Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
AWS VPC PrivateLink를 이용한 네트워크 구성 전략 (Network Ar...
Search
Byungjin Park
August 27, 2021
Programming
1
570
AWS VPC PrivateLink를 이용한 네트워크 구성 전략 (Network Architecture using AWS PrivateLink) - 당근 SRE 밋업 1회
AWS PrivateLink 서비스를 활용하여 해결할 수 있는 네트워크 문제들에 대해 살펴봅니다.
Byungjin Park
August 27, 2021
Tweet
Share
More Decks by Byungjin Park
See All by Byungjin Park
HashiConf 2023 를 다녀와서 (HashiConf 2023 Experience)
posquit0
0
100
모던 테라폼 (Modern Terraform)
posquit0
1
770
테라폼으로 ECR 관리하기 (How to Manage ECR with Terraform)
posquit0
0
900
GitHub 엔터프라이즈 어카운트 소개 및 엔터프라이즈 서버 구축 경험
posquit0
1
320
확장 가능한 테라폼 코드 관리 (Scalable Terraform Code Management)
posquit0
2
1.2k
AWS Config의 멀티 어카운트 적용 (feat. Terraform)
posquit0
1
180
Managing Kong API Gateway with Terraform
posquit0
1
1.2k
HashiCorp 한국 사용자 모임 소개
posquit0
1
250
[GDG DevFest Seoul 2017] JAMstack이 GitHub와 CloudFlare를 만날 때 고성능 웹 어플리케이션 호스팅은 무료가 된다
posquit0
1
230
Other Decks in Programming
See All in Programming
生成AI時代のフルスタック開発
kenn
5
540
知識0からカンファレンスやってみたらこうなった!
syossan27
5
260
LRパーサーはいいぞ
ydah
7
1.4k
20250429 - CNTUG Meetup #67 / DevOps Taiwan Meetup #69 - Deep Dive into Tetragon: Building Runtime Security and Observability with eBPF
tico88612
0
180
プロダクトエンジニアのしごと 〜 受託 × 高難度を乗り越えるOptium開発 〜
algoartis
0
220
開発者フレンドリーで顧客も満足?Platformの秘密
algoartis
0
230
Jakarta EE Meets AI
ivargrimstad
0
910
ComposeでのPicture in Picture
takathemax
0
140
Flutterでllama.cppをつかってローカルLLMを試してみた
sakuraidayo
0
150
監視 やばい
syossan27
12
10k
ぽちぽち選択するだけでOSSを読めるVSCode拡張機能
ymbigo
14
6.3k
The Missing Link in Angular’s Signal Story: Resource API and httpResource
manfredsteyer
PRO
0
150
Featured
See All Featured
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
29
2.6k
We Have a Design System, Now What?
morganepeng
52
7.6k
Unsuck your backbone
ammeep
671
58k
Save Time (by Creating Custom Rails Generators)
garrettdimon
PRO
31
1.2k
Faster Mobile Websites
deanohume
307
31k
Visualization
eitanlees
146
16k
Rails Girls Zürich Keynote
gr2m
94
13k
Documentation Writing (for coders)
carmenintech
71
4.8k
What's in a price? How to price your products and services
michaelherold
245
12k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
160
15k
Into the Great Unknown - MozCon
thekraken
38
1.8k
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
45
7.2k
Transcript
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. Network Architecture using AWS VPC PrivateLink AWS VPC PrivateLinkܳ ਊೠ ֎ਕ ҳࢿ ۚ ߅ ߽ (Byungjin Park) · ۽٘ (Claud) · Site Reliability Engineer @ Ӕಕ Ӕ SRE স 1ഥ Aug 26, 2021
speaker ߊ ࣗѐ Byungjin Park · posquit0.com · posquit0 Copyright
© 2021 All Rights Reserved. ߅߽ / @posquit0 / ۽٘ (Claud) (അ) Site Reliability Engineer @ Ӕಕ () Director of Infrastructure Division @ ࢎܻই () Software Architect @ ১פযझ () Co-founder & Software Engineer @ ۖ Ҵઁ೧ఊഥ DEFCON CTF ࠄࢶ 6ഥ ೞद ೠҴ ࢎਊ ݽ ೠҴ য়ࣗझ GitHub 10,000ѐ ࢚ झఋܳ ߉ ۽ં
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. intro
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. Ӕಕ Ӕ݃ ਃ ࢎਊੋ җ ز֎࢚ӂ ࠛಞೣਸ ೧ѾೞҊ ೧ਃ. Ӕ݃ ۖಬ ղ Ӕݠפܳ ഝਊೠ рಞ ࣠Ә ઁҕ ز֎࢚ӂীࢲ Ӕಕ рಞѾઁ ઁҕ Ӕಕח Ӕ݃җ ߹ب ߨੋਵ۽ Әਲ਼ ۄࣃझ ஂٙ ରܳ ೯ ী যਃ. Әਲ਼ ࢲ࠺झ ী AWS ۄ٘ܳ ࢎਊೞӝਤೠ ୶о ର ೯ Әਲ਼хةӏ ߂ Әਲ਼ӂ ۄ٘ ࢲ࠺झ ਊ о٘ ١ ஹۄझ ળࣻ ਃ
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. Әਲ਼স ֎ਕ ࠁউ ݎ ܻ࠙ Client VPN MFA In-transit Encryption ݎ ো҅ mTLS Site-to-Site VPN Auditing ਊࢶ োѾ Firewall ৻ࠗ ੋఠ֔ ాઁ
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. Әਲ਼স ֎ਕ ࠁউ ݎ ܻ࠙ Client VPN MFA In-transit Encryption ݎ ো҅ mTLS Site-to-Site VPN Auditing ਊࢶ োѾ Firewall ৻ࠗ ੋఠ֔ ాઁ
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. AWS VPC ࢚ ݎ ো҅ ޙઁ ݾী ٮۄ ܻ࠙ ػ ৈ۞ VPCܳ যڌѱ োѾೡ ࣻ ਸө? ѐߊо VPC Private ী Ӕೡ ࣻ ب۾ ઁҕೞ۰ݶ? AWS VPCীࢲ ੋఠ֔ਸ ాೞ ঋҊ S3, ECR, KMS ١ ࢲ࠺झܳ ഐೡ ࣻ হਸө? ࢎޖप ֎ਕ৬ AWS VPCܳ উೞѱ োѾೞҊ रؘ? ৻ӝҙҗ दझమ ো҅ܳ ೧ঠೞחؘ যڌѱ ೞ?
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. AWS VPC ࢚ ݎ ো҅ ޙઁ ݾী ٮۄ ܻ࠙ ػ ৈ۞ VPCܳ যڌѱ োѾೡ ࣻ ਸө? ѐߊо VPC Private ী Ӕೡ ࣻ ب۾ ઁҕೞ۰ݶ? AWS VPCীࢲ ੋఠ֔ਸ ాೞ ঋҊ S3, ECR, KMS ١ ࢲ࠺झܳ ഐೡ ࣻ হਸө? ࢎޖप ֎ਕ৬ AWS VPCܳ উೞѱ োѾೞҊ रؘ? ৻ӝҙҗ दझమ ো҅ܳ ೧ঠೞחؘ যڌѱ ೞ? AWS PrivateLink !!
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৻ӝҙ दझమ ো҅ ߑߨ AWS VPC <=> AWS VPC ࢚ടੋ ҃ AWS VPC <=> ৡۨझ ࢚ടੋ ҃ AWS VPC Peering / AWS PrivateLink / AWS Site-to-Site VPN / AWS Transit Gateway Software VPN AWS Direct Connect / AWS Site-to-Site VPN / AWS Transit Gateway Software VPN
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. concept
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. AWS PrivateLink A highly available, scalable technology that enables you to privately connect your VPC to supported AWS services, services hosted by other AWS accounts (VPC endpoint services), and supported AWS Marketplace partner services. AWS VPC৬ ࢚ ࢲ࠺झ р উೠ োѾਸ ਤೠ ӝࣿ Ҋоਊࢿ (High Availability) ߂ ഛࢿ (Scalability) ઁҕ ਗೞח ࢚ ࢲ࠺झ - AWS ࢲ࠺झ (S3, ECR, KMS ١) - ܲ AWS ҅ ࢚ীࢲ ઁҕೞח ࢲ࠺झ (VPC Endpoint Service) - AWS ݃ۨझ ࢚ ց ࢲ࠺झ
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. PrivateLink ҳࢿਃࣗ AWS PrivateLink Endpoint Endpoint Service Interface Endpoint Gateway Endpoint Gateway Load Balancer Endpoint (ࢲ࠺झ ࣗ࠺) (ࢲ࠺झ ઁҕ)
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ѱਝ ূ٘ನੋ (Gateway Endpoint) ۄ ӏਸ ాೠ AWS ࢲ࠺झী ࢎࢸ Ӕ AWS Managed Pre fi x Listܳ ਊೞৈ ۄ ӏ ҙܻ ೧ ۄ ӏ ਊػ ࢲ࠳֔ী݅ PrivateLink ਊ AWS S3 / DynamoDB ࢲ࠺झ݅ ਗ Ӓ৻ ࢲ࠺झח ਊࠛо ܻࣗझ ଼ਸ ా೧ ࣁೠ Ӕઁয оמ ূ٘ನੋ ଼ / S3 ߡఉ ଼ ١ ഝਊ оמ
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ੋఠಕझ ূ٘ನੋ (Interface Endpoint) ֎ਕ ੋఠಕझܳ ా೧ ࢎࢸ IP ࠗৈ ࢚ ࢲ࠺झী ೠ ENIܳ ਗೞח ࢲ࠳֔ী ࢤࢿ (Multi-AZ ਗ) নೠ ࢚ ࢲ࠺झী ೧ ਊ оמ 90ѐ ࢚ AWS ࢲ࠺झ ਗ ূ٘ನੋ ࢲ࠺झܳ ా೧ ܲ AWS ҅ ࢲ࠺झ োѾ ਗ AWS ݃ۨझ ࢲ࠺झ ਗ ࠁউӒܛҗ NACLਸ ా೧ ࣁೠ Ӕઁয оמ ENI ࠁউӒܛ ߂ ೧ ࢲ࠳֔ NACLਸ ా೧ IP Ӕઁয ূ٘ನੋ ܻࣗझ ଼ ౠ AWS ࢲ࠺झٜ݅ ਗ ূ٘ನੋ بݫੋ ߂ ࢎࢸ بݫੋ ਗ AZ ߹ بݫੋ ߂ ࢲ࠺झ بݫੋ ӝࠄ ઁҕ / ࢎࢸ بݫੋ (ࢶఖ)
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ূ٘ನੋ ࢲ࠺झ (Endpoint Service)
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ূ٘ನੋ ࢲ࠺झ (Endpoint Service) ܲ AWS ҅ীѱ ࢲ࠺झ ઁҕ ݾ ࢲ࠺झ ઁҕ(Service Provider) : ֎ਕ ۽٘ߖ۠ࢲ(NLB) ѱਝ ۽٘ߖ۠ࢲ(GWLB)ী ೞৈ ূ٘ನੋ ࢲ࠺झ ࢤࢿ ࢲ࠺झ ࣗ࠺(Service Consumer) / Principal : ੋఠಕझ ূ٘ನੋ ѱਝ ۽٘ߖ۠ࢲ ূ٘ನੋ ࢤࢿ ࢎࢸ بݫੋ ઁҕ оמ ࢲ࠺झ ࣗ࠺о PrivateDNS ӝמਸ ഝࢿചೡ ҃ ೧ ࢎࢸ بݫੋਸ оמ بݫੋ ࣗਬӂ ੋૐ ਃ *.company.com җ э ৬ੌ٘٘ بݫੋ ೲਊ
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. problem solving
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. য়݃ (द) AWSীࢲ EC2 ӝ߈ਵ۽ ࢲ࠺झ ࢲ࠺झ ਕ۽٘ח Private ࢲ࠳֔ীࢲ VPC ৻ࠗ AWS ࢲ࠺झ(KMS, ECR, Secrets Manager) ਊ
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ “ੋఠ֔ ݎਸ ాೞ ঋҊ AWS ࢲ࠺झ৬ ాन೧ঠ פ.”
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ ੋఠಕझ ূ٘ನੋ ࢤࢿ - AWS ࢲ࠺झ৬ ాन NAT GWܳ Ѣ ঋҊ ࢎࢸ IP۽ ాन - ѱਝ ূ٘ನੋח S3, DynamoDBী ೧ࢲ݅ ҳࢿ оמ - ূ٘ನੋ ࢤࢿ द PrivateDNS ӝמ ഝࢿച - PrivateDNSܳ ഝࢿചೞ ঋਵݶ п ࢲ࠺झ(KMS, ECR ١)৬ ాन द ূ٘ನੋ URL ਃ $ aws secretsmanager list-secrets —endpoint-url https://vpce-xx.secretsmanager.us-west-2.vpce.amazonaws.com
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ PrivateLink ਊ PrivateLink ਊ റ
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 2. AWSܳ ਊೞח ৻ӝҙҗ दझమ ো҅ “৻ӝҙ APIܳ ਊೞҊ פ. ೧ APIח хೠ ؘఠо য়оӝ ٸޙী ࠁউ ਃפ. ݅ড Ҕب AWS ࢚ী ࢲ࠺झܳ ۄݶ?”
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 2. AWSܳ ਊೞח ৻ӝҙҗ दझమ ো҅ (VPC Peering) VPC ࠁ ֢ ࢲ࠳֔ ױਤ োѾ ਬز IP ജ҃ীࢲ Ӕઁযо ө۽ ۄ ప࠶ / NACL ҙܻ ग
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 2. AWSܳ ਊೞח ৻ӝҙҗ दझమ ো҅ (PrivateLink) VPC ࠁ ֢ೞ ঋ ࢤࢿػ ENI ࠁউӒܛਸ ా೧ Ӕઁয ۄ ప࠶ / NACL ҙܻ ग হ
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. troubleshooting
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. NLB Multi-AZ ग ࢲ࠺झ ઁҕ AWS az1 / az2 / az3 оਊ ࢎਊ పझਊ ਕ۽٘ܳ ASG۽ 1 ҳࢿೞਵա az3ী ߓನؽ ࢲ࠺झ ࣗ࠺ AWS az1 / az2 оਊ ࢎਊ PrivateLink ࢲ࠺झ ઁҕо NLB Cross-zone Load Balancing ӝמਸ ࠺ഝࢿചೠ ҃ ࢲ࠺झ ઁҕ az3 ਕ۽٘ী ې ׳غ ঋই Empty reply from server য়ܨ ߊࢤ => নஏ AZܳ ࢎী ੜ Ҋ۰ೞѢա, ۽झ ઓ ӝמ ഝࢿച ਃ
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. NLB Multi-AZ ग
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “ৈ۞ VPCо ೧ ࢲ࠺झী Ӕ೧ঠ ೠݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “VPC Peeringਵ۽ ೧Ѿೡ ࣻ ঋਸө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग VPCী ENIо ࢤࢿغয VPC ࢎࢸ IPܳ ೡ ߉ ࢚కۄ ాन оמ But, ੋఠಕझ ূ٘ನੋо ઁҕೞח ূ٘ನੋ بݫੋҗ ࢎࢸ بݫੋ ࢎਊ ࠛо “VPC Peeringਵ۽ ೧Ѿೡ ࣻ ঋਸө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “Ӓր п VPC݃ ࠂਵ۽ ٜ݅ө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग Ә ޙઁ ೧Ѿ оמ But, ࢜۽ VPCо ҅ࣘ ٜ݅য ٸ݃ ҙܻ ࠗ / ҙܻನੋо ݆ইઉ ഛࢿ ڄয “Ӓր п VPC݃ ࠂਵ۽ ٜ݅ө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “PrivateDNS بݫੋݺਸ Route53 Private Hosted Zoneਸ ਊ೧ ഐझೠݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “PrivateDNS بݫੋݺਸ Route53 Private Hosted Zoneਸ ਊ೧ ഐझೠݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৡۨझ بݫੋ ग “ৡۨझ ࢚ীࢲب بݫੋ Ӕ ਃೞݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৡۨझ بݫੋ ग “Route53 Inbound Resolverܳ ా೧ DNS ਃਸ ನਕ٬೧ࠁ!”
summary ࣁ ਃড Byungjin Park · posquit0.com · posquit0
Copyright © 2021 All Rights Reserved. AWS PrivateLinkܳ ࢎਊೞݶ ݎ ো҅ী য উೞҊ ഛࢿ ח ֎ਕ ҳࢿਸ оઉ т ࣻ যਃ. AWS PrivateLink ࢲ࠺झ ઁҕ AZ ҳࢿҗ NLB Cross-zone Load Balancing ২࣌ਸ ೧ঠ ೧ਃ. PrivateLinkܳ ৈ۞ VPC৬ ৡۨझী ా ਊೞҊ रݶ Route53 ӝמਸ ഝਊೡ ࣻ যਃ. ݄݃ਵ۽…
ࣻಣੋ ࣗా — ә X / যܴ / न܉৬ ج
/ ైݺೠ ࠁ ҕਬ ਯҗ ଼ — מز সޖ ࣻ೯ / ਯ ౸ױ ૌѩѱ ࢿ — աࠁ ڪযդ زܐ / ਕ / ૌѢ ࢎਊ ब ࢎҊ — ࢎਊ о ୭ࢶ / ࢎਊ৬ ࢲ োѾ recruiting ୡӝ ݯߡ۽ ೣԋ ೡ ѐߊܳ ইਃ Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All Rights Reserved. ࣁೠ ղਊ daangn.teamਸ ߑޙ೧ࣁਃ! :) Ѿઁ/ ࢲߡ ѐߊ (Java, Kotlin) Ӕಕ рಞѾઁ ࢲ࠺झ ѐߊ ݠפ ࢲߡ ѐߊ (Java, Kotlin) Ӕݠפ ߂ ਬ ҙܻ ࢲ࠺झ ѐߊ ؘ࠳২झ ূפয(?) 4࠙ӝ ਊ য় ܻח ۧѱ ੌ೧ਃ ഌఖ ߂ ࠂ ਬ۽ ോо / ਬো ృӔ ߂ ఖӔޖ / धࢎ ߂ নೠ рध ઁҕ झగ٬ ؘझ or ೲݢ۞ ઁҕ / بࢲ ҳݒ ߂ Үਭ࠺ ਗ
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. End of Document Visit my AMA (https://github.com/posquit0/ama) for any question!