AWS VPC PrivateLink를 이용한 네트워크 구성 전략 (Network Architecture using AWS PrivateLink) - 당근 SRE 밋업 1회

Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All
Rights Reserved. Network Architecture using AWS VPC PrivateLink AWS VPC PrivateLinkܳ ੉ਊೠ ֎౟ਕ௼ ҳࢿ ੹ۚ ߅ ߽૓ (Byungjin Park) · ௿۽٘ (Claud) · Site Reliability Engineer @ ׼Ӕಕ੉ ׼Ӕ SRE ޿স 1ഥ Aug 26, 2021

speaker ߊ಴੗ ࣗѐ Byungjin Park · posquit0.com · posquit0 Copyright
© 2021 All Rights Reserved. ߅߽૓ / @posquit0 / ௿۽٘ (Claud) (അ) Site Reliability Engineer @ ׼Ӕಕ੉ (੹) Director of Infrastructure Division @ ஠ࢎ௏ܻই (੹) Software Architect @ ১פযझ   (੹) Co-founder & Software Engineer @ ஠೒ۖ Ҵઁ೧ఊ؀ഥ DEFCON CTF ࠄࢶ 6ഥ ૓୹ ೞद௏೐ ೠҴ ࢎਊ੗ ݽ੐ ਍৔ ೠҴ੄ য়೑ࣗझ ઺ GitHub 10,000ѐ ੉࢚੄ झఋܳ ߉਷ ೐۽ં౟

Rights Reserved. intro

intro Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. ׼Ӕಕ੉ ׼Ӕ݃௄੄ ઱ਃ ࢎਊ੗ੋ ૑৉઱޹җ ز֎࢚ӂ੄ ࠛಞೣਸ ೧ѾೞҊ੗ ೧ਃ. ׼Ӕ݃௄ ೒ۖಬ ղ ׼Ӕݠפܳ ഝਊೠ рಞ ࣠Ә ઁҕ ز֎࢚ӂীࢲ ׼Ӕಕ੉ рಞѾઁ ઁҕ ׼Ӕಕ੉ח ׼Ӕ݃௄җ ߹ب ߨੋਵ۽ ੹੗Әਲ਼ ۄ੉ࣃझ ஂٙ ੺ରܳ ૓೯ ઺ী ੓যਃ. ੹੗Әਲ਼ ࢲ࠺झ ਍৔ী AWS ௿ۄ਋٘ܳ ࢎਊೞӝਤೠ ୶о ੺ର ૓೯઺ ੹੗Әਲ਼хةӏ੿ ߂ Әਲ਼ӂ ௿ۄ਋٘ ࢲ࠺झ ੉ਊ о੉٘ ١੄ ஹ೒ۄ੉঱झ ળࣻ ೙ਃ

All Rights Reserved. AWS VPC ࢚੄ ݎ ো҅ ޙઁ ݾ੸ী ٮۄ ܻ࠙ ػ ৈ۞ VPCܳ যڌѱ োѾೡ ࣻ ੓ਸө? ѐߊ੗о VPC੄ Private ৔৉ী ੽Ӕೡ ࣻ ੓ب۾ ઁҕೞ۰ݶ? AWS VPCীࢲ ੋఠ֔ਸ ాೞ૑ ঋҊ S3, ECR, KMS ١੄ ࢲ࠺झܳ ഐ୹ೡ ࣻ হਸө? ࢎޖप ֎౟ਕ௼৬ AWS VPCܳ উ੹ೞѱ োѾೞҊ र਷ؘ? ؀৻ӝҙҗ दझమ ো҅ܳ ೧ঠೞחؘ যڌѱ ೞ૑?

All Rights Reserved. AWS VPC ࢚੄ ݎ ো҅ ޙઁ ݾ੸ী ٮۄ ܻ࠙ ػ ৈ۞ VPCܳ যڌѱ োѾೡ ࣻ ੓ਸө? ѐߊ੗о VPC੄ Private ৔৉ী ੽Ӕೡ ࣻ ੓ب۾ ઁҕೞ۰ݶ? AWS VPCীࢲ ੋఠ֔ਸ ాೞ૑ ঋҊ S3, ECR, KMS ١੄ ࢲ࠺झܳ ഐ୹ೡ ࣻ হਸө? ࢎޖप ֎౟ਕ௼৬ AWS VPCܳ উ੹ೞѱ োѾೞҊ र਷ؘ? ؀৻ӝҙҗ दझమ ো҅ܳ ೧ঠೞחؘ যڌѱ ೞ૑? AWS PrivateLink !!

All Rights Reserved. ؀৻ӝҙ दझమ ো҅ ߑߨ AWS VPC <=> AWS VPC ࢚ടੋ ҃਋ AWS VPC <=> ৡ೐ۨ޷झ ࢚ടੋ ҃਋ AWS VPC Peering / AWS PrivateLink / AWS Site-to-Site VPN / AWS Transit Gateway Software VPN AWS Direct Connect / AWS Site-to-Site VPN / AWS Transit Gateway Software VPN

Rights Reserved. concept

concept Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. AWS PrivateLink A highly available, scalable technology that enables you to privately connect your VPC to   supported AWS services, services hosted by other AWS accounts (VPC endpoint services),   and supported AWS Marketplace partner services. AWS VPC৬ ؀࢚ ࢲ࠺झ р উ੹ೠ োѾਸ ਤೠ ӝࣿ Ҋоਊࢿ (High Availability) ߂ ഛ੢ࢿ (Scalability) ઁҕ ૑ਗೞח ؀࢚ ࢲ࠺झ - AWS ࢲ࠺झ (S3, ECR, KMS ١) - ׮ܲ AWS ҅੿ ࢚ীࢲ ઁҕೞח ࢲ࠺झ (VPC Endpoint Service) - AWS ݃௄೒ۨ੉झ ࢚੄ ౵౟ց ࢲ࠺झ

All Rights Reserved. ѱ੉౟ਝ੉ ূ٘ನੋ౟ (Gateway Endpoint) ۄ਋౴ ӏ஗ਸ ాೠ AWS ࢲ࠺झী ࢎࢸ ੽Ӕ AWS Managed Pre fi x Listܳ ੉ਊೞৈ ۄ਋౴ ӏ஗ ҙܻ ೧׼ ۄ਋౴ ӏ஗੉ ੸ਊػ ࢲ࠳֔ী݅ PrivateLink ੸ਊ AWS S3 / DynamoDB ࢲ࠺झ݅ ૑ਗ Ӓ৻ ࢲ࠺झח ੉ਊࠛо ܻࣗझ ੿଼ਸ ా೧ ࣁ޻ೠ ੽Ӕઁয оמ ূ٘ನੋ౟ ੿଼ / S3 ߡఉ ੿଼ ١ ഝਊ оמ

All Rights Reserved. ੋఠಕ੉झ ূ٘ನੋ౟ (Interface Endpoint) ֎౟ਕ௼ ੋఠಕ੉झܳ ా೧ ࢎࢸ IP ࠗৈ ؀࢚ ࢲ࠺झী ؀ೠ ENIܳ ਗೞח ࢲ࠳֔ী ࢤࢿ (Multi-AZ ૑ਗ) ׮নೠ ؀࢚ ࢲ࠺झী ؀೧ ੉ਊ оמ 90ѐ ੉࢚੄ AWS ࢲ࠺झ ૑ਗ ূ٘ನੋ౟ ࢲ࠺झܳ ా೧ ׮ܲ AWS ҅੿ ࢲ࠺झ োѾ ૑ਗ AWS ݃௄೒ۨ੉झ ࢲ࠺झ ૑ਗ ࠁউӒܛҗ NACLਸ ా೧ ࣁ޻ೠ ੽Ӕઁয оמ ENI੄ ࠁউӒܛ ߂ ೧׼ ࢲ࠳֔੄ NACLਸ ా೧ IP ੽Ӕઁয ূ٘ನੋ౟ ܻࣗझ ੿଼਷ ౠ੿ AWS ࢲ࠺झٜ݅ ૑ਗ ূ٘ನੋ౟ بݫੋ ߂ ࢎࢸ بݫੋ ૑ਗ AZ ߹ بݫੋ ߂ ࢲ࠺झ بݫੋ ӝࠄ ઁҕ / ࢎࢸ بݫੋ (ࢶఖ)

All Rights Reserved. ূ٘ನੋ౟ ࢲ࠺झ (Endpoint Service) ׮ܲ AWS ҅੿ীѱ ࢲ࠺झ ઁҕ ݾ੸ ࢲ࠺झ ઁҕ੗(Service Provider)   : ֎౟ਕ௼ ۽٘ߖ۠ࢲ(NLB) ഑਷ ѱ੉౟ਝ੉ ۽٘ߖ۠ࢲ(GWLB)ী ؀ೞৈ ূ٘ನੋ౟ ࢲ࠺झ ࢤࢿ ࢲ࠺झ ࣗ࠺੗(Service Consumer) / Principal   : ੋఠಕ੉झ ূ٘ನੋ౟ ഑਷ ѱ੉౟ਝ੉ ۽٘ߖ۠ࢲ ূ٘ನੋ౟ ࢤࢿ ࢎࢸ بݫੋ ઁҕ оמ ࢲ࠺झ ࣗ࠺੗о PrivateDNS ӝמਸ ഝࢿചೡ ҃਋ ೧׼ ࢎࢸ بݫੋਸ ૕੄ оמ بݫੋ ࣗਬӂ ੋૐ ೙ਃ *.company.com җ э਷ ৬ੌ٘஠٘ بݫੋ ೲਊ

Rights Reserved. problem solving

2021 All Rights Reserved. 1. VPC ࢚ীࢲ AWS ࢲ࠺झ ాन ޙઁ ੋఠಕ੉झ ূ٘ನੋ౟ ࢤࢿ - AWS ࢲ࠺झ৬੄ ాन੉ NAT GWܳ Ѣ஖૑ ঋҊ ࢎࢸ IP۽ ాन - ѱ੉౟ਝ੉ ূ٘ನੋ౟ח S3, DynamoDBী ؀೧ࢲ݅ ҳࢿ оמ - ূ٘ನੋ౟ ࢤࢿ द PrivateDNS ӝמ ഝࢿച - PrivateDNSܳ ഝࢿചೞ૑ ঋਵݶ п ࢲ࠺झ(KMS, ECR ١)৬ ాन द   ূ٘ನੋ౟ URL ૑੿ ೙ਃ $ aws secretsmanager list-secrets —endpoint-url https://vpce-xx.secretsmanager.us-west-2.vpce.amazonaws.com

Rights Reserved. troubleshooting

troubleshooting Byungjin Park · posquit0.com · posquit0 Copyright © 2021
All Rights Reserved. NLB Multi-AZ ੉ग ࢲ࠺झ ઁҕ੗ AWS az1 / az2 / az3 оਊ৔৉ ࢎਊ పझ౟ਊ ਕ௼۽٘ܳ ASG۽ 1؀ ҳࢿೞ৓ਵա az3ী ߓನؽ ࢲ࠺झ ࣗ࠺੗ AWS az1 / az2 оਊ৔৉ ࢎਊ PrivateLink ࢲ࠺झ ઁҕ੗о NLB੄   Cross-zone Load Balancing ӝמਸ ࠺ഝࢿചೠ ҃਋ ࢲ࠺झ ઁҕ੗੄ az3 ਕ௼۽٘ী ౟ې೗੉ ੹׳غ૑ ঋই   Empty reply from server য়ܨ ߊࢤ => নஏ੄ AZܳ ࢎ੹ী ੜ Ҋ۰ೞѢա, ௼۽झ ઓ ӝמ ഝࢿച ೙ਃ

summary ࣁ ઴ ਃড Byungjin Park · posquit0.com · posquit0
Copyright © 2021 All Rights Reserved. AWS PrivateLinkܳ ࢎਊೞݶ ݎ ো҅ী ੓য উ੹ೞҊ ഛ੢ࢿ ੓ח ֎౟ਕ௼ ҳࢿਸ оઉ т ࣻ ੓যਃ. AWS PrivateLink ࢲ࠺झ ઁҕ੗੄ AZ ҳࢿҗ NLB Cross-zone Load Balancing ২࣌ਸ ઱੄೧ঠ ೧ਃ. PrivateLinkܳ ৈ۞ VPC৬ ৡ೐ۨ޷झী ా೤ ੸ਊೞҊ र׮ݶ Route53 ӝמਸ ഝਊೡ ࣻ ੓যਃ. ݃૑݄ਵ۽…

ࣻಣ੸ੋ ࣗా — ૒ә X / ৔য੉ܴ / न܉৬ ୽ج
/ ైݺೠ ੿ࠁ ҕਬ ੗ਯҗ ଼੐ — מز੸ সޖ ࣻ೯ / ੗ਯ੸ ౸ױ ૌѩѱ ࢿ੢ — աࠁ׮ ڪযդ زܐ / ౱ ਕ௼ / ૌѢ਑ ࢎਊ੗ ઺ब ࢎҊ — ࢎਊ੗ о஖ ୭਋ࢶ / ࢎਊ੗৬ ੿ࢲ੸ োѾ recruiting ੄ ୡӝ ੿৘ ݯߡ۽ ೣԋ ೡ ѐߊ੗ܳ ଺ইਃ Byungjin Park · posquit0.com · posquit0 Copyright © 2021 All Rights Reserved. ੗ࣁೠ ղਊ਷ daangn.teamਸ ߑޙ೧઱ࣁਃ! :) Ѿઁ/੿࢑౱ ࢲߡ ѐߊ੗ (Java, Kotlin) ׼Ӕಕ੉ рಞѾઁ ࢲ࠺झ ѐߊ ݠפ౱ ࢲߡ ѐߊ੗ (Java, Kotlin) ׼Ӕݠפ ߂ ਬ੷ ҙܻ ࢲ࠺झ ѐߊ ؘ࠳২झ ূ૑פয(?) 4࠙ӝ ଻ਊ য়೑ ৘੿ ਋ܻח ੉ۧѱ ੌ೧ਃ ഌఖ ߂ ࠂ૑ ੗ਬ۽਍ ോо / ਬো ୹ృӔ ߂ ੤ఖӔޖ / धࢎ ߂ ׮নೠ рध ઁҕ झగ٬ ؘझ௼ or ೲݢ޻۞ ੄੗ ઁҕ / بࢲ ҳݒ ߂ Үਭ࠺ ૑ਗ

Rights Reserved. End of Document Visit my AMA (https://github.com/posquit0/ama) for any question!

AWS VPC PrivateLink를 이용한 네트워크 구성 전략 (Network Architecture using AWS PrivateLink) - 당근 SRE 밋업 1회

AWS VPC PrivateLink를 이용한 네트워크 구성 전략 (Network Architecture using AWS PrivateLink) - 당근 SRE 밋업 1회

More Decks by Byungjin Park

Other Decks in Programming

Featured

Transcript