Study Guides/AWS Cybersecurity Notes/VPC Security: Difference between revisions
From Cramsession
Jump to navigationJump to search
✍️ Verified Author: Mflavell • Click to view professional profile & credentials
| Line 4: | Line 4: | ||
:* Subnets - Remember each subnet must stay within its AZ. No Multiple AZ's or regions. | :* Subnets - Remember each subnet must stay within its AZ. No Multiple AZ's or regions. | ||
:* Security groups - Think of them as firewalls assigned to the EC2 instance. | :* Security groups - Think of them as firewalls assigned to the EC2 instance. | ||
| Line 10: | Line 11: | ||
::: These are stateful - they will remember. | ::: These are stateful - they will remember. | ||
:* NACL - Network Access Control Lists | :* NACL - Network Access Control Lists | ||
| Line 16: | Line 18: | ||
::: They are evaluated in order from low to high. | ::: They are evaluated in order from low to high. | ||
::: A NACL with always be associated with a subnet. | |||
:::: If no NACL is specified for a VPC the VPC will be assigned a default NACL. | |||
:* NAT - Forwards traffic from a private subnet ot the internet or other AWS service. | :* NAT - Forwards traffic from a private subnet ot the internet or other AWS service. | ||
::: These are not secure - never use in production. | ::: These are not secure - never use in production. | ||
:* VPC Endpoint | :* VPC Endpoint | ||
::: Allows a resounce to connect you AWS VPC or AWS services without the public internet. | ::: Allows a resounce to connect you AWS VPC or AWS services without the public internet. | ||
:* AWS Direct Connect | :* AWS Direct Connect | ||
::: A direct connection to AWS - no public internet. | ::: A direct connection to AWS - no public internet. | ||
:* Elastic network interface - A virtual network card. | :* Elastic network interface - A virtual network card. | ||
== The NO NO IP addresses == | == The NO NO IP addresses == | ||
Revision as of 17:14, 13 June 2026
VPC Security
Important terms
- Subnets - Remember each subnet must stay within its AZ. No Multiple AZ's or regions.
- Security groups - Think of them as firewalls assigned to the EC2 instance.
- You can have up to 5 per instance
- These are stateful - they will remember.
- NACL - Network Access Control Lists
- Remember these are stateless - so you need to enable both directions.
- They are evaluated in order from low to high.
- A NACL with always be associated with a subnet.
- If no NACL is specified for a VPC the VPC will be assigned a default NACL.
- NAT - Forwards traffic from a private subnet ot the internet or other AWS service.
- These are not secure - never use in production.
- VPC Endpoint
- Allows a resounce to connect you AWS VPC or AWS services without the public internet.
- AWS Direct Connect
- A direct connection to AWS - no public internet.
- Elastic network interface - A virtual network card.
The NO NO IP addresses
Some IP's cannot be used.
- .0 - DUR!!
- .1 - The VPC router
- .2 - Rserved by AWS
- .3 - Reseved by AWS
- .255 - Don't think about it (broadcast address)
Basically the same as most modern networks, except AWS takes .2 and .3
Multiple VPCs
- Every region has a default VPC
- You can setup another VPC if needed.
- Remember the VPC is virtual - so setup is not a big deal.
- Their is a nominal additional cost for an another VPC.
