网络课程笔记

00:00 Okay, so far our discussion is more towards what happens within the VPC and how you can create various

00:09 route tables and everything for the traffic within the VPC.

00:12 Or how do you take this traffic out to the internet.

00:15 But now let's expand our networking beyond the VPC, and let's see how you can connect VPCs to other

00:23 networks, for example, to other VPCs or to the on premises network, or say within the AWS.

00:30 How you can reach to different AWS services, but not using the public IPS, but rather reaching over

00:36 to using the private IPS.

00:39 And this requires special networking plumbing between these networks.

00:43 And in this section let's try to understand that.

00:47 So in this section we are going to talk about how do you connect to VPCs and how do you then access

00:53 the machines over the private IPS across the VPCs.

00:58 Further, we are going to cover how can you reach to AWS services from the VPC without VPC having the

01:05 internet gateway or the Nat gateway?

01:08 So if you remember in the first lecture of overview of AWS networking services, we had touched upon

01:16 the VPC endpoints.

01:17 So let's understand about VPC endpoints.

01:20 There are different types for example gateway endpoint interface endpoint and as well as interface endpoint

01:27 extension to the private link.

01:31 So the fundamental question is what are the benefits of having this kind of private connectivity.

01:37 So let's try to answer that.

01:38 And then we will dive into individual networking components here.

01:43 So why do we need private connectivity.

01:46 That's because if there is no private connectivity the traffic will flow over the internet.

01:51 And for that you would have to expose your application over the public IPS to the internet.

01:57 So what are the disadvantages if you do that.

02:00 So of course traffic flows over the internet and it is considered as less secure.

02:06 Now depending on at which layer of networking you operate, you might have to then put additional layer

02:12 of security.

02:13 For example, you might have to encrypt the traffic at layer three or layer four, or at layer seven

02:19 using Https, right.

02:21 So you can do that, but there is additional overhead.

02:26 Second, internet may not provide you the consistent bandwidth and the lowest latency because traffic

02:33 might be routed through multiple hops.

02:36 And in that case, if there is a latency sensitive application, then it doesn't guarantee that it will

02:42 have the best user experience.

02:45 So for that reason, also having private connectivity might improve the experience.

02:51 Now, if you remember our Nat gateway discussion, you can provide the internet access to the instances

02:58 in private subnet using the Nat gateways.

03:01 But there is additional cost, right?

03:04 What if your instance wants to reach to some other VPC instance which is also in AWS?

03:10 In that case, is there an option to bypass, you know, the Nat or internet gateway.

03:15 So we will see what kind of architecture you can implement for this kind of use case.

03:21 And as I said, you don't need to unnecessarily expose your servers publicly if they don't need to.

03:29 So it is recommended that your blast radius is minimum by exposing minimum application to the internet.

03:37 So in this section we are going to talk about how to solve this problem using various networking features

03:44 of AWS.

03:45 That is, VPC peering, VPC endpoints, and VPC private link.

03:50 And I am not talking about the transit gateway so far because I try to put that in a hybrid networking

03:57 bucket.

03:58 But Transit Gateway otherwise links everywhere, right?

04:02 But in next few section, let's just try to focus on these three features okay.

04:07 With that, let's get started.