Study Guides/AWS Cybersecurity Notes/VPC Security - Revision history

Mflavell at 20:55, 13 June 2026

2026-06-13T20:55:31Z

← Older revision		Revision as of 20:55, 13 June 2026
Line 383:		Line 383:

	Think of this as a fixed VPN to AWS.		Think of this as a fixed VPN to AWS.


			= VPC Endpoints =


			These remove the neeed for the VPC to communcate over the internet when accessing an AWS native service.

			This approach increases security and reduces latency.


			Only two endpoints are available:

			::* Interface endpoints - ENI's that connect to AWS services over PrivateLink

			::* GateWay endpoints - run by Gateway Load Balancer, allowging connections to:

			::: S3 and Dynamo DB

Mflavell: /* VPN Connections */

2026-06-13T20:40:18Z

VPN Connections

← Older revision		Revision as of 20:40, 13 June 2026
Line 336:		Line 336:
	:: Best for linking VPC to on prem.		:: Best for linking VPC to on prem.


			=== Using VPN connections ===


			Several steps are involved:


			::* Setup a VPG - this is a local representation of the VPC enabling the connection.

			::* Configue CGW - This is the customer gateway.

			::* Create a VPN connection - Between the VPN - VPC - CGW (Everytihng is stacked)

			::* Configure routing - Configure VPC to allow traffic to flow through the VPN tunnel.

	== AWS Direct connect ==		== AWS Direct connect ==

Mflavell: /* AWS Direct connect */

2026-06-13T20:35:08Z

AWS Direct connect

← Older revision		Revision as of 20:35, 13 June 2026
Line 347:		Line 347:
	:: High bandwith low latency.		:: High bandwith low latency.


			=== What is Direct Connect ===

			:: A direct connection to an AWS data center using dedicated fiber.

			:: Manged using a partner data center.

	= AWS VPN Cloud Hub =		= AWS VPN Cloud Hub =

Mflavell at 20:31, 13 June 2026

2026-06-13T20:31:44Z

← Older revision		Revision as of 20:31, 13 June 2026
Line 346:		Line 346:

	:: High bandwith low latency.		:: High bandwith low latency.


			= AWS VPN Cloud Hub =

			This allows you to secure muitiple locations with AWS VPC.

			Uses a VPG - Virtual private gateway.

			None of the sites can have overlapping IP addresses.


			The connection is made using a CGW (Customer Gateway) at each endpoint

			CloudHub managed all this.


			Think of this as a fixed VPN to AWS.

Mflavell: /* Transit Gateway */

2026-06-13T20:24:26Z

Transit Gateway

← Older revision		Revision as of 20:24, 13 June 2026
Line 317:		Line 317:
	:: All VPC's must be in the same account.		:: All VPC's must be in the same account.


			Think of Transit Gateway as a cloud router that works on a regional basis.

			:: This can centalize Direct connect and VPN

			:: It can scale to support 5,000 attachments

			:: Can segment traffic based on route tables.

			::: This can ensure speficic segments cannot communcate with each other.

	== VPN Connections ==		== VPN Connections ==

Mflavell: /* VPC Peering */

2026-06-13T19:20:19Z

VPC Peering

@@ Line 281: / Line 281: @@
 :: Traffic can flow like they are the same network.
-:: Can be in the same region, or different regions but in the same AWS account.
+:: Can be in the same region, or different regions.
 == Transit Gateway ==

Mflavell: /* Networking VPC's Together */

2026-06-13T19:12:31Z

Networking VPC's Together

← Older revision		Revision as of 19:12, 13 June 2026
Line 274:		Line 274:

	= Networking VPC's Together =		= Networking VPC's Together =

			== VPC Peering ==

			:: Connect two VPC's with a direct private connection.

			:: Traffic can flow like they are the same network.

			:: Can be in the same region, or different regions but in the same AWS account.


			== Transit Gateway ==

			:: Connects multiple VPC's based on a hub and spoke model.

			:: Makes routing more simple.

			:: Is independent of the region.

			:: All VPC's must be in the same account.


			== VPN Connections ==

			:: Secure connection between the VPC and a private network.

			:: Uses public internet.

			:: Best for linking VPC to on prem.


			== AWS Direct connect ==

			:: Dedicated private connection to the VPC.

			:: For the on-prem to AWS link.

			:: More reliable than a VPN (fewer moving parts).

			:: High bandwith low latency.

Mflavell: /* Public and Private Subnets */

2026-06-13T19:03:48Z

Public and Private Subnets

← Older revision		Revision as of 19:03, 13 June 2026
Line 254:		Line 254:

	::Don't store the file on the bastion host if you do this security is pointless.		::Don't store the file on the bastion host if you do this security is pointless.


			== Internet access from the Private subnet ==


			A NAT gateway allows internet requests from a private subnet.

			:: It works like a basic home router

			:: Allows outbound traffic but does not permit inbound requests.

			:: Ideal when machines on the private subnet need to download updates.

			:: The NAT gateway will block traffic the host did not intiate (it is stateful).


			Because the gateway is managed by AWS it is more scaleable that providing your own NAT server.


			= Networking VPC's Together =

Mflavell: /* Public and Private Subnets */

2026-06-13T18:55:19Z

Public and Private Subnets

← Older revision		Revision as of 18:55, 13 June 2026
Line 186:		Line 186:

	= Public and Private Subnets =		= Public and Private Subnets =


			Subnets devide your network into logical segments.

			::The subnet mask acts as the devider between the netowrk and host portion of the address.


			Subnets improve security by breaking the network up.

			:: A single homogionous network is a bad idea!

			:: This gives you better control over resources - you have a NACL between the subnets.


			AWS has two types of subnet:

			::* Public: Can access from the internet

			::* Private: No internet access.

			::: Use the private subnet for things that should not be directly accessable from the internet, for example databases.


			What's the difference?

			::* A subnet is pubic if the IGW is attached to the VPC (data in)

			::* A route exists in the subnet with a default route to the IGW target (data out).


			When to use a public subnet:

			::* Bastion hosts - So you can connect in

			::* Public data storage.

			::* Public Websits and apps.


			== Bastion hosts ==


			::* These are essential to access EC2 instances on the private subnet.

			::* It's a hardened EC2 instance with a connection to both subnets.


			How you use them:

			:: SSH to the bastion from the public internet

			:: Copy the pem file for the destination

			:: From the bastion SSH to the protection EC2 on the private subnet.

			:: When done delete the pem file


			Harden the bastion host:

			::* Only allow the essential ports.

			::* restrict access to a range of IP addresses (if possible).


			Think about the .pem file.

			::Don't store the file on the bastion host if you do this security is pointless.

Mflavell at 18:13, 13 June 2026

2026-06-13T18:13:38Z

← Older revision		Revision as of 18:13, 13 June 2026
Line 132:		Line 132:

	::* Help you orgnaize subnets.		::* Help you orgnaize subnets.


			= NACL Notes =

			::* They are stateless - don't care about connection state.

			::: So.. you need to pair rules inbout and outbound otherwise - connection problems (it won't warn you!).


			::* Think of them as an additional layer of deffense.

			::: They work at the subnet level protecting each subnet.

			::: They DON'T work at the machine level - that is security groups.


			::* Evalaution occurs in the order of definition.


			They allow traffic to be permitted or denied based on:

			::* IP Addresses (Source / Destination)

			::* Port numbers

			::* Protocols


			NACL is vial for diffense in depth.

			:: Should not be your only defense in prod - use security groups and ALB's also.


			A NACL must be associated with a subnet '''Good exam question''' if it is not associated it will not work as designed.


			= Security Group Notes =


			Not the same as a NACL!

			::* Operate at the instance level.

			::: Think of it as a host firewall

			::: They are statefull.


			Security groups are '''Fail closed''' they don't have a deny option.

			::* If you don't expeciltly allow something it is denied.


			= Public and Private Subnets =