Lecture 123: ip-ranges.json
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:02
- 来源：Udemy Lecture 39623250
- Slide 数量：8
- 画面切换：00:12、02:24、03:17、03:29、03:40、04:30、05:11
扫描说明
逐条检查了 Udemy 页面中的 94 条 Transcript cue，并以每条 cue 对应画面扫描了全长约 6:02 的视频。依据 Public VIF 路由路径、互联网替代路径、ip-ranges.json 功能清单、变更通知和 JSON 结构示例，共划分为 8 个小节。正式截图均在锁定 Lecture 39623250、Autoplay 关闭、视频播放且控件隐藏后，按完整媒体边界截取并输出为 1364×770，逐张复核了左右与底部边界。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. ip-ranges.json 导入
时间范围：00:00–00:12
总结 / Summary
中文
在学习公共虚拟接口（Public Virtual Interface, Public VIF）前，需要先理解 AWS 发布公共 IP 范围的 ip-ranges.json 文件。
English
Before studying Public VIFs, it is important to understand the ip-ranges.json file that publishes AWS public IP ranges.
Transcript
00:00 Hi. So before we look into the public
00:02 VIF, it is important to understand this one concept called
00:07 ip-ranges.json
00:09 and I will also explain why.
00:11 So as you know,
2. Public VIF 接收 AWS 公共路由
时间范围：00:12–02:24
总结 / Summary
中文
Public VIF 连接企业数据中心与 AWS 公共 IP 地址空间；VIF 启用后，AWS 会通过边界网关协议（Border Gateway Protocol, BGP）发布其公共服务前缀，企业侧可在防火墙（firewall）过滤这些路由或流量。
English
A Public VIF connects the corporate network to AWS public IP space; AWS advertises public service prefixes over BGP, which the customer can filter at its firewall.
Transcript
00:12 the public VIF allows the connectivity between your data center network and
00:17 all AWS public IP address space and we will dive deep into that
00:22 into the next lecture.
00:24 But essentially what it means that all the public IPs on AWS site,
00:29 you can access over the public VIF.
00:32 So when you make this VIF
00:34 active, AWS will publish all the routes for all the public
00:39 IP address ranges which AWS uses for its own services.
01:03 Either you can accept all these routes and then all the traffic going to
01:07 any of the AWS public IP then will flow over this public VIF.
01:12 That means over to this DX connection.
01:38 Now, if this is the situation,
01:40 then what you need to do is, you need to
01:42 filter out the IP addresses at the Firewall level.
01:46 So on corporate data center side
01:49 over your DX connection,
01:51 you can set up a Firewall on your side of the network.
01:54 And then as you receive these routes from the AWS side for all the public IPs,
02:00 including for all AWS services.
3. 互联网访问同样可用
时间范围：02:24–03:17
总结 / Summary
中文
ip-ranges.json 不仅用于 Direct Connect；通过互联网（Internet）访问 AWS 服务时，也可按服务或区域只允许目标公共 IP，从而收紧出口防火墙规则。
English
ip-ranges.json also applies to Internet access, allowing egress firewalls to permit only public IPs for selected AWS services or Regions.
Transcript
02:24 And this is useful not just for the public VIF DX connectivity,
02:29 but even if you are accessing any other AWS services without using the DX,
02:34 that means over the internet
02:36 and you want to restrict access to certain AWS public services,
02:40 then also you can use
02:41 ip-ranges.json
02:42 JSON file.
02:43 So which means here now if you're accessing,
02:46 say Load-Balancer service of AWS from your
02:49 on-premises data center
02:51 over the internet,
02:52 then you can use this file to filter the
02:55 traffic and you say only traffic going to load
02:59 balancer service
03:00 in a particular Region or globally
03:02 is allowed rest of the traffic, you can block at your Firewall.
03:07 Now, for that reason, also,
03:08 you will need IP ranges from AWS site to configure the Firewall rules.
03:14 So now let's look into this file in a little more detail.
4. AWS 发布与下载 JSON
时间范围：03:17–03:29
总结 / Summary
中文
AWS 以 JSON 格式发布当前公共 IP 地址，可从 ip-ranges.amazonaws.com/ip-ranges.json 下载。
English
AWS publishes its current public IP addresses in JSON format at ip-ranges.amazonaws.com/ip-ranges.json.
Transcript
03:17 So AWS publishes all its current public IP addresses in the JSON format.
03:23 And this file ip-ranges.json can be downloaded from this
03:27 web link as well.
5. 按 Region、Service 与 IP Version 过滤
时间范围：03:29–03:40
总结 / Summary
中文
文件可按区域（Region）、AWS 服务（service）、IPv4 或 IPv6 过滤，适合生成只允许 AWS 公共服务地址的精确访问控制规则。
English
The file can be filtered by Region, AWS service, IPv4, or IPv6 to build precise access rules for AWS public endpoints.
Transcript
03:29 You can filter the IP addresses by Region or AWS service or whether it's IPv4
03:34 or IPv6
03:35 address.
03:36 And ultimately, you can use it to filter your traffic as I said.
6. 通过 SNS 监听地址变更
时间范围：03:40–04:30
总结 / Summary
中文
AWS 扩容会持续修改该文件。可订阅美国弗吉尼亚北部区域（N. Virginia Region）的 AmazonIpSpaceChanged 简单通知服务主题（Amazon Simple Notification Service topic, SNS topic），再用电子邮件或 Lambda 自动更新防火墙规则。
English
Because AWS updates the file as its address space changes, customers can subscribe to the N. Virginia AmazonIpSpaceChanged SNS topic and use email or Lambda to update firewall rules.
Transcript
03:40 Now ip-ranges.json would often change because
03:44 as AWS expands its services or scale its services,
03:48 there will be new IP addresses added, right?
03:50 So ip-ranges.json
03:51 would be updated. Now, if you are using
03:54 ip-ranges.json
03:55 file
03:56 to filter your traffic, you must also update your Firewall rules.
04:00 So how do you get notified?
04:02 AWS has configured this simple notification topic,
04:06 SNS topic on which they will publish the message
04:09 that there has been changes to
04:11 ip-ranges.json
04:12 file
04:12 So what you can do,
04:12 you can subscribe to this topic so that you get notified over an email as well.
04:17 Or you can also set up a Lambda function
04:19 and that lambda will trigger and probably pull the
04:23 ip-ranges.json from this web link and then update your Firewall rules.
04:26 So you can set up that automation as well.
7. ip-ranges.json 结构
时间范围：04:30–05:11
总结 / Summary
中文
顶层字段包含同步令牌（syncToken）、创建日期（createDate）、IPv4 前缀数组（prefixes）和 IPv6 前缀数组（ipv6_prefixes）；每条记录还包含 Region、network_border_group 和 service。
English
Top-level fields include syncToken, createDate, IPv4 prefixes, and ipv6_prefixes; each entry also includes Region, network_border_group, and service.
Transcript
04:30 So if I show you this file, then the syntax of this file looks something like this.
04:36 It has a sync token which says when the last
04:39 time this file was updated and then creation date.
04:42 And the important part is IPv4
04:45 prefixes and then IPv6
04:47 prefixes.
04:48 And then there is a prefix, the corresponding Region, network
04:52 group. Typically it's Global service or regional and then actual service name.
8. 按服务提取 Prefixes
时间范围：05:11–06:02
总结 / Summary
中文
示例展示 S3 与 EC2 的不同前缀记录。Linux 环境可使用 jq 按服务或区域筛选 JSON，再将结果写入本地防火墙（firewall）策略。
English
The examples show different prefix records for S3 and EC2; on Linux, jq can filter the JSON by service or Region before updating firewall policy.
Transcript
05:11 And as I said, this file contains the prefixes for all AWS public services.
05:18 So here is the list of full AWS services.
05:20 You can use any kind of filters to just filter
05:24 the prefixes for the service in which you are interested.
05:27 And you can then update
05:29 the Firewall rule at your site.
05:32 If you are using Linux as a platform, there is a nice utility called JQ
05:37 and you can write a command line to filter this
05:40 JSON file based on the service or a region
05:43 the way you want it.
05:45 Ok. So that's it about ip-ranges.json
05:48 file.
05:49 And we talked about this because
05:52 with respect to the public VIF, it is
05:54 used in most of the cases to filter your routes.
05:59 So thanks for watching and stay tuned.
整讲总结 / Overall Summary
中文
ip-ranges.json 是 AWS 当前公共 IPv4/IPv6 前缀的机器可读清单，Public VIF 和互联网出口都可用它限制对特定 AWS 服务或区域的访问。由于文件会变化，应订阅 AmazonIpSpaceChanged SNS topic，并用 Lambda 或其他自动化及时更新防火墙规则。
English
ip-ranges.json is a machine-readable inventory of current AWS public IPv4 and IPv6 prefixes. Public VIFs and Internet egress controls can use it to restrict access by service or Region. Because the file changes, customers should subscribe to the AmazonIpSpaceChanged SNS topic and automate firewall updates with Lambda or similar tooling.
返回顶部 ↑