AWS VPC Fundamentals- Webinar
•Download as PPTX, PDF•
1 like•968 views
Apresentação utilizada no Webinar Tech Talks de Junho
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to AWS VPC Fundamentals- Webinar
Similar to AWS VPC Fundamentals- Webinar (20)
More from Amazon Web Services LATAM
More from Amazon Web Services LATAM (20)
Recently uploaded
Recently uploaded (20)
AWS VPC Fundamentals- Webinar
- 1. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Mv – Marcus Vinicius Ferreira / Claick Oliveira Solution Architect Team, Public Sector, Education Junho/2019 AWS: VPC Fundamentals VPC, Subnets, Security Groups
- 2. Mv – Marcus Vinicius Ferreira mvferr@amazon.com SolutionsArchitect BR, Public Sector, Education Mv
- 3. Claick Oliveira claicko@amazon.com SolutionsArchitect BR, Public Sector, Education Claick
- 4. AWS Agenda AWS VPC AWS Global Infrastructure AWS Subnets AWS Security Groups AWS VPC Best Practices AWS DevOps: CloudFormation
- 5. AWS VPC
- 6. AWS VPC: Getting Started https://aws.amazon.com/vpc/details/
- 9. Region New Region Coming Soon Edge Location Region & Number of Availability Zones# The Global Infrastructure
- 11. AWS VPC: reference architecture 172.31.0.0/16 sa-east-1a sa-east-1b sa-east-1c
- 12. AWS Subnets
- 13. Logical Layer Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c
- 14. Creating your VPC 10.100.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c
- 17. Creating your VPC 10.100.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c
- 18. Creating your VPC 172.31.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c
- 19. Creating your VPC 192.168.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c
- 20. 172.31.11.0/24 172.31.21.0/24 172.31.31.0/24 Creating your VPC 172.31.0.0/16 Availability Zone Availability Zone Availability Zone VPC subnet VPC subnet VPC subnet sa-east-1a sa-east-1b sa-east-1c
- 21. 172.31.11.0/24 172.31.21.0/24 172.31.31.0/24 Creating your VPC 172.31.0.0/16 Availability Zone Availability Zone Availability Zone VPC subnet VPC subnet VPC subnet sa-east-1a sa-east-1b sa-east-1c VPC subnet VPC subnet VPC subnet 172.31.12.0/24 172.31.22.0/24 172.31.32.0/24
- 22. 172.31.11.0/24 172.31.21.0/24 172.31.31.0/24 Creating your VPC 172.31.0.0/16 Availability Zone Availability Zone Availability Zone VPC subnet sa-east-1a sa-east-1b sa-east-1c VPC subnet VPC subnet 172.31.13.0/24 172.31.23.0/24 172.31.33.0/24 172.31.12.0/24 172.31.22.0/24 172.31.32.0/24
- 23. 172.31.11.0/24 172.31.21.0/24 172.31.31.0/24 Creating your VPC 172.31.0.0/16 Availability Zone Availability Zone Availability Zone VPC subnet sa-east-1a sa-east-1b sa-east-1c VPC subnet VPC subnet 172.31.13.0/24 172.31.23.0/24 172.31.33.0/24 172.31.12.0/24 172.31.22.0/24 172.31.32.0/24
- 24. 172.31.11.0/24 172.31.21.0/24 172.31.31.0/24 Creating your VPC 172.31.0.0/16 Availability Zone Availability Zone Availability Zone VPC subnet sa-east-1a sa-east-1b sa-east-1c VPC subnet VPC subnet 172.31.13.0/24 172.31.23.0/24 172.31.33.0/24 172.31.12.0/24 172.31.22.0/24 172.31.32.0/24
- 26. VPC: Routing: Internet 2-way https://github.com/mv/mv-aws-cloudformation-coding/tree/master/templates/vpc
- 27. VPC: Routing: Internet 1-way https://github.com/mv/mv-aws-cloudformation-coding/tree/master/templates/vpc
- 28. VPC Routing: Locally 172.31.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c Public Private DB
- 30. Security Groups: Multi-AZ by default 172.31.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c
- 31. Security Groups: Grouping and Securing 172.31.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c sg-web sg-app sg-db
- 32. Security Groups: Grouping and Securing 172.31.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c sg-web sg-app sg-db
- 33. Open HTTPS port access from anywhere Open backend access to a specific security-group ID Port Range Source sg-web 443 (HTTPS) 0.0.0.0/0 ID Port Range Source sg-app 22 (SSH) sg-web Open database access to a specific security-group ID Port Range Source sg-db 3306 (MySQL) sg-app Security Groups - Examples
- 34. Security Groups: Grouping and Securing 172.31.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c sg-web sg-app sg-db
- 35. Security Groups: Multi-AZ as a feature 172.31.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c
- 36. AWS VPC Best Practices
- 37. Creating your VPC 172.31.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c
- 38. Creating your VPC 172.31.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c
- 39. Creating your VPC 172.31.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c
- 40. Creating your VPC 172.31.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c
- 41. Creating your VPC 172.31.0.0/16 Availability Zone Availability Zone Availability Zone sa-east-1a sa-east-1b sa-east-1c
- 42. 2.1 ELB access or Public IP access? sa-east-1a sa-east-1b sa-east-1c user access
- 43. 2.1 ELB access or Public IP access? sa-east-1a sa-east-1b sa-east-1c user access user access? EIP/Public IPEIP/Public IP
- 44. 2.2 ELB access: use Private Subnet sa-east-1a sa-east-1b sa-east-1c user access Private IPPrivate IP Bastion Host/ SSH Gateway
- 45. 3.1 Security Groups: problems sa-east-1a sa-east-1b sa-east-1c sgPrivate
- 46. 3.1 Security Groups: problems sa-east-1a sa-east-1b sa-east-1c
- 47. Highly-Available Architecture Access: via NAT Availability Zone 1 Availability Zone 2 Amazon S3 User Amazon CloudFront Amazon Route 53 Internet Gateway Public Subnet Private Subnet Public Subnet Private Subnet Private Subnet Private Subnet Private Subnet Private Subnet RDS Read Replica RDS Read Replica RDS Read Master RDS Standby Static Assets Public load balancer Private load balancer NAT
- 48. Highly-Available Architecture Access: via VPN Availability Zone 1 Availability Zone 2 Amazon S3 User Amazon CloudFront Amazon Route 53 Internet Gateway Public Subnet Private Subnet Public Subnet Private Subnet Private Subnet Private Subnet Private Subnet Private Subnet RDS Read Replica RDS Read Replica RDS Read Master RDS Standby Static Assets Public load balancer Private load balancer VPN NAT
- 51. Cloudformation
- 52. DevOps: What is AWS CloudFormation? Declarative programming language for deploying AWS resources. Uses templates and stacks to provision resources. Create, update, and delete a set of resources as a single unit (stack). Create/delete AWS CloudFormation Create/delete AWS resources Template Stack - Basic definition of resources to create - JSON text file - Collection of AWS resources
- 53. Example Environment Templates Dev Apps Stack Dev Base Stack Test Apps Stack Test Base Stack Private Subnet App tier Private Subnet DB tier Master Public Subnet Private Subnet Web tier Private Subnet App tier Private Subnet DB tier NAT Master AMIs Amazon EBS snapshots Internet Gateway Internet Gateway Development Account Production Account Private Subnet Web tier NAT Public Subnet
- 56. S U M M I T São Paulo https://www.cvent.com/events/aws-summit-sao-paulo/registration-89802b17e4ab403db6baeed7ba5917cc.aspx?lang=pt- BR&fqp=true&refid=sp_summit_2019
- 57. Questions? Mv – mvferr@amazon.com Claick – claicko@amazon.com
- 58. Obrigado! Mv – mvferr@amazon.com Claick – claicko@amazon.com
Editor's Notes
- Each AZ is placed in a way to ensure that latency is as low as 2 ms 99% of the time.
- Let’s take a look at some examples of security groups in action. In the first example, we use a source description of 0.0.0.0/0 to specify that any computer from anywhere on the Internet can access a web server on our instance that is listening on port 80. Note that security groups that restrict access by IP actually specify an IP range using a convention called CIDR Notation. CIDR is short for Classless Inter-Domain Routing. We will discuss CIDR in more depth in the VPC module. For now, it is enough to know that the address 0.0.0.0/0 specifies any IP address, and that the address 10.50.2.133/32 is how we specify a single IP address (in this case, 10.50.2.133) in CIDR notation. In the second example, we specify that we only want to allow access from a specific IP address. In the third example, we specify that members of this security group should only allow SSH access from an instance that belongs to the security group that has the security group ID sg-4ad3712f. This can be very useful when you need instances to communicate with one another, but only want to grant this permission to instances that serve a particular function in your network. A great example of this is the bastion host, which we will discuss in more detail in the next module.
- Notes: Here’s a basic system. Remember, it is important to build security into every layer of your design.
- Notes: Here’s a basic system. Remember, it is important to build security into every layer of your design.
- AWS CloudFormation enables you to create and provision AWS infrastructure deployments in a predictable, repeatable, and automated fashion. You can create templates for the service or application architectures you want and then have AWS CloudFormation use those templates for quick and reliable provisioning of the services or applications (called “stacks”). When you use AWS CloudFormation, you work with templates and stacks. An AWS CloudFormation template is a JSON text file used to describe the AWS resources and their properties in your infrastructure. For example, in a template, you can describe an Amazon EC2 instance, such as the instance type, the AMI ID, block device mappings, and its Amazon EC2 key pair name. You use these templates to create a stack. A stack is a collection of AWS resources that has been created from a template. You may provision (create) a stack numerous times. When a stack is provisioned, the AWS resources specified by its template are created. Any AWS usage changes incurred from using these services will start accruing as they are created as part of the AWS CloudFormation stack. When a stack is deleted, the resources associated with the stack are deleted. The order of deletion is determined by AWS CloudFormation; you do not have direct control over what gets deleted when.
- AWS CloudFormation enables you to create and provision AWS infrastructure deployments in a predictable, repeatable, and automated fashion. You can create templates for the service or application architectures you want and then have AWS CloudFormation use those templates for quick and reliable provisioning of the services or applications (called “stacks”). When you use AWS CloudFormation, you work with templates and stacks. An AWS CloudFormation template is a JSON text file used to describe the AWS resources and their properties in your infrastructure. For example, in a template, you can describe an Amazon EC2 instance, such as the instance type, the AMI ID, block device mappings, and its Amazon EC2 key pair name. You use these templates to create a stack. A stack is a collection of AWS resources that has been created from a template. You may provision (create) a stack numerous times. When a stack is provisioned, the AWS resources specified by its template are created. Any AWS usage changes incurred from using these services will start accruing as they are created as part of the AWS CloudFormation stack. When a stack is deleted, the resources associated with the stack are deleted. The order of deletion is determined by AWS CloudFormation; you do not have direct control over what gets deleted when.
- With Infrastructure as Code, you can automate your entire dev, test, or production environment to be deployed, configured, and ready to use within minutes. For example, the entire setup on this slide can be deployed using AWS CloudFormation templates. You can create baseline templates for your Dev and Test environments, and then create stacks as needed from those templates. You can easily create production-like setups to perform your development and testing as part of your software development lifecycle. All the templates can be stored in a version control system like Git or AWS CodeCommit.
- In this reference diagram note that you can have many S3 buckets: 1. Public S3 buckets, that will store static files to be cached by Cloudfront and 2. Private S3 buckets that can store logs, backups, config files that can be read by any server in any AZ.