VPC - An analogy about shared resources
Public subnets and Internet Gateway
<aside> 🚧
This page is currently under construction. Please check back later.
</aside>
<aside> 🧑🎓
It is recommended to refresh your memory around basics network concepts by going through Week 9 - Networking and APIs from the Core Program
</aside>
VPC seem straight forward in the first place can be described as your own private network within AWS infrastructure, isolating your resources from the someone else resources and the internet and giving you full control over the network flow.
Since a VPC is one of the fundamental block over which you will build pretty much any piece of architecture and machines you will work with within AWS, there is a lot of nuances to it and not understanding this fundamental can lead to a lot of frustration down the line when working with AWS.
Because of this, we will start by using an analogy and from this analogy we will build up the knowledge of what is a VPC and how to use it.
Source: https://excalidraw.com/#json=14T1eEBY8p6F03-Jp88VA,48V5lso5ZF1bR8PbaIpkXQ
There is a planet AWS on which there are cities (called regions). Within each of these cities there is different districts (called Availability zones). In those districts there is houses and buildings that are different constructions people did for themselves.
On AWS, there is a ruler called Amazon, the ruler owns most of the infrastructures, the roads, the lands and it provides pre-made houses, building, doors, entire rooms... If you need a house it will deal with everything for you to make your house live hapilly within one of the district of one of the cities that exist on AWS planet.
One day, a stranger asked Amazon to be able to organise their own building the way they like, for example, they wanted to last floor to be on its own and isolated from all the other floors, they wanted certain rooms to be on the same floor and able to find each other...
What AWS did is to give the person a bucket of labels from A to Z (IPs within a CIDR which is the VPC) and it told them:
With those, Amazon also gave a private post office system so you can write rules on how packages from one door to another should be handled.
The person mentioned to Amazon that when they started with them, they gave them one empty building in each district of each cities.
Those, said amazon, are using your default VPC, the one I gave you at the beginning of your time on the planet. you can use it as you wish with certain restrictions that you will learn more about in the next chapters.
Now that you have your own labels to address your private resources as you wish in your buildings, I have other things to help you live happily in the city such as being able to create private path between buildings (PrivateLinks), give your post office the ability to receive and transmit packages to resources that are outside your building (Internet gateway) and much more.
This should give you all the flexibility to build each of your buildings the way you see fit while protecting them from being exposed to the internet or other habitant of the AWS planet as you see fit.
In week 2 you have quickly see that a VPC is what isolate your resources from someone else resources as well as the internet. With the new city analogy we will now be able to be more specific and precise.
What a VPC actually is, is a range (CIDR) of private addresses (That can or can not be accessible from the internet) that you can cut, assign and route as you see fit between the different services you own.
Let's take an example, let's say you have 4 machines, 2 in one AZ (district) A and 2 in another AZ (district) B in the Frankfurt region (city).
You can request a VPC with the CIDR 172.71.50.0/30 (we will see more in depth how CIDR works later within this course)
This CIDR will give you 4 private IPs:
Since you are within two availability zones (district) you need to subnets (blocks), we will have those two subnets
| Private Subnet A CIDR: 172.71.50.0/31 | Public Subnet B CIDR: 172.71.50.2/31 |
|---|---|
| IP: 172.71.50.0 | IP: 172.71.50.2 |
| IP: 172.71.50.1 | IP: 172.71.50.3 |
You now have two subnets that you can assign to availability zones and within those subnets you have 2 IPs which covers all your machines.
So now, each machine can speak to each other but that is all they can do.
The rest of this week will be dedicated to different ways you can allow those machines to speaks to one another and the rest of the internet and how you can use this to build complex interactions between different services while ensuring a secure, controlled and isolated environment for your application.
This video present another way of thinking of VPC offering more ways for you to understand the foundation of this important concept
https://www.youtube.com/watch?v=7_NNlnH7sAg&
Out of the box, AWS provides you with a default VPC in each region with one public subnet per availability zones.
This aims for you to be able to quickly start building simple things such as static website server or blogs that can be reached from the internet. If you are curious what is in the box of this VPC you can read more here.
<aside> 💭
In most projects, you will want to create one or more VPC dedicated to your cloud application. This way you can better manage from the ground your architecture and IAM/Security.
</aside>
By the end of the week you should be able to answer question such as:
For now, let's be honest 4 IP addresses will probably not be enough for your amazing application, next stop we will look more in depth into CIDR and subnets...
The HackYourFuture curriculum is licensed under CC BY-NC-SA 4.0 *https://hackyourfuture.net/*
Built with ❤️ by the HackYourFuture community · Thank you, contributors
Found a mistake or have a suggestion? Let us know in the feedback form.