Hi guys, in this exam cram we're going to cover Amazon VPC, networking and hybrid.
So firstly, the Amazon virtual private cloud is a virtual network dedicated to your account.
It's similar to having your own DC inside AWS.
In other words, your own data center.
It's logically isolated from other virtual networks in the AWS cloud and you have complete control over
the virtual networking.
So that's why you can create your own IP ranges and your own subnets and define your own routing
and so on.
You can launch your resources such as EC2 instances into your VPC.
When you create a VPC, you have to specify a range of IP addresses in the form of what we call classless
inter-domain routing, a CIDR block.
A VPC will span all the availability zones in a region and you have full control over who has access
to the resources inside your VPC.
You can create up to five VPCs per region by default.
And a default VPC is automatically created in each region with a subnet in each AZ.
Security groups are a firewall for EC2 instances.
They operate at the actual instance level.
They support allow rules only and they're what's called a stateful firewall.
Then we have network access control lists.
These are at the subnet level.
So it's traffic going in and out of your subnets.
They support allow rules and deny rules and they're stateless.
So you have to define rules for the traffic going in both directions, including response traffic.
They process rules in order.
For IP addresses a public IP is a dynamic public IP address that is lost whenever the instances stop.
So you get a new one the next time it boots.
Public IPs can't be moved between instances.
Then we have private IPs.
These are attached to all EC2 instances and they're retained when the instance is stopped.
Elastic IPs are public IPS, but these ones are static and they're retained when the instance is stopped
and they can be moved between different EC2 instances.
Remember that you pay for elastic IPs if you have them in your account,
but you're not actually using them.
Then we have NAT instances and gateways.
These are used for accessing the Internet from private subnets and they're deployed in a public subnet.
But then you have an entry in a route table in a private subnet that directs traffic to go to
the NAT Gateway or the NAT instance.
The NAT instances are managed by you.
It's an EC2 instance.
You have to configure it and manage it yourself whereas a NAT Gateway is managed by AWS.
VPC peering is used to route between VPCs using private IP addresses.
So you can set up a way that you can communicate using private addresses between different VPCs.
Then we have a managed VPN.
This is a virtual private networking connection between on-premises sites and AWS.
It uses the public Internet.
Direct connect on the other hand is a private connection from your on-premises data center or office
to AWS and this will avoid the public Internet.
Then we have a transit gateway.
This connects VPCs and on-premises networks through a central hub, so you can connect lots of different
VPCs together.
You can even connect your direct connect connection to Transit Gateway
and that simplifies network configuration.
And then we have AWS Outposts.
This is relatively new.
It allows you to deploy AWS infrastructure on-premises and connect AWS services.
So, for example, you can extend the VPC into the on premises environment
and it supports quite a few different AWS services.
And that's it for this exam cram.
It was a big section, but those are the core facts you need to remember.