפয(?) 4࠙ӝ ਊ য় ܻח ۧѱ ੌ೧ਃ ഌఖ ߂ ࠂ ਬ۽ ോо / ਬো ృӔ ߂ ఖӔޖ / धࢎ ߂ নೠ рध ઁҕ झగ٬ ؘझ or ೲݢ۞ ઁҕ / بࢲ ҳݒ ߂ Үਭ࠺ ਗ
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. End of Document Visit my AMA (https://github.com/posquit0/ama) for any question!