Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
AWS VPC PrivateLink를 이용한 네트워크 구성 전략 (Network Ar...
Search
Byungjin Park
August 27, 2021
Programming
1
590
AWS VPC PrivateLink를 이용한 네트워크 구성 전략 (Network Architecture using AWS PrivateLink) - 당근 SRE 밋업 1회
AWS PrivateLink 서비스를 활용하여 해결할 수 있는 네트워크 문제들에 대해 살펴봅니다.
Byungjin Park
August 27, 2021
Tweet
Share
More Decks by Byungjin Park
See All by Byungjin Park
HashiConf 2023 를 다녀와서 (HashiConf 2023 Experience)
posquit0
0
110
모던 테라폼 (Modern Terraform)
posquit0
1
780
테라폼으로 ECR 관리하기 (How to Manage ECR with Terraform)
posquit0
0
920
GitHub 엔터프라이즈 어카운트 소개 및 엔터프라이즈 서버 구축 경험
posquit0
1
340
확장 가능한 테라폼 코드 관리 (Scalable Terraform Code Management)
posquit0
2
1.3k
AWS Config의 멀티 어카운트 적용 (feat. Terraform)
posquit0
1
200
Managing Kong API Gateway with Terraform
posquit0
1
1.2k
HashiCorp 한국 사용자 모임 소개
posquit0
1
260
[GDG DevFest Seoul 2017] JAMstack이 GitHub와 CloudFlare를 만날 때 고성능 웹 어플리케이션 호스팅은 무료가 된다
posquit0
1
250
Other Decks in Programming
See All in Programming
開発チーム・開発組織の設計改善スキルの向上
masuda220
PRO
18
9.9k
Ruby×iOSアプリ開発 ~共に歩んだエコシステムの物語~
temoki
0
250
フロントエンドのmonorepo化と責務分離のリアーキテクト
kajitack
2
160
More Approvers for Greater OSS and Japan Community
tkikuc
1
110
react-callを使ってダイヤログをいろんなとこで再利用しよう!
shinaps
1
180
実用的なGOCACHEPROG実装をするために / golang.tokyo #40
mazrean
1
230
「手軽で便利」に潜む罠。 Popover API を WCAG 2.2の視点で安全に使うには
taitotnk
0
740
私の後悔をAWS DMSで解決した話
hiramax
4
190
JSONataを使ってみよう Step Functionsが楽しくなる実践テクニック #devio2025
dafujii
0
410
CloudflareのChat Agent Starter Kitで簡単!AIチャットボット構築
syumai
2
430
The Past, Present, and Future of Enterprise Java
ivargrimstad
0
250
RDoc meets YARD
okuramasafumi
4
160
Featured
See All Featured
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
162
15k
Speed Design
sergeychernyshev
32
1.1k
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
12
1.1k
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
46
7.6k
Writing Fast Ruby
sferik
628
62k
Art, The Web, and Tiny UX
lynnandtonic
302
21k
Fashionably flexible responsive web design (full day workshop)
malarkey
407
66k
VelocityConf: Rendering Performance Case Studies
addyosmani
332
24k
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
49
3k
10 Git Anti Patterns You Should be Aware of
lemiorhan
PRO
656
61k
For a Future-Friendly Web
brad_frost
180
9.9k
How STYLIGHT went responsive
nonsquared
100
5.8k
Transcript
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. Network Architecture using AWS VPC PrivateLink AWS VPC PrivateLinkܳ ਊೠ ֎ਕ ҳࢿ ۚ ߅ ߽ (Byungjin Park) · ۽٘ (Claud) · Site Reliability Engineer @ Ӕಕ Ӕ SRE স 1ഥ Aug 26, 2021
speaker ߊ ࣗѐ Byungjin Park · posquit0.com · posquit0 Copyright
© 2021 All Rights Reserved. ߅߽ / @posquit0 / ۽٘ (Claud) (അ) Site Reliability Engineer @ Ӕಕ () Director of Infrastructure Division @ ࢎܻই () Software Architect @ ১פযझ () Co-founder & Software Engineer @ ۖ Ҵઁ೧ఊഥ DEFCON CTF ࠄࢶ 6ഥ ೞद ೠҴ ࢎਊ ݽ ೠҴ য়ࣗझ GitHub 10,000ѐ ࢚ झఋܳ ߉ ۽ં
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. intro
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. Ӕಕ Ӕ݃ ਃ ࢎਊੋ җ ز֎࢚ӂ ࠛಞೣਸ ೧ѾೞҊ ೧ਃ. Ӕ݃ ۖಬ ղ Ӕݠפܳ ഝਊೠ рಞ ࣠Ә ઁҕ ز֎࢚ӂীࢲ Ӕಕ рಞѾઁ ઁҕ Ӕಕח Ӕ݃җ ߹ب ߨੋਵ۽ Әਲ਼ ۄࣃझ ஂٙ ରܳ ೯ ী যਃ. Әਲ਼ ࢲ࠺झ ী AWS ۄ٘ܳ ࢎਊೞӝਤೠ ୶о ର ೯ Әਲ਼хةӏ ߂ Әਲ਼ӂ ۄ٘ ࢲ࠺झ ਊ о٘ ١ ஹۄझ ળࣻ ਃ
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. Әਲ਼স ֎ਕ ࠁউ ݎ ܻ࠙ Client VPN MFA In-transit Encryption ݎ ো҅ mTLS Site-to-Site VPN Auditing ਊࢶ োѾ Firewall ৻ࠗ ੋఠ֔ ాઁ
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. Әਲ਼স ֎ਕ ࠁউ ݎ ܻ࠙ Client VPN MFA In-transit Encryption ݎ ো҅ mTLS Site-to-Site VPN Auditing ਊࢶ োѾ Firewall ৻ࠗ ੋఠ֔ ాઁ
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. AWS VPC ࢚ ݎ ো҅ ޙઁ ݾী ٮۄ ܻ࠙ ػ ৈ۞ VPCܳ যڌѱ োѾೡ ࣻ ਸө? ѐߊо VPC Private ী Ӕೡ ࣻ ب۾ ઁҕೞ۰ݶ? AWS VPCীࢲ ੋఠ֔ਸ ాೞ ঋҊ S3, ECR, KMS ١ ࢲ࠺झܳ ഐೡ ࣻ হਸө? ࢎޖप ֎ਕ৬ AWS VPCܳ উೞѱ োѾೞҊ रؘ? ৻ӝҙҗ दझమ ো҅ܳ ೧ঠೞחؘ যڌѱ ೞ?
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. AWS VPC ࢚ ݎ ো҅ ޙઁ ݾী ٮۄ ܻ࠙ ػ ৈ۞ VPCܳ যڌѱ োѾೡ ࣻ ਸө? ѐߊо VPC Private ী Ӕೡ ࣻ ب۾ ઁҕೞ۰ݶ? AWS VPCীࢲ ੋఠ֔ਸ ాೞ ঋҊ S3, ECR, KMS ١ ࢲ࠺झܳ ഐೡ ࣻ হਸө? ࢎޖप ֎ਕ৬ AWS VPCܳ উೞѱ োѾೞҊ रؘ? ৻ӝҙҗ दझమ ো҅ܳ ೧ঠೞחؘ যڌѱ ೞ? AWS PrivateLink !!
intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৻ӝҙ दझమ ো҅ ߑߨ AWS VPC <=> AWS VPC ࢚ടੋ ҃ AWS VPC <=> ৡۨझ ࢚ടੋ ҃ AWS VPC Peering / AWS PrivateLink / AWS Site-to-Site VPN / AWS Transit Gateway Software VPN AWS Direct Connect / AWS Site-to-Site VPN / AWS Transit Gateway Software VPN
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. concept
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. AWS PrivateLink A highly available, scalable technology that enables you to privately connect your VPC to supported AWS services, services hosted by other AWS accounts (VPC endpoint services), and supported AWS Marketplace partner services. AWS VPC৬ ࢚ ࢲ࠺झ р উೠ োѾਸ ਤೠ ӝࣿ Ҋоਊࢿ (High Availability) ߂ ഛࢿ (Scalability) ઁҕ ਗೞח ࢚ ࢲ࠺झ - AWS ࢲ࠺झ (S3, ECR, KMS ١) - ܲ AWS ҅ ࢚ীࢲ ઁҕೞח ࢲ࠺झ (VPC Endpoint Service) - AWS ݃ۨझ ࢚ ց ࢲ࠺झ
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. PrivateLink ҳࢿਃࣗ AWS PrivateLink Endpoint Endpoint Service Interface Endpoint Gateway Endpoint Gateway Load Balancer Endpoint (ࢲ࠺झ ࣗ࠺) (ࢲ࠺झ ઁҕ)
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ѱਝ ূ٘ನੋ (Gateway Endpoint) ۄ ӏਸ ాೠ AWS ࢲ࠺झী ࢎࢸ Ӕ AWS Managed Pre fi x Listܳ ਊೞৈ ۄ ӏ ҙܻ ೧ ۄ ӏ ਊػ ࢲ࠳֔ী݅ PrivateLink ਊ AWS S3 / DynamoDB ࢲ࠺झ݅ ਗ Ӓ৻ ࢲ࠺झח ਊࠛо ܻࣗझ ଼ਸ ా೧ ࣁೠ Ӕઁয оמ ূ٘ನੋ ଼ / S3 ߡఉ ଼ ١ ഝਊ оמ
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ੋఠಕझ ূ٘ನੋ (Interface Endpoint) ֎ਕ ੋఠಕझܳ ా೧ ࢎࢸ IP ࠗৈ ࢚ ࢲ࠺झী ೠ ENIܳ ਗೞח ࢲ࠳֔ী ࢤࢿ (Multi-AZ ਗ) নೠ ࢚ ࢲ࠺झী ೧ ਊ оמ 90ѐ ࢚ AWS ࢲ࠺झ ਗ ূ٘ನੋ ࢲ࠺झܳ ా೧ ܲ AWS ҅ ࢲ࠺झ োѾ ਗ AWS ݃ۨझ ࢲ࠺झ ਗ ࠁউӒܛҗ NACLਸ ా೧ ࣁೠ Ӕઁয оמ ENI ࠁউӒܛ ߂ ೧ ࢲ࠳֔ NACLਸ ా೧ IP Ӕઁয ূ٘ನੋ ܻࣗझ ଼ ౠ AWS ࢲ࠺झٜ݅ ਗ ূ٘ನੋ بݫੋ ߂ ࢎࢸ بݫੋ ਗ AZ ߹ بݫੋ ߂ ࢲ࠺झ بݫੋ ӝࠄ ઁҕ / ࢎࢸ بݫੋ (ࢶఖ)
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ূ٘ನੋ ࢲ࠺झ (Endpoint Service)
concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ূ٘ನੋ ࢲ࠺झ (Endpoint Service) ܲ AWS ҅ীѱ ࢲ࠺झ ઁҕ ݾ ࢲ࠺झ ઁҕ(Service Provider) : ֎ਕ ۽٘ߖ۠ࢲ(NLB) ѱਝ ۽٘ߖ۠ࢲ(GWLB)ী ೞৈ ূ٘ನੋ ࢲ࠺झ ࢤࢿ ࢲ࠺झ ࣗ࠺(Service Consumer) / Principal : ੋఠಕझ ূ٘ನੋ ѱਝ ۽٘ߖ۠ࢲ ূ٘ನੋ ࢤࢿ ࢎࢸ بݫੋ ઁҕ оמ ࢲ࠺झ ࣗ࠺о PrivateDNS ӝמਸ ഝࢿചೡ ҃ ೧ ࢎࢸ بݫੋਸ оמ بݫੋ ࣗਬӂ ੋૐ ਃ *.company.com җ э ৬ੌ٘٘ بݫੋ ೲਊ
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. problem solving
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. য়݃ (द) AWSীࢲ EC2 ӝ߈ਵ۽ ࢲ࠺झ ࢲ࠺झ ਕ۽٘ח Private ࢲ࠳֔ীࢲ VPC ৻ࠗ AWS ࢲ࠺झ(KMS, ECR, Secrets Manager) ਊ
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ “ੋఠ֔ ݎਸ ాೞ ঋҊ AWS ࢲ࠺झ৬ ాन೧ঠ פ.”
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ ੋఠಕझ ূ٘ನੋ ࢤࢿ - AWS ࢲ࠺झ৬ ాन NAT GWܳ Ѣ ঋҊ ࢎࢸ IP۽ ాन - ѱਝ ূ٘ನੋח S3, DynamoDBী ೧ࢲ݅ ҳࢿ оמ - ূ٘ನੋ ࢤࢿ द PrivateDNS ӝמ ഝࢿച - PrivateDNSܳ ഝࢿചೞ ঋਵݶ п ࢲ࠺झ(KMS, ECR ١)৬ ాन द ূ٘ನੋ URL ਃ $ aws secretsmanager list-secrets —endpoint-url https://vpce-xx.secretsmanager.us-west-2.vpce.amazonaws.com
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ PrivateLink ਊ PrivateLink ਊ റ
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 2. AWSܳ ਊೞח ৻ӝҙҗ दझమ ো҅ “৻ӝҙ APIܳ ਊೞҊ פ. ೧ APIח хೠ ؘఠо য়оӝ ٸޙী ࠁউ ਃפ. ݅ড Ҕب AWS ࢚ী ࢲ࠺झܳ ۄݶ?”
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 2. AWSܳ ਊೞח ৻ӝҙҗ दझమ ো҅ (VPC Peering) VPC ࠁ ֢ ࢲ࠳֔ ױਤ োѾ ਬز IP ജ҃ীࢲ Ӕઁযо ө۽ ۄ ప࠶ / NACL ҙܻ ग
problem solving Byungjin Park · posquit0.com · posquit0 Copyright ©
2021 All Rights Reserved. 2. AWSܳ ਊೞח ৻ӝҙҗ दझమ ো҅ (PrivateLink) VPC ࠁ ֢ೞ ঋ ࢤࢿػ ENI ࠁউӒܛਸ ా೧ Ӕઁয ۄ ప࠶ / NACL ҙܻ ग হ
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. troubleshooting
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. NLB Multi-AZ ग ࢲ࠺झ ઁҕ AWS az1 / az2 / az3 оਊ ࢎਊ పझਊ ਕ۽٘ܳ ASG۽ 1 ҳࢿೞਵա az3ী ߓನؽ ࢲ࠺झ ࣗ࠺ AWS az1 / az2 оਊ ࢎਊ PrivateLink ࢲ࠺झ ઁҕо NLB Cross-zone Load Balancing ӝמਸ ࠺ഝࢿചೠ ҃ ࢲ࠺झ ઁҕ az3 ਕ۽٘ী ې ׳غ ঋই Empty reply from server য়ܨ ߊࢤ => নஏ AZܳ ࢎী ੜ Ҋ۰ೞѢա, ۽झ ઓ ӝמ ഝࢿച ਃ
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. NLB Multi-AZ ग
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “ৈ۞ VPCо ೧ ࢲ࠺झী Ӕ೧ঠ ೠݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “VPC Peeringਵ۽ ೧Ѿೡ ࣻ ঋਸө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग VPCী ENIо ࢤࢿغয VPC ࢎࢸ IPܳ ೡ ߉ ࢚కۄ ాन оמ But, ੋఠಕझ ূ٘ನੋо ઁҕೞח ূ٘ನੋ بݫੋҗ ࢎࢸ بݫੋ ࢎਊ ࠛо “VPC Peeringਵ۽ ೧Ѿೡ ࣻ ঋਸө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “Ӓր п VPC݃ ࠂਵ۽ ٜ݅ө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग Ә ޙઁ ೧Ѿ оמ But, ࢜۽ VPCо ҅ࣘ ٜ݅য ٸ݃ ҙܻ ࠗ / ҙܻನੋо ݆ইઉ ഛࢿ ڄয “Ӓր п VPC݃ ࠂਵ۽ ٜ݅ө?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “PrivateDNS بݫੋݺਸ Route53 Private Hosted Zoneਸ ਊ೧ ഐझೠݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৈ۞ VPC द ग “PrivateDNS بݫੋݺਸ Route53 Private Hosted Zoneਸ ਊ೧ ഐझೠݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৡۨझ بݫੋ ग “ৡۨझ ࢚ীࢲب بݫੋ Ӕ ਃೞݶ?”
troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ৡۨझ بݫੋ ग “Route53 Inbound Resolverܳ ా೧ DNS ਃਸ ನਕ٬೧ࠁ!”
summary ࣁ ਃড Byungjin Park · posquit0.com · posquit0
Copyright © 2021 All Rights Reserved. AWS PrivateLinkܳ ࢎਊೞݶ ݎ ো҅ী য উೞҊ ഛࢿ ח ֎ਕ ҳࢿਸ оઉ т ࣻ যਃ. AWS PrivateLink ࢲ࠺झ ઁҕ AZ ҳࢿҗ NLB Cross-zone Load Balancing ২࣌ਸ ೧ঠ ೧ਃ. PrivateLinkܳ ৈ۞ VPC৬ ৡۨझী ా ਊೞҊ रݶ Route53 ӝמਸ ഝਊೡ ࣻ যਃ. ݄݃ਵ۽…
ࣻಣੋ ࣗా — ә X / যܴ / न܉৬ ج
/ ైݺೠ ࠁ ҕਬ ਯҗ ଼ — מز সޖ ࣻ೯ / ਯ ౸ױ ૌѩѱ ࢿ — աࠁ ڪযդ زܐ / ਕ / ૌѢ ࢎਊ ब ࢎҊ — ࢎਊ о ୭ࢶ / ࢎਊ৬ ࢲ োѾ recruiting ୡӝ ݯߡ۽ ೣԋ ೡ ѐߊܳ ইਃ Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All Rights Reserved. ࣁೠ ղਊ daangn.teamਸ ߑޙ೧ࣁਃ! :) Ѿઁ/ ࢲߡ ѐߊ (Java, Kotlin) Ӕಕ рಞѾઁ ࢲ࠺झ ѐߊ ݠפ ࢲߡ ѐߊ (Java, Kotlin) Ӕݠפ ߂ ਬ ҙܻ ࢲ࠺झ ѐߊ ؘ࠳২झ ূפয(?) 4࠙ӝ ਊ য় ܻח ۧѱ ੌ೧ਃ ഌఖ ߂ ࠂ ਬ۽ ോо / ਬো ృӔ ߂ ఖӔޖ / धࢎ ߂ নೠ рध ઁҕ झగ٬ ؘझ or ೲݢ۞ ઁҕ / بࢲ ҳݒ ߂ Үਭ࠺ ਗ
Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. End of Document Visit my AMA (https://github.com/posquit0/ama) for any question!