Amazon Web Services Networking

We'll start with high-level concepts:

• What AWS services are relevant to a networking engineer?
• What are regions and availability zones?
• How do you implement high availability in AWS environment?

Virtual Private Cloud (VPC) service is the foundation of AWS networking. This section describes VPC concepts, subnets within VPCs, and VPC/subnet addressing.

Subnets are useless without servers connected to them. In this section we'll focus on AWS implementation of VM network interfaces, network interface addressing, and supporting services like DNS and DHCP.

The section also covers advanced concepts like public and private IP addresses, elastic IP addresses, and elastic network interfaces.

AWS offeres several layers of network security within a VPC:

• Stateful security groups applied to VM interfaces;
• Stateless network ACLs applied to subnets;
• Validation of source and destination IP addresses.

All these mechanisms (and the logging and mirroring functionality available with flow logs and VPC traffic mirroring) are described in this section.

When you want to secure traffic entering or leaving a VPC, you could use a number of AWS services, including:

• Network Firewall: scale-out layer-4 firewall combined with Suricata IPS
• Web Application Firewall: a Layer-7 HTTP(S) firewall
• AWS Shield: a rudimentary DDoS protection service

VPC Route Tables are almost like VRFs with a few significant differences:

• Route tables are applied to subnets;
• All route tables share the entry for local VPC CIDR block.

This section describes the route tables and details of packet forwarding within VPC.

VPC Internet connectivity is usually provided through an Internet gateway. IPv6 hosts that don't provide services to outside clients can use egress-only gateway; similar IPv4 hosts can access Internet through NAT gateway or NAT instance.

This section describes all three mechanisms, and the adjustments to route tables that have to be made to support them.

This section describes other external connectivity options available in AWS VPC - IPsec VPN connections, router-to-router VLAN connections (Direct Connect), inter-VPC peering, and Transit Gateways.

AWS Cloud WAN is a managed WAN service that you can use to build a WAN backbone based on enhanced AWS transit gateways. AWS Cloud WAN supports VRF-like segmentation and EBGP routing.

AWS provides a variety of load balancing mechanisms, from local L4 load balancing (Network Load Balancing) and HTTP (Application) load balancing to service insertion with Gateway Load Balancer, global load balancing with DNS, and anycast IP addresses.

AWS API has numerous idiosyncrasies: it's a strict Create/Read/Update/Delete API, you need multiple API calls to create an object, objects can be referenced by IDs, but not by names...

This section explains the peculiarities of AWS API, and describes how to use bash scripts, Ansible playbooks, CloudFormation templates, and Terraform configuration files to create, update, or delete anything from a single AWS object to a full-blown application stack.

This section contains links to interesting third-party blog posts, articles or presentations.