This document provides an overview of setting up a private network in AWS called a VPC (Virtual Private Cloud). It discusses choosing an IP address range for the VPC, creating subnets across Availability Zones, setting up a route to the internet, and configuring security. It also covers options for connecting the VPC to on-premises networks, accessing other AWS services from the VPC, and monitoring VPC traffic with Flow Logs.

1. Your private network in AWS
VPC

2. EC2 Instance

3. 172.31.0.128
172.31.0.129
172.31.1.24
172.31.1.27
54.4.5.6
54.2.3.4

4. Creating an Internet-connected VPC: steps
Choosing an
address range
Setting up subnets
in Availability Zones
Creating a route to
the Internet
Authorizing traffic
to/from the VPC

5. Choosing an IP address range

6. What is an Internet Protocol address?
An IP address is FOUR numbers (octets*) separated by the
period symbol.
192.168.90.0

7. What is an Internet Protocol address range?
From 192.168.90.0 to (and including) 192.168.90.255
How many IP address can we use?
192.168.90.0 plus another 255 IP addresses = 256 IP addresses.

8. What is an Internet Protocol address range?
From 192.0.0.0 to (and including) 192.0.0.255
256 IP addresses
From 192.0.0.0 to (and including) 192.0.255.255
256 * 256 = 65,536
From 192.0.0.0 to (and including) 192.255.255.255
256 * 256 * 256 = 16,777,216

9. Classless inter-domain routing [CIDR notation]
An IP address range is the starting 4 octets (IP address) plus a
value after a slash.
i.e 192.168.90.0/24
What is that value and what does it mean?

10. Binary
128 64 32 16 8 4 2 1
0 0 0 0 0 0 0 0
0 1 0 1 1 0 1 0
1 1 1 1 1 1 1 1
0 0 0 0 0 1 1 1
The number 0 represented in binary
The number 90 represented in binary
The number 255 represented in binary
The number 7 represented in binary

11. IP addresses
172.31.0.0
10101100.00011111.00000000.00000000
172.31.0.255
10101100.00011111.00000000.11111111
172.31.0.0 to 172.31.255.255
From 172.31.0.0/255.255.255.255 to and including 172.31.255.255/255.255.255.255
172.31.0.0/255.255.0.0
172.31.0.0/(8).(8).(0).(0)
172.31.0.0/16 gives you 65,536 IP addresses to pick from.

12. Choosing an IP address range for your VPC
172.31.0.0/16
Recommended:
RFC1918 range

13. Subnets

14. VPC subnets and Availability Zones
172.31.0.0/16
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
172.31.0.0/24 172.31.1.0/24 172.31.2.0/24
eu-west-1a eu-west-1b eu-west-1c

15. Route to the Internet

16. Routing in your VPC
• Route tables contain rules for which
packets go where
• Your VPC has a default route table
• … but you can assign different route
tables to different subnets

17. Traffic destined for my VPC
stays in my VPC

18. Internet Gateway
Send packets here if you want
them to reach the Internet

19. Everything that isn’t destined for the VPC:
Send to the Internet

20. Network security in VPC:
Network ACLs / Security Groups

21. Network ACLs: Stateless firewalls
English translation: Allow all traffic in
Can be applied on a subnet basis

22. “MyWebServers” Security Group
“MyBackends” Security Group
Allow only “MyWebServers”
Security Groups follow application structure

23. Security Groups example: web servers
In English: Hosts in this group are reachable
from the Internet on port 80 (HTTP)

24. Security Groups example: backends
In English: Only instances in the MyWebServers
Security Group can reach instances in this
Security Group

25. Security Groups in VPC: additional notes
• Follow the Principle of Least Privilege
• VPC allows creation of egress as well as ingress
Security Group rules
• Many application architectures lend themselves to a 1:1
relationship between Security Groups (who can reach
me) and IAM roles (what I can do).

26. Connectivity options for VPCs

27. Beyond Internet connectivity
Restricting Internet access
Connecting to your
corporate network
Connecting to other
VPCs

28. Restricting Internet access:
Routing by subnet

29. Routing by subnet
VPC subnet
VPC subnet
Has route to Internet
Has no route to Internet

30. Outbound-only Internet access: NAT Gateway
VPC subnet VPC subnet
0.0.0.0/0
0.0.0.0/0
Public IP: 54.161.0.39
NAT Gateway

31. Inter-VPC connectivity:
VPC peering

32. Example VPC peering use:
shared services VPC
Common/core services
• Authentication/directory
• Monitoring
• Logging
• Remote administration
• Scanning

33. Security Groups across peered VPCs
VPC Peering
172.31.0.0/16 10.55.0.0/16
Orange Security Group Blue Security Group
ALLOW

34. Establish a VPC peering: initiate request
172.31.0.0/16 10.55.0.0/16
Step 1
Initiate peering request

35. Establish a VPC peering: accept request
172.31.0.0/16 10.55.0.0/16
Step 1
Initiate peering request
Step 2
Accept peering request

36. Establish a VPC peering: create route
172.31.0.0/16 10.55.0.0/16Step 1
Initiate peering request
Step 2
Accept peering request
Step 3
Create routes
In English: Traffic destined for the
peered VPC should go to the peering

37. Connecting to on-premises networks:
Virtual Private Network & Direct Connect

38. Extend an on-Premises network into your VPC
VPN
Direct Connect

39. AWS VPN basics
Customer
Gateway
Virtual
Gateway
Two IPSec tunnels
192.168.0.0/16 172.31.0.0/16
192.168/16
Your networking device

40. VPN and Amazon Direct Connect
• Both allow secure connections
between your network and your VPC
• VPN is a pair of IPSec tunnels over
the Internet
• DirectConnect is a dedicated line with
lower per-GB data transfer rates
• For highest availability: Use both

41. VPC and the rest of AWS

42. AWS services in your VPC

43. Example: Amazon RDS database in your VPC
Reachable via DNS Name: mydb-cluster-1
….us-west-2.rds.amazonaws.com

44. VPC Endpoints for S3

45. S3 and your VPC
S3 Bucket
Your applications
Your data

46. AWS VPC Endpoints for S3
S3 Bucket

47. AWS VPC Endpoints for S3
S3 Bucket
Route S3-bound
traffic to the VPCE

48. IAM Policy for VPC Endpoints
S3 Bucket
IAM Policy at VPC Endpoint:
Restrict actions of VPC in S3
IAM Policy at S3 Bucket:
Make accessible from
VPC Endpoint only

49. DNS in a VPC

50. VPC Flow Logs:
VPC traffic metadata in Amazon
CloudWatch Logs

51. VPC Flow Logs
Visibility into effects of Security
Group rules
Troubleshooting network
connectivity
Ability to analyze traffic

52. VPC Flow Logs: setup
VPC traffic metadata captured in
CloudWatch Logs

53. VPC Flow Logs data in CloudWatch Logs
Who’s this?
# dig +short -x 109.236.86.32
internetpolice.co.
REJECT
UDP Port 53 = DNS

54. VPC: your private network in AWS