How to Improve Connectivity and Secure your VPC Resources?

Are you preparing for AWS Certified SysOps Administrator – Associate certification exam?  Are you ready to pass this AWS associate exam? In this blog, we are writing a series of articles on topics which are covered in the AWS Certified SysOps Associate certification exam. You can subscribe to us for receiving further updates on this topic.

The SysOps Associate certification exam is the hardest exam at the associate certification level. We would recommend you pass both the AWS associate architect certification exam and developer associated certification exam first before of taking this exam.

The AWS Certified SysOps Administrator – Associate exam validates technical expertise in deployment, management, and operations on the AWS platform

• SysOps Administrator Associate Practice Questions

• Free Questions for SysOps Administrator Associate

The AWS Certified SysOps Administrator – Associate Level exam validates the candidate’s ability to:

• Deliver the stability and scalability needed by a business on AWS
• Provision systems, services, and deployment automation on AWS
• Ensure data integrity and data security on AWS technology
• Provide guidance on AWS best practices
• Understand and monitor metrics on AWS

Figure #0.  Domains covered by the AWS Certified SysOps associate exam

You can download the related AWS Certified SysOps Administrator – Associate Level Exam Blueprint for more detail about it.

In this article, we are going to explain about the topic that addresses the “demonstrate the ability to implement networking features of AWS” as highlighted in the AWS Blueprint from the above exam guide.

Context

The Cloud computing provides agility for organizations. It mays increase users’ flexibility with re-provisioning, adding, or expanding technological infrastructure resources fast. Also, it could contribute to cost reductions.

It is a model for enabling ubiquitous, on-demand access to a shared pool of configurable computing resources which can be rapidly provisioned and released with minimal management effort.

You could provision a logically isolated section of the Amazon Web Services cloud where you can launch infrastructure resources and services in a virtual network that you define, like your corporate datacenter network. You have complete control over your virtual networking environment, it is called a Virtual Private Cloud (VPC).

What is Amazon VPC?

Amazon Virtual Private Cloud (Amazon VPC) enables you to launch Amazon Web Services (AWS) resources into a virtual network that you’ve defined, with the benefits of using the scalable infrastructure of AWS.

You can launch your AWS resources, such as Amazon EC2 instances, into your VPC. You can configure your VPC; you can select its IP address range, create subnets, and configure route tables, network gateways, and security settings.

You can create a VPC quickly and easily using the AWS Management Console. You can instantly scale your resources up or down, select Amazon EC2 instances types and sizes that are right for your applications, and pay only for the resources you use.

A variety of connectivity options exist for your Amazon Virtual Private Cloud:

• Connect directly to the Internet (public subnets): You can launch instances into a publicly accessible subnet where they can send and receive traffic from the Internet.
• Connect to the Internet using Network Address Translation (private subnets)– Private subnets can be used for instances that you do not want to be directly addressable from the Internet. Instances in a private subnet can access the Internet without exposing their private IP address by routing their traffic through a Network Address Translation (NAT) gateway in a public subnet.
• Connect securely to your corporate datacenter: All traffic to and from instances in your VPC can be routed to your corporate datacenter over an industry standard, encrypted IPsec hardware VPN connection.
• Connect privately to other VPCs: Peer VPCs together to share resources across multiple virtual networks owned by your or other AWS accounts.
• Connect to Amazon S3 without using an internet gateway or NAT, and control what resources, requests, or users are allowed through a VPC endpoint.

Combine connectivity methods to match the needs of your application– You can connect your VPC to both the Internet and your corporate datacenter and configure Amazon VPC route tables to direct all traffic to its proper destination.

What are the components of Amazon VPC?

Amazon VPC comprises a variety of components like the existing networks at your datacenter:

Table #1. VPC relevant concepts

Your AWS resources are automatically provisioned in a ready-to-use default VPC. You can choose to create additional VPCs by going to the Amazon VPC page in the AWS Management Console and selecting “Start VPC Wizard“, as follow:

Figure #1. Getting started with the VPC Wizard

You can modify the VPC to add more subnets or add or remove gateways at any time after the VPC has been created. You’ll be presented with the following four basic options for network architectures:

• VPC with a Single Public Subnet Only
• VPC with Public and Private Subnets
• VPC with Public and Private Subnets and Hardware VPN Access
• VPC with a Private Subnet Only and Hardware VPN Access

Accessing the Internet

Amazon VPC supports the creation of an Internet gateway. This gateway enables Amazon EC2 instances in the VPC to directly access the Internet.

You can use public IP addresses, including Elastic IP addresses (EIPs), to give instances in the VPC the ability to both directly communicate outbound to the Internet and to receive unsolicited inbound traffic from the Internet. EC2 instances without public IP addresses can route their traffic through a NAT gateway or a NAT instance to access the Internet. Also, you may use a third-party software VPN to create a site to site or remote access VPN connection with your VPC via the Internet gateway.

Securing the access to your VPC resources

Amazon VPC provides advanced security features such as security groups and network access control lists to enable inbound and outbound filtering at the instance level and subnet level.
Amazon VPC provides features that you can use to increase and monitor the security for your VPC:

• Security groups: Act as a firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the instance level
• Network access control lists (ACLs): Act as a firewall for associated subnets, controlling both inbound and outbound traffic at the subnet level
• Flow logs: Capture information about the IP traffic going to and from network interfaces in your VPC

Figure #2. Layers of security provided by security groups and network ACLs

Differences between Security Groups and NACLs

A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign the instance to up to five security groups. If you don’t specify a group at launch time, the instance is automatically assigned to the default security group for the VPC. For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic.

A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. The following table illustrates the differences between both security topics:

Table #2. Differences between Security Groups and NACLs

As the AWS Shared Responsibility Model is established, the AWS subscriber is the responsible and required to EC2 security using security groups and network ACLs.

How to modify Network Access Controls (NACLs)?

A network ACL contains a numbered list of rules that we evaluate in order, starting with the lowest numbered rule, to determine whether traffic is allowed in or out of any subnet associated with the network ACL.

A network ACL has separate inbound and outbound rules, and each rule can either allow or deny traffic. You can specify any protocol that has a standard protocol number.

Figure #3. Modifying rules into a Network ACL

 Important Points to Remember for the AWS Certified SysOps Administrator – Associate Certification exam

• Amazon VPC lets you provision a logically isolated section of the Amazon Web Services (AWS) cloud where you can launch AWS resources in a virtual network defined.
• There are no additional charges for creating and using the VPC, you pay only for the resources you use into a VPC
• EC2 instances in a private subnet can access by routing their traffic through a Network Address Translation (NAT) gateway located into a public subnet
• EC2 instances in a public subnet can browse the internet using an Internet gateway
• A network ACL allows communication between different subnets, supporting allow rules and deny rules
• The network ACL rules are evaluated in number order when deciding whether to allow traffic
• A security group allows communication between EC2 instances into a specific protocol/port
• Stateful filtering tracks the origin of a request and can automatically allow the reply to the request to be returned to the originating computer
• Traffic which is not explicitly allowed to or from an instance is automatically denied

 Glossary

Don’t MISS IT : 420 Practice Questions for SysOps Administrator Exam (50% Discount)

Summary

In this article, we have explained about the security and connectivity options provided by the Amazon Virtual Private Cloud at networking level, discussing differences between security groups and network ACLs and describing core elements located into a VPC.

References:

[1] Amazon VPC FAQs. Amazon AWS. https://aws.amazon.com/vpc/faqs
[2] Amazon VPC Documentation. Amazon AWS. https://aws.amazon.com/documentation/vpc
[3] AWS SysOps Administrator – Associate Certification. https://aws.amazon.com/certification/certified-sysops-admin-associate/
[4] AWS Glossary. Amazon AWS. http://docs.aws.amazon.com/general/latest/gr/glos-chap.html