网络课程笔记

00:00 Hello and welcome to this new section, VPC endpoint and Private link.

00:05 Now in my opinion, this is again one of the most important section because here we are going to talk

00:11 all about the private connectivity from your VPC to other AWS services or the services which are hosted

00:19 in VPC.

00:20 And you will realize that over the time, your network architecture would have more and more of this

00:26 VPC endpoints because it really simplifies your AWS network architecture.

00:32 Also, it reduces cost and also it improves the security of your architecture.

00:38 And that's where it is one of the important topic.

00:42 Okay.

00:42 So the first thing what is VPC endpoint and what is private link.

00:46 Right.

00:47 So this is kind of familiar architecture to you.

00:49 Where you have AWS region you have VPCs.

00:52 And in that VPC you might have EC2 instance which hosts some application.

00:57 And then you have AWS services like S3 or Kinesis SDKs.

01:02 These are managed AWS services.

01:04 Now if your application, which is hosted on EC2, needs to connect to this AWS services, typically

01:11 the EC2 instance will make that call over the internet.

01:15 So all that traffic goes over the internet.

01:18 Even though both your EC2 instance and AWS services are part of the same AWS region, right?

01:25 So this works, right?

01:27 But because everything is in AWS, probably we can do a little better here.

01:32 Now this is one use case where EC2 instance is public and then it can directly access the internet.

01:37 But in most of the cases your application servers are in a private subnet, right.

01:42 And in that case if you want to access AWS services, for example, if you want to upload some data

01:47 to S3 or download data from S3, you will need Nat gateway in a public subnet.

01:52 And then instance can connect to those AWS services.

01:56 Right?

01:57 So this works.

01:58 But again, if you see this architecture, all the traffic is within AWS region, but still you are

02:05 paying for the Nat gateway charges and you might have to apply some security policies because traffic

02:10 is going out from the internet.

02:13 And sometimes you might also face the Nat gateway bandwidth challenges if you are downloading or uploading

02:18 huge amount of data, and there are multiple EC2 instances in your VPC.

02:23 Now to exactly address this problem, AWS had launched VPC endpoints.

02:28 So VPC endpoints and AWS Privatelink.

02:32 And there is a distinction between these two terms.

02:34 So we'll understand about that.

02:36 But basically both endpoints and privatelink work together to establish a private connection between

02:42 your VPC and AWS services.

02:46 Or you could also host your own services inside a VPC.

02:51 And you can access those services from this consumer VPC privately.

02:55 You don't need, say, Internet Gateway or Nat gateway to access these services.

03:00 So that's essentially is VPC endpoints powered by Privatelink.

03:06 And if you set up this kind of connectivity then all the traffic between your consumer VPC to the provider

03:12 VPC or provider services will be inside AWS.

03:16 It doesn't go over the internet.

03:18 So it's a private connection now right?

03:20 So that's the benefit.

03:22 So let's answer the question why VPC endpoint.

03:25 So the VPC endpoint enables the private connections that we already talked about.

03:30 It reduces your security risk because all the traffic remains now within the AWS region.

03:36 And you don't need additional devices like internet gateway or Nat devices.

03:41 So of course it's a less work for you and you're not exposing your network to the outside world.

03:48 Third, it supports a lot of different AWS services as well as customer owned services, which are hosted

03:54 inside VPC.

03:56 And I will talk shortly.

03:57 What do I mean by that?

03:58 Right.

03:59 So these are the reasons for which you should use VPC endpoints.

04:05 Okay.

04:05 With that now let's look at the different types of endpoints.

04:08 And then we will start with one of the type of endpoint.

04:12 So there are different types of endpoint.

04:14 And the very first is VPC gateway endpoint.

04:17 Now this is a different kind of endpoint from rest of the endpoints that we are going to talk about.

04:23 And that's where we will cover VPC gateway endpoint in its own subsection.

04:27 And rest of the endpoints we will cover separately.

04:32 And this is for the reason that rest of the endpoints are powered by something called Privatelink,

04:39 which basically establishes the private connectivity between VPC and the target network.

04:45 And these endpoints, which are powered by VPC Privatelink, work little differently than how VPC gateway

04:52 endpoint works.

04:53 And in the subsequent lecture, let's understand about those Differences.

04:57 So as of now, if we talk about the VPC private link, then there are different types of the endpoint.

05:03 The fundamental endpoint is VPC interface endpoint.

05:06 And we will spend more time understanding about that.

05:10 But lately AWS has also launched additional type of endpoints.

05:14 So there is a gateway load balancer endpoint.

05:16 There is VPC resource endpoint and VPC lattice service network endpoint.

05:22 And further we are going to also talk about these endpoints in the respective section in this course.

05:27 So in this section we will primarily focus on VPC gateway endpoint and VPC interface endpoint.

05:35 Right.

05:36 So with that now let's understand how these endpoints simplifies your network and what benefits they

05:41 provide.

05:42 So again VPC with a private subnet and instance with private IP.

05:47 And assume that this instance needs to access AWS services endpoint something like this.

05:53 Or it needs to access other VPC services which are hosted behind a network load balancer, and or it

06:00 needs to access some AWS services APIs, for example API gateways or SQS queue, all those things,

06:06 right?

06:07 Now, one thing that may confuse you here is you can see the S3 and DynamoDB both are here, as well

06:15 as in the bottom side of this architecture right now.

06:19 That's for the reason that for S3 and DynamoDB specifically, you can access that from VPC using either

06:26 VPC gateway endpoint or using VPC interface endpoint.

06:31 And the use case is if you need to access these services from within the VPC, then use a gateway endpoint.

06:37 But otherwise, if you want to enable the access to S3 from the VPC.

06:41 But then this VPC can then further be accessed from some other remote networks, for example on premises

06:47 network or peered VPC.

06:49 Then you will use interface endpoint.

06:52 And in this section we are going to talk in much deeper about all these scenarios, so just hold on

06:57 till we reach there.

06:59 Okay, so let's get back to this topic again.

07:02 So traditionally without VPC endpoints, as I said we need to have Nat gateway and internet gateway.

07:09 And this traffic goes over the internet to these services.

07:13 And that's where all those challenges about the cost and bandwidth comes into play.

07:17 Right.

07:18 But with VPC endpoints, as I said there are different types of the endpoint.

07:23 So the first VPC endpoint type is a gateway endpoint for which you have to update your route table of

07:30 the subnet, and then all the traffic to the S3 or DynamoDB only for these two services, traffic goes

07:36 privately from this instance to this AWS services.

07:40 Right.

07:41 So that's a gateway endpoint.

07:43 Further, as I said there is interface endpoint.

07:46 Now interface endpoint works a little differently where it provisions and Elastic Network interface

07:52 into your subnet.

07:54 Right.

07:55 And that's where it has an IP address.

07:57 And now all the traffic from your this private EC2 instance can be routed through this Eni to this AWS

08:04 services or the customer services which are hosted inside the VPC.

08:10 So traffic goes privately now to this target networks.

08:14 So that's interface endpoint.

08:17 And as you can now see once we have these endpoints we don't really need these Nat gateways and internet

08:24 gateway into your VPC right.

08:27 So I hope it is clear.

08:28 And for the benefits as in gateway endpoint is completely free.

08:32 And interface endpoint has small charge.

08:35 But it is much lower than using Nat gateways.

08:37 Right.

08:38 So it is always beneficial.

08:41 Okay.

08:42 So let's quickly summarize what we understood in this lecture about VPC endpoints and privatelink.

08:48 So VPC endpoints allows you to connect to resources in VPCs or AWS services using private network instead

08:55 of public network.

08:57 They remove the need of internet gateways, Nat gateways to access AWS services, and all these devices

09:03 which powers these endpoints are managed by AWS and they are horizontally scaled, redundant and highly

09:10 available.

09:10 So you don't need to worry about, say for example, Nat gateways high availability.

09:14 You have to have multiple Nat gateways in different AZS, but you don't need to worry about that for

09:19 the endpoints.

09:20 Now again, with respect to the types, there is a gateway endpoint which only enables the access to

09:26 Amazon S3 and DynamoDB.

09:28 But otherwise if you need access to other AWS services and customer managed or owned services which

09:35 are deployed inside the VPC, then you will use interface endpoint.

09:40 And further, as I said, AWS launched many other different types of endpoints.

09:45 So there is something called gateway load balancer endpoint VPC resource endpoint VPC lattice service

09:50 network endpoint.

09:52 And maybe in the future there will be additional endpoints as well.

09:55 But our focus will be primarily on the gateway endpoint and the interface endpoint.

10:01 Right.

10:02 So I hope it is clear at the high level what is VPC endpoint and the private link and how they work

10:07 together.

10:08 And with that now let's get started with the VPC gateway endpoint.

10:14 And this is a small topic as compared to the interface endpoint for the reason that it only allows you

10:19 to connect to the Amazon S3 and DynamoDB to only these two services.

10:24 Right?

10:25 And the benefit is it's free.

10:27 There is no charge for using gateway endpoint, and that's what you should always use it in my opinion.

10:32 And we will talk more about that in the following lectures.

10:35 But this is where we will start.

10:37 And then we will spend most of the time in this section for the interface endpoints.

10:43 Okay.

10:43 With that, let's stop for this lecture.

10:45 And now let's see more about VPC gateway endpoint.

10:49 So thanks for watching and stay tuned.