Lecture 65: Hands On: Create VPC endpoint service and access through VPC endpoint
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：26:51
- 来源：Udemy Lecture 50324625
- Slide 数量：20
- 画面切换：00:19、01:25、02:32、04:27、04:35、05:00、05:44、05:53、07:01、09:32、11:21、14:08、16:22、18:15、19:48、22:29、23:11、24:06、25:38
扫描说明
逐条检查了 Udemy 页面中的 418 条 Transcript cue，并对全长 26:51 的视频画面进行扫描。依据 6 张讲解幻灯片，以及控制台中的 AMI、提供方网络、Web Server、NLB、Endpoint Service、使用者 Endpoint、连接接受与访问验证等阶段，共划分出 20 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC Endpoint Service 实操导论
时间范围：00:00–00:19
总结 / Summary
中文
本讲通过完整实验创建 VPC 端点服务（VPC Endpoint Service），并从使用者 VPC 的接口端点（Interface Endpoint）访问提供方 VPC 中的私有 Web 服务。
English
This hands-on lecture builds a complete VPC Endpoint Service and accesses the provider VPC's private web service through an Interface Endpoint in a consumer VPC.
Transcript
00:00 Okay.
00:01 So now let's do this exercise for VPC endpoint service.
00:04 And this is relatively long exercise.
00:06 But hopefully it gives you an entire view of how VPC endpoint service works and VPC endpoints work.
00:13 So as we discussed in the previous lecture, in order to create the VPC endpoint service, the first
2. Provider VPC 中的 Endpoint Service 组件
时间范围：00:19–01:25
总结 / Summary
中文
提供方 VPC 需要跨可用区（Availability Zones, AZs）的网络负载均衡器（Network Load Balancer, NLB）和已注册的后端目标，并将 NLB 发布为 Endpoint Service。创建时可配置跨区域访问（Cross-Region access）、连接接受（acceptance）、私有 DNS（Private DNS）、IPv4/IPv6，以及允许连接的 AWS 账户或 IAM 主体（IAM principal）。
English
The provider VPC needs a Network Load Balancer (NLB) across Availability Zones with registered backend targets, and the NLB is published as an Endpoint Service. Configuration options include cross-Region access, connection acceptance, Private DNS, IPv4/IPv6, and the AWS accounts or IAM principals permitted to connect.
Transcript
00:19 thing that you need is a provider VPC.
00:22 And in that you will create a network load balancer with right availability zones.
00:26 And then you will have your actual services running on the EC2 instances or say ECS or on ECS that you
00:34 will register to the network load balancer.
00:36 And now this network load balancer will be set up as a VPC endpoint service.
00:41 And as you create this service, you will have many options.
00:44 For example, whether you want to allow access to this service from other AWS region, whether you need
00:50 the required acceptance so that the VPC endpoint created in the consumer VPC can connect to your service
00:56 or not.
00:57 Similarly, you can enable the private DNS so that you can have custom domain name to access your services.
01:03 Then support for IPv4 or IPv6 or both.
01:06 And also to allow access to the other AWS accounts.
01:10 So all these settings will be there.
01:12 So if you do that you will create the VPC endpoint service in the service provider VPC.
01:17 And then in the service consumer VPC, you would have to create the VPC endpoint for this particular
01:24 service right.
3. 双 VPC 基础实验架构
时间范围：01:25–02:32
总结 / Summary
中文
服务提供方 VPC（Service Provider VPC）运行两台 Web Server，并通过内部 NLB 暴露服务；服务使用者 VPC（Service Consumer VPC）创建 Endpoint ENI 和客户端 EC2。客户端通过 PrivateLink 连接 Endpoint Service，而不需要 VPC 对等连接（VPC Peering）或互联网网关（Internet Gateway, IGW）。
English
The Service Provider VPC runs two web servers behind an internal NLB, while the Service Consumer VPC contains endpoint ENIs and a client EC2 instance. The client connects to the Endpoint Service through PrivateLink without VPC Peering or an Internet Gateway.
Transcript
01:25 So typically this is how the architecture should look like.
01:28 Where in service provider VPC you have the network load balancer.
01:32 And there will be say a dummy EC2 instances on which you will run some services.
01:37 And those will be exposed through this network load balancer.
01:40 Then you will create the VPC endpoint service.
01:42 And then in the consumer VPC you will create the VPC endpoints across this two availability zones for
01:49 high availability.
01:51 And there will be a client through which you will test this connectivity.
01:55 Now further in order to connect to this client, typically you will have bastion host so that you can
02:00 log in over ssh.
02:01 And then from here you can log in to this.
02:03 But as you understood in the previous lectures, we are now getting away with the bastion host setup
02:09 because AWS provides easier way to directly connect to this EC2 instance which is in a private subnet.
02:16 So for that we use EC2 instance connect endpoint.
02:20 And additionally we can just refine this architecture and probably have more subnets such that we have
02:26 dedicated subnet for VPC endpoints.
02:29 This is how you should actually do it in production.
4. 生产化子网与 EC2 Instance Connect 架构
时间范围：02:32–04:27
总结 / Summary
中文
架构进一步为 Interface Endpoint、客户端 EC2、EC2 Instance Connect Endpoint、NLB 和 Web Server 分配专用私有子网（private subnets），并跨两个 AZ 部署关键资源。实验完全不创建 Internet Gateway；提供方 Web Server 将从预装 HTTP 服务的 Amazon 机器映像（Amazon Machine Image, AMI）启动。
English
The refined design uses dedicated private subnets for Interface Endpoints, the client EC2 instance, the EC2 Instance Connect Endpoint, the NLB, and the web servers, with critical resources spread across two AZs. No Internet Gateway is created; provider web servers launch from an Amazon Machine Image (AMI) that already contains the HTTP service.
Transcript
02:32 So on the left side as you see in the consumer VPC, I have two subnets dedicated for VPC endpoint,
02:39 one subnet for the client and one private subnet for EC2 instance connect endpoint.
02:45 And out of this I think we already had this three subnets created in the previous exercise.
02:50 So I'll just reuse the same VPC.
02:53 But additionally I would have to create this fourth subnet in second availability zone.
02:57 Now we don't have anything in the service provider VPC.
03:00 Let's call it VPC b in that we'll need this for subnets, two for network load balancer and two for
03:06 these EC2 instances on which we host our service.
03:10 Now one interesting thing that you will note in this setup is that there is no internet gateway.
03:16 All subnets are private, but still we are able to do this exercise.
03:21 And for the same reason, there is one small challenge.
03:25 Right now we are saying that this EC2 instance should have a web server, but you know that when we
03:30 launch EC2 instance and install httpd service, it needs to be installed or downloaded from the internet,
03:36 right?
03:37 So if we do that, this EC2 can't really download anything from the internet.
03:41 Rather we can't even reach to this EC2 instance from outside, right?
03:45 Unless we also create the EC2 instance connect endpoint.
03:50 So how this EC2 instance will have web server.
03:52 Now for that typically you will have an Ami Amazon machine image which would already have the web server
03:59 running, and then you will just launch EC2 instance using that Ami.
04:04 So in order to have this web server, first thing let's create an Ami which is already having the web
04:10 server.
04:10 And then for actual setup we will use those Amis.
04:14 Right.
04:15 So let's do that as a first step.
04:17 And first let's set up the right side that is VPC b.
04:21 And then we will come to the VPC a right.
04:24 And I have also listed all the steps here.
5. 端到端实施步骤
时间范围：04:27–04:35
总结 / Summary
中文
实施顺序先创建 Web Server AMI，再搭建提供方 VPC、四个子网、两台 Web Server、Target Group、NLB 和 Endpoint Service；随后完善使用者 VPC、启动客户端 EC2、创建 Interface Endpoint、接受连接，并验证区域与可用区 DNS（Regional and Zonal DNS）。
English
The implementation first builds a web-server AMI, then the provider VPC, four subnets, two web servers, a target group, an NLB, and an Endpoint Service. It then completes the consumer VPC, launches a client EC2 instance, creates an Interface Endpoint, accepts the connection, and validates Regional and Zonal DNS.
Transcript
04:27 So you can do all these steps on your own by reading this.
04:31 And with that first thing as I said let's create EC2 Ami right.
6. 预装 Web Server 的 AMI 方案
时间范围：04:35–05:00
总结 / Summary
中文
由于提供方实例位于无公网出口的私有子网，先在默认 VPC 的临时实例中通过用户数据（user data）安装 httpd、启用服务并写入 index.html，再把该实例制作成 AMI。正式 Web Server 即可从 AMI 启动，无需访问软件仓库。
English
Because provider instances reside in private subnets without Internet egress, a temporary instance in the default VPC uses user data to install and enable httpd and create index.html. An AMI is then made from the instance, allowing the production web servers to launch without reaching package repositories.
Transcript
04:35 And for that you have to use the user data so that it is easier to create the Ami.
04:40 And this EC2 instance, which first we launch will be in a public subnet.
04:45 And normally C2 instance will create an Ami.
04:47 And then we will go for creating the VPC, b and launch those EC2 instances using this particular Ami.
04:55 Right.
04:56 So let's do this and let's follow the steps now.
7. 启动临时 EC2 并运行 User Data
时间范围：05:00–05:44
总结 / Summary
中文
在默认 VPC 中启动临时 Amazon EC2，安全组（Security Group）允许 HTTP，并在高级设置中加入安装 httpd 和生成页面的用户数据（user data）。该实例仅用于构建镜像。
English
A temporary Amazon EC2 instance is launched in the default VPC with a Security Group permitting HTTP and user data that installs httpd and creates the web page. The instance exists only to build the image.
Transcript
05:00 Okay.
05:00 So let's launch the EC2 instance.
05:03 And this is a test EC2 instance.
05:05 We just want that for creating the Ami.
05:08 And I will launch it in a default VPC so that I can connect over the internet.
05:14 So all the settings as it is just that.
05:17 We also want to test the HTTP traffic so that we know whether web server is running fine or not.
05:22 And in the advanced details, we want to have basically a user data and you can copy it from the slides.
05:29 But what essentially it does it install the httpd service and then just adds this index dot HTML file.
05:36 Right.
05:37 So let's launch the instance and let's give it one minute and then I'll come back here okay.
8. 验证临时 Web Server
时间范围：05:44–05:53
总结 / Summary
中文
通过临时实例的公网 IP 打开网页，确认自定义页面成功返回。这证明 httpd 和 index.html 已按用户数据（user data）正确配置，可安全制作 AMI。
English
Opening the temporary instance's public IP returns the custom page, confirming that httpd and index.html were configured correctly by user data and the instance is ready to be imaged.
Transcript
05:44 So instance is running.
05:45 So let's pick its public IP and verify that the web server is running.
05:50 And you can see that it is running here.
05:53 Right.
9. 创建 AMI 并终止临时实例
时间范围：05:53–07:01
总结 / Summary
中文
从临时实例创建自定义 Web Server AMI，等待镜像状态变为 Available，然后终止临时 EC2。此 AMI 将用于两个私有后端实例。
English
A custom web-server AMI is created from the temporary instance and allowed to reach Available, after which the temporary EC2 instance is terminated. The AMI will launch both private backend instances.
Transcript
05:53 So next what we want to do is just we want to create Ami out of this.
05:58 So let's go to the images and create image and let's give it a name.
06:02 Say VPC endpoint exercise am I.
06:10 Web server am I.
06:13 Right.
06:14 And you don't want to reboot the instance.
06:16 That's okay.
06:17 And let's create the image.
06:20 So if we go to the Amis you will see this Ami being created.
06:26 So right now the state is pending.
06:27 So let me probably pause this video for a couple of more minutes and I'll come back here.
06:34 Okay.
06:34 So it took around two minutes for Ami to be available.
06:37 So now we can just go and terminate this instance because this is not required.
06:42 So let's terminate that okay.
06:44 So now we have the Ami.
06:46 And if we see the architecture we need to have now target VPC or service provider VPC and these four
06:54 subnets.
06:54 And then we will create these two web server and the network load balancer.
06:59 Right.
06:59 So let's do that now.
10. 创建 Provider VPC、四个子网和路由表
时间范围：07:01–09:32
总结 / Summary
中文
创建服务提供方 VPC B，并配置两个 NLB 私有子网和两个 EC2 私有子网，分布在两个可用区（Availability Zones, AZs）。四个子网关联到专用私有路由表（private route table）；本实验不需要额外服务路由。
English
Service Provider VPC B is created with two private NLB subnets and two private EC2 subnets across two Availability Zones. All four subnets are associated with a dedicated private route table; no additional service route is required for this lab.
Transcript
07:01 Okay.
07:01 So let's go to the VPCs.
07:03 So there is this consumer VPC already.
07:05 So let's create a service provider VPC.
07:09 And let's give it a name say VPC b for easy recognition and Cidr you can give same as VPC A because
07:18 VPC endpoint works even though the VPCs have overlapping Cidr.
07:24 But just to make it a little simple and identifiable, let's use 10.20, right?
07:31 Rest of the settings as it is, and let's create the VPC.
07:34 Okay.
07:35 Now let's create the subnets for VPC b.
07:37 So let's select vpc b and we need to create four subnets.
07:41 So let's call it vpc b.
07:43 So first one is for NLB.
07:45 So let's call it NLB private one.
07:48 And it's in first AZ and the Sidr.
07:54 Is this right.
07:57 Again.
07:58 Let's add one more subnet.
07:59 Let's call it private two for NLP.
08:02 And this time let's select AC two and the cider range as 1.0 slash 24.
08:10 Let's add one more.
08:12 And this is for my EC2 instance.
08:16 So let's call it EC2 private one.
08:20 And let's call it 10.2.2.0 slash 24.
08:26 And the fourth one.
08:29 So this is for EC2 private two in second AC.
08:36 And let's call it 10.2.3.0 slash 24 okay let's create the subnets.
08:45 So subnets have been created.
08:47 Now all these subnets would follow the main route table of VPC.
08:51 But for consistency let's create a separate route table which is the private route table.
08:58 Nothing special about it, but let's create that.
09:02 So this is private route table in VPC B, let's create the route table.
09:07 And the most important thing is to associate that with all these four subnets.
09:13 As I said, even if you don't do this it should still be okay.
09:17 Okay so we have four subnets now.
09:20 And now let's uh, launch EC2 instances in those two subnets in VPC B.
09:26 So this was a test instance that we had terminated.
09:28 And we had created that for Ami.
09:31 Okay.
11. 从 AMI 启动两台私有 Web Server
时间范围：09:32–11:21
总结 / Summary
中文
分别在两个 EC2 私有子网中从自定义 AMI 启动 Web Server 1 和 Web Server 2。两台实例共用允许 HTTP 的安全组（Security Group），作为 NLB 的跨 AZ 后端目标。
English
Web Server 1 and Web Server 2 are launched from the custom AMI in the two private EC2 subnets. They share a Security Group permitting HTTP and serve as multi-AZ backend targets for the NLB.
Transcript
09:32 So now let's create the first web server in the VPC B.
09:36 So let's call it web server one.
09:40 And important thing is the Ami because we want to launch it from the custom Ami that we created.
09:47 So it lists all the Amis.
09:49 So I'm selecting the Ami that we created and then key pair.
09:54 And the most important is the networking.
09:56 We want to have that in VPC B, and it should be in the EC2 private one subnet.
10:04 And then let's create a new security group for this.
10:10 And we just want HTTP traffic basically nothing else.
10:14 So HTTP from anywhere is okay.
10:16 Or we can restrict it to vpc, Cidr because EC2 instance will get only traffic from the Nlbs.
10:22 Right.
10:23 So let's leave as it is.
10:26 And that's it I think.
10:27 Let's launch the instance.
10:31 And now similarly let's launch Web server two in another AC.
10:36 So same steps just that we need to use another subnet.
10:42 And here also we need to use our own Ami.
10:45 So make sure that you select the right Ami key pair.
10:52 Then the networking VPC IP And uh, subnet will be EC2 private two.
11:02 And then we will choose the existing web server as G because it will be common.
11:08 And that's it right.
11:09 So let's launch this instance as well.
11:13 Okay.
11:13 So if everything works fine we should have two EC2 instances Web server one and Web Server two.
12. 创建 Target Group 与 Internal NLB
时间范围：11:21–14:08
总结 / Summary
中文
创建以实例为目标的目标组（Target Group），使用 TCP 80 并注册两台 Web Server。随后创建内部网络负载均衡器（internal Network Load Balancer），在两个 NLB 子网中监听 TCP 80；NLB 激活后可查看各 AZ 的可用区 ID（Availability Zone ID, AZ ID）。
English
An instance Target Group is created on TCP port 80 and both web servers are registered. An internal Network Load Balancer is then created in the two NLB subnets with a TCP 80 listener; once active, its Availability Zone IDs can also be inspected.
Transcript
11:21 And now the next thing let's create the network load balancer and then attach these two instances.
11:27 So for that let's go to the load balancer and say create.
11:31 And the middle option is network load balancer.
11:34 So let's create that and let's give it a name say VPC endpoint exercise NLB.
11:41 And it should be internal.
11:42 Because we are not exposing it to the internet.
11:45 We are going to expose it using the VPC endpoint service.
11:49 Now IP address IPv4 is okay but otherwise it supports IPv6 as well.
11:54 And we want that VPC B across both AZS.
11:58 So this is for the first stage.
11:59 We need to select the NLB private subnet.
12:02 Similarly for another AZ.
12:04 It should be NLB private two.
12:06 Now with respect to the security group earlier NLB did not support that.
12:09 But now it does support that.
12:11 And by default it will be default security group.
12:13 But we are going to use this NLB for the private link.
12:16 And in that case these security groups are not really used.
12:20 Right.
12:21 So either we can keep it default or rather I would suggest we remove that.
12:25 Okay.
12:26 Next we want to have a listener on port 80.
12:28 That is a TCP listener because it's NLB only supports the TCP, UDP and TLS.
12:34 So that is there.
12:35 And we want to send all the traffic to the EC2 instances.
12:40 And for that we need to create a target group.
12:43 So let's create a target group for NLB.
12:46 And target is instance target group name is say TX and protocol is TCP.
12:53 And on port 80 of the instances IPv4 traffic and it should be in the VPC.
12:59 B I think rest of the settings as it is.
13:02 And now let's include both these instances into the target group.
13:06 And let's create the target group okay.
13:09 Once we are there let's go back here.
13:11 Refresh it.
13:12 And we should see this target group.
13:14 And additionally I don't think so.
13:17 We need to do anything else.
13:19 Let's create this network load balancer okay.
13:23 So it will take maybe a couple of minutes for this NLB to be available.
13:27 So I'm pausing this video okay.
13:30 You can see that NLB is active now and I can't access it from the internet.
13:34 Otherwise we could have tested it.
13:36 But so NLB is there.
13:38 And one interesting thing that you see here, uh, so we talked about AZ mapping.
13:43 Right.
13:43 So AZ name AP South one A and then there is acid right now if you see for AZ a the ID is this.
13:52 But for AZ b id is These apps.
13:56 One is three.
13:58 So that means that name and acids do not directly map in different AWS account.
14:02 It can be different mapping.
14:05 Okay.
14:06 So this is done.
13. 发布 VPC Endpoint Service
时间范围：14:08–16:22
总结 / Summary
中文
以内部 NLB 创建 Demo Endpoint Service，保留连接接受（acceptance required），使用 IPv4，暂不启用 Private DNS 或跨区域访问。Endpoint Service 控制台可查看服务覆盖的 AZ、允许的 IAM 主体（allowed principals）和使用者 Endpoint Connection。
English
A Demo Endpoint Service is created from the internal NLB with acceptance required, IPv4 enabled, and Private DNS and cross-Region access left disabled. The service console exposes its supported AZs, allowed IAM principals, and consumer endpoint connections.
Transcript
14:08 So coming back to the architecture we are done with most of the settings on the right side.
14:13 Now important thing is to create the VPC endpoint service using this network load balancer.
14:19 So let's do that.
14:21 So for that let's go to the VPC console again.
14:23 And here there are endpoint services.
14:27 So let's create the endpoint service and let's call it demo endpoint service.
14:36 And the load balancer type is network load balancer.
14:39 And it shows up your network load balancer.
14:42 Now further this is a new option now where you can allow different regions to connect to your endpoint
14:48 service.
14:49 Otherwise VPC endpoint was only a regional thing.
14:52 But now it can be accessed access across the region, right?
14:57 So for us, the consumer VPC is in the same region, but if it is in a different region then you would
15:02 have to allow that here right.
15:04 So remember that.
15:06 So I'm not choosing as of now then this is the load balancer that it is sending traffic to.
15:12 And here we say acceptance required because we are creating the service.
15:17 So we want that anybody tries to connect to our service we should approve that request right.
15:22 So that's where we are keeping it.
15:24 Acceptance required.
15:25 If you turn off this it will be directly connected which is not that secure.
15:29 Now enable private DNS.
15:31 As of now I'm not using that.
15:32 But if you have time, we will also see this as a part two of this exercise.
15:38 Now supported IP address type.
15:39 As of now it's IPv4 only.
15:41 So let's go with that and let's create the service.
15:45 Now if you see this service has been created and there are details as in which availability zone the
15:51 service is available.
15:53 And here you can also allow other AWS accounts to connect to your service, right?
15:59 So you would have to whitelist basically those accounts, all that you can do here.
16:03 And from endpoint Connection you can monitor which all consumer VPCs are connected to this endpoint
16:10 service.
16:11 Right.
16:11 So all those kind of things are here in this dashboard.
16:14 So I think we are done with the right side of our setup.
16:18 And now let's move to the left side of the setup.
14. 完善 Consumer VPC 的第二个 Endpoint 子网
时间范围：16:22–18:15
总结 / Summary
中文
在使用者 VPC A 的第二个 AZ 中新增专用 VPC Endpoint 子网，并把它关联到现有私有路由表（private route table）。这样 Interface Endpoint 可跨两个 AZ 创建 ENI。
English
A dedicated VPC endpoint subnet is added in the second AZ of consumer VPC A and associated with the existing private route table. This allows the Interface Endpoint to create ENIs across two AZs.
Transcript
16:22 So now in case of VPC A uh we already had this three subnets, if you remember just that there should
16:30 be this additional fourth subnet so that we can have the VPC endpoint created in this subnet.
16:36 So let's do that as a first thing.
16:38 Then we will launch this EC2 instance.
16:41 And then we will create the VPC endpoint for the VPC endpoint service that we just created.
16:47 So let's do that.
16:50 Okay so let's go to the VPCs.
16:53 And there should be this VPC A and B.
16:55 And let's go to the subnet and let's filter it by VPC a.
17:00 So there are only these three subnets.
17:02 So now let's create one more subnet.
17:05 So that will be for VPC endpoint basically another subnet.
17:10 So this idea is two.
17:12 So let's use the next one of this.
17:16 So let's create the subnet for VPC a and let's call it say vpc b.
17:26 VPC endpoint subnet two something.
17:31 And it should be in ACB.
17:34 And Cidr should be 3.0.
17:38 Okay let's create the subnet.
17:40 And again it will be by default linked to the main route table.
17:44 But it's better if we associate the specific route table.
17:48 So let's do that as well.
17:50 And let's select all those.
17:53 Sorry This is for VPC b.
17:56 This one is for the VPC a.
17:58 Let's edit that and also add this subnet.
18:02 Now in this entire exercise we are not playing around with the route tables.
18:06 It's not required.
18:07 So it doesn't matter whether you create a specific route table or not.
18:11 But this is for consistency.
18:12 Okay.
18:13 So we have the fourth subnet as well.
15. 启动 Client EC2 并验证网络隔离
时间范围：18:15–19:48
总结 / Summary
中文
在 VPC A 的私有 EC2 子网中启动无公网 IP 的客户端实例，并通过 EC2 Instance Connect Endpoint 登录。ping 公网失败，且两个 VPC 尚未通过 Endpoint 连通，确认实验起点完全隔离。
English
A client instance without a public IP is launched in VPC A's private EC2 subnet and accessed through the EC2 Instance Connect Endpoint. An Internet ping fails and the two VPCs are not yet connected, confirming the isolated starting state.
Transcript
18:15 Now let's go to the EC2 instances.
18:18 And uh let's create the client EC2 instance basically.
18:23 So let's launch the instance.
18:26 So let's call it client EC2 instance from Amazon Linux.
18:31 And the key pair and the network setting.
18:36 We want it in VPC A and we have specific subnet for this EC2 private subnet.
18:42 We don't want public IP and we want to create a new SG.
18:48 Now here we need to connect it over SSH over the EC2 instance connect.
18:54 So let's have just ssh.
18:55 Anywhere that should be good enough.
18:58 And let's launch the instance.
19:02 Okay.
19:02 So this is also done.
19:04 Um, and let's test the connectivity to this instance as well as it comes up.
19:10 So let me pause this video for maybe a minute and I'll come back here okay.
19:15 So instance is running.
19:16 Now let's connect to this instance using EC2 instance connect endpoint that we already have.
19:23 And let's connect now once it is connected we will just try to say ping google.com and it won't work
19:31 because there is no outbound connectivity in this instance cannot connect to the NLB that we created
19:37 because these are isolated VPCs right now and everything is private.
19:41 Okay, so that's done.
19:43 Now the next important thing is to create the VPC endpoint for the service, right.
16. 为自建 Endpoint Service 创建 Interface Endpoint
时间范围：19:48–22:29
总结 / Summary
中文
复制提供方 Endpoint Service 名称，在 VPC A 中创建面向 NLB Endpoint Service 的 Interface Endpoint，选择两个 AZ 的专用子网，禁用跨区域和 Private DNS，并关联允许来自客户端 HTTP 流量的 Endpoint 安全组（Security Group）。
English
The provider Endpoint Service name is copied and used to create an Interface Endpoint for an NLB-based endpoint service in VPC A. Dedicated subnets in both AZs are selected, cross-Region access and Private DNS remain disabled, and an endpoint Security Group permits HTTP from the client.
Transcript
19:48 Which will create this connectivity between these two VPCs.
19:52 So let's go to the end points.
19:54 And sorry.
19:55 Before that we need to have the endpoint service name that we had created.
20:00 So this endpoint service and there is this service name.
20:04 So we want that for creating the endpoint.
20:07 Okay.
20:08 So let's create the endpoint and let's call it say VPC endpoint service exercise endpoint.
20:17 I mean this little confusing but this is what we are doing.
20:20 And this time we want to create it for one particular AWS service right.
20:25 So endpoint services that use NLB or Gateway Load Balancer and the service name is the one that we had
20:32 created.
20:33 Let's verify that.
20:34 And it says that it is verified now.
20:37 Do we want to enable the Cross-region endpoint?
20:39 No.
20:39 At this point, because both VPCs are in the same AWS region.
20:44 Now we want this endpoint to be created in VPC A, and optionally we want to enable the DNS name.
20:51 In that case as you know, it will create the private hosted zone and it will attach it to your VPC.
20:59 So as of now, we don't want that.
21:02 But as I said, we can also try to do an exercise where we use a custom domain name for accessing the
21:07 VPC endpoint service.
21:09 Okay.
21:10 So DNS record type IPv4.
21:12 And then we want this to be created in both the AZS and we had AZS specific subnet for that.
21:19 So this subnet one and this is subnet two right.
21:26 That's it I think everything is okay.
21:28 And here the security group we need to create the security group because it should allow the inbound
21:34 traffic from the EC2 instance.
21:37 So let's create a security group and then filter it again here.
21:41 Okay.
21:43 So rather let's create another tab with the VPCs.
21:48 And let's go to the security group.
21:51 And let's create a new security group and let's call it VPC endpoint SG in the VPC a and we just want
22:03 inbound rule and we want to allow HTTP traffic from anywhere is okay.
22:11 Otherwise from the EC2 instance or VPC, Cidr is also okay.
22:15 Let's create that.
22:17 And let's go back here and refresh this.
22:21 So we have this VPC endpoint security group.
22:25 That's it.
22:26 Let's create the endpoint.
22:28 Okay.
17. 接受 Consumer Endpoint Connection
时间范围：22:29–23:11
总结 / Summary
中文
新建 Interface Endpoint 最初处于 Pending Acceptance。提供方在 Endpoint Service 的 Endpoint Connections 页面接受该请求；若使用不同 AWS 账户，同样需要由提供方账户完成审批。
English
The new Interface Endpoint initially enters Pending Acceptance. The provider accepts it from the Endpoint Connections page of the Endpoint Service; the same approval would occur in the provider account when separate AWS accounts are used.
Transcript
22:29 So first thing it says that the pending acceptance because this is happening in the consumer VPC we
22:36 actually need to go to the VPC or the provider AWS account and approve this request.
22:42 Right now because we are using the same AWS account, we will see this pending request, uh, in the
22:48 endpoint services uh itself.
22:50 Right.
22:51 So here if you go to the endpoint connection it shows that it is pending for acceptance.
22:56 So let's go here and accept this request.
23:04 Okay.
23:04 So it will take maybe a minute or so for this to happen.
23:07 So I am just pausing this video.
23:11 Okay.
18. 检查 Regional 与 Zonal Endpoint DNS
时间范围：23:11–24:06
总结 / Summary
中文
连接变为 Available 后，Endpoint 显示一个区域 DNS（Regional DNS）以及每个 AZ 的可用区 DNS（Zonal DNS）。客户端可使用任一名称访问 Endpoint Service；Regional DNS 可能解析到任一 Endpoint ENI。
English
Once the connection becomes Available, the endpoint exposes one Regional DNS name and Zonal DNS names for each AZ. Clients can use any of them to reach the Endpoint Service, while Regional DNS may resolve to either endpoint ENI.
Transcript
23:11 So this is now available.
23:13 And if you go to the endpoint you will see that this endpoint has been created.
23:17 And there are different DNS names.
23:20 And that's what we learned in the previous lectures as well.
23:22 There is one DNS and then there are DNS as per the AZS.
23:27 So because we created it in two AZS there is one for one B and this is for one a right.
23:34 And we can access this VPC endpoint service using any of these DNS.
23:38 So let's pick the regional one rather right.
23:41 And now if everything is okay we should be access the endpoint services using this particular DNS.
23:48 So going back to our architecture I think we created everything that you see here in this architecture.
23:54 So from this client EC2 instance, now we should be able to access this VPC endpoint service using the
24:02 endpoint specific DNS.
24:04 So let's do that okay.
19. 使用 curl 与 nslookup 验证 PrivateLink
时间范围：24:06–25:38
总结 / Summary
中文
客户端使用 Endpoint Regional DNS 执行 wget/curl，成功获取提供方 Web Server 页面，证明流量经 PrivateLink 穿越两个隔离 VPC。nslookup 返回使用者 VPC 中 Endpoint ENI 的私有 IP；Regional DNS 可轮询多个 ENI，而 Zonal DNS 固定到指定 AZ 的 ENI。
English
The client uses the endpoint's Regional DNS name with wget and curl and successfully retrieves the provider web page, proving that traffic crosses the isolated VPCs through PrivateLink. nslookup returns a private IP of an endpoint ENI in the consumer VPC; Regional DNS can round-robin across ENIs, whereas Zonal DNS maps to an ENI in the specified AZ.
Transcript
24:06 So here what I just need to do is say wget http and the endpoint DNS.
24:15 So let's paste it.
24:17 Sorry there are some extra character.
24:26 And you see that it got the index.html.
24:30 Or you can do rather curl right.
24:32 That would be better.
24:34 And let's copy this.
24:47 And you see that this service is for VPC endpoint demo.
24:51 This is coming from the right side of the VPC and it is working as expected.
24:56 Additionally, if you do say Nslookup for this endpoint DNS, then it should also give you the private
25:05 IP address from the consumer VPC, right?
25:08 So it is 10.10.3.143.
25:12 So this is right now coming from the fourth subnet that we created.
25:17 And sometimes you may get a second subnet because it's a regional DNS.
25:21 It will provide the IP addresses in round robin fashion.
25:25 So what I mean by that this IP could be from this Eni or this Eni.
25:31 But if you use zonal specific DNS then it will always resolve to a specific Eni.
20. 架构回顾、Custom DNS 预告与资源清理
时间范围：25:38–26:51
总结 / Summary
中文
实验完成了从客户端、Interface Endpoint、PrivateLink、Endpoint Service、NLB 到两台 Web Server 的私有路径。下一讲将使用自定义域名（custom domain name）和 Private DNS 扩展该环境；若不继续，应删除三台 EC2、NLB、Endpoint Service 和 Interface Endpoint，因为这些资源会产生费用。
English
The completed path runs from the client through the Interface Endpoint, PrivateLink, Endpoint Service, and NLB to the two web servers. The next lecture extends this environment with a custom domain name and Private DNS; if not continuing, delete the three EC2 instances, NLB, Endpoint Service, and Interface Endpoint because they incur charges.
Transcript
25:38 Right?
25:38 So I hope it is clear now how this entire thing works with respect to the VPC endpoint, service and
25:44 endpoints.
25:46 And we are not really done with the entire exercise because I have one small exercise where I will show
25:52 you how to use private DNS name or say custom DNS name for your endpoint service.
25:58 For example, if in the client VPC you want to access the services using, say app dot example.com,
26:05 then how to do that?
26:07 Now for that you need to own the domain name.
26:09 So if you have it then you can only do that exercise.
26:13 But if you don't have that then I would suggest that you delete everything that you created.
26:18 In this exercise, which includes three EC2 instances, there is a network load balancer.
26:24 There is a VPC endpoint service VPC endpoint and everything has a cost.
26:29 So better delete that if you are not doing the next exercise.
26:34 But in my case, because I have the domain name with myself in route 53, I will continue with this
26:40 setup and extend it for the custom domain name.
26:44 Right?
26:44 So with that, we'll stop for this exercise and let's go to the next exercise.
26:49 Thank you.
整讲总结 / Overall Summary
中文
本讲从零搭建了完整 VPC Endpoint Service：预制 Web Server AMI，在提供方 VPC 中跨 AZ 部署后端、Target Group 与 internal NLB，将 NLB 发布为 Endpoint Service；再在使用者 VPC 中创建多 AZ Interface Endpoint、接受连接，并通过 Regional/Zonal DNS、curl 和 nslookup 验证私有访问。整个方案无需 Internet Gateway 或 VPC Peering，并为下一讲的 Custom DNS 做好准备。
English
This lecture builds a complete VPC Endpoint Service from scratch: it creates a web-server AMI, deploys multi-AZ backends, a Target Group, and an internal NLB in the provider VPC, publishes the NLB as an Endpoint Service, then creates a multi-AZ Interface Endpoint in the consumer VPC and accepts the connection. Regional and Zonal DNS, curl, and nslookup verify private access without an Internet Gateway or VPC Peering, while preparing for the next custom-DNS exercise.
返回顶部 ↑