Lecture 155: VPC lattice introduction
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:50
- 来源：Udemy Lecture 48015399
- Slide 数量：14
- 画面切换：01:22、01:37、01:52、02:15、02:52、03:13、03:31、03:38、04:17、04:36、05:23、05:41、05:56
扫描说明
逐条检查了 Udemy 页面中的 99 条 Transcript cue，并按时间轴扫描全长约 06:50 的视频。先对 35 个字幕时刻进行候选截图，再剔除仅有讲师光标移动、没有新增图形或文字的重复帧，最终保留 14 个不同幻灯片或有效揭示阶段。最终画面直接截取完整视频媒体区（1264×711），没有 Transcript 侧栏、播放器控件、黑边、右侧或下方裁切，并统一输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC Lattice：从网络连接到应用连接
时间范围：00:00–01:22
总结 / Summary
中文
传统 VPC Peering 主要解决网络到网络连接（Network-to-Network Connectivity），常让网络内主机获得过宽的互访范围。Amazon VPC Lattice 是面向应用到应用通信（Application-to-Application Communication）的应用网络服务（Application Networking Service），用于提供更细粒度的服务连接。
English
Traditional VPC peering primarily provides network-to-network connectivity and can grant hosts unnecessarily broad reachability. Amazon VPC Lattice is an application networking service designed for finer-grained application-to-application communication.
Transcript
00:00 Hello and welcome to this new section Amazon VPC lattice.
00:04 Okay, so until now in this course we have talked about different networking services.
00:09 And how do you connect different networks.
00:11 For example we talked about VPC peering connection.
00:14 We talked about transit gateways, site to site VPN connection direct connect everything.
00:19 Right.
00:20 But if you look at this networking connectivity it is typically network to network connectivity.
00:25 And there we did not really talk about application to application connectivity.
00:30 Now what is the difference.
00:31 So difference is that when we talk about network to network connectivity, that means any host in one
00:37 network can communicate with any host in other network.
00:40 And that works well when you want to connect to networks.
00:43 Right?
00:44 But what if you only want point to point connectivity between the applications?
00:49 And one of such application networking we had seen was VPC endpoints, but still it doesn't really work
00:56 in ideal way.
00:57 The ideal way would be where application can only communicate with only required application.
01:03 Irrespective of where they are located and in order to solve this problem.
01:08 In year 2023, AWS had launched Amazon VPC Lattice service.
01:14 So VPC lattice is the application networking service and it simplifies.
01:19 Service to service communication.
2. 简化 Service-to-Service Communication
时间范围：01:22–01:37
总结 / Summary
中文
VPC Lattice 简化服务到服务通信（Service-to-Service Communication），让应用服务直接表达需要连接的目标，而不必先构建完整的网络互联。
English
VPC Lattice simplifies service-to-service communication, allowing applications to express required service connectivity without first building full network interconnection.
Transcript
01:22 Further, Amazon VPC lattice provides the secure and consistent connectivity without you required to
01:29 have, say, VPC peering or transit gateway.
01:32 And in the following lecture we will see how exactly it works.
3. 无需复杂 Peering 或 Transit Gateway
时间范围：01:37–01:52
总结 / Summary
中文
它提供安全、一致的连接（Secure, Consistent Connectivity），不要求为每个应用关系设计复杂的 VPC Peering 网格或 Transit Gateway 拓扑。
English
It provides secure, consistent connectivity without requiring a complex VPC peering mesh or Transit Gateway topology for every application relationship.
Transcript
01:37 Now, other than the connectivity, it also provides the service discovery capability.
01:41 And that is typically the capability of the service meshes where there are the sidecar proxies using
01:48 which you can communicate transparently with other services.
4. Service Discovery 与 Dynamic Routing
时间范围：01:52–02:15
总结 / Summary
中文
VPC Lattice 内置服务发现（Service Discovery）和动态路由（Dynamic Routing）能力，服务消费者不需要自行维护大量目标地址或端点。
English
VPC Lattice includes service discovery and dynamic routing so service consumers do not need to maintain large sets of target addresses or endpoints themselves.
Transcript
01:52 And further it also has the dynamic routing.
01:55 This is very similar to how load balancers work, where you can have, say, path based routing or.
02:00 Weighted routing.
02:01 So all those features are there in the VPC lattice as well.
02:06 And finally, this is not just about the networking, but it also provides the authentication and authorization
02:13 for the connectivity.
5. Zero Trust 与 IAM Authorization
时间范围：02:15–02:52
总结 / Summary
中文
VPC Lattice 支持零信任架构（Zero Trust Architecture），使用集中访问控制、IAM 身份验证（IAM Authentication）和与上下文相关的授权（Context-Specific Authorization），把访问决策绑定到服务与身份。
English
VPC Lattice supports Zero Trust architectures with centralized access controls, IAM authentication, and context-specific authorization tied to services and identities.
Transcript
02:15 So basically it provides the zero trust architecture where you can manage the access to different services
02:21 using AWS IAM authentication.
02:25 So overall this is what is VPC lattice.
02:28 And typically you will see VPC lattice useful in the microservices architecture where there are different
02:35 services.
02:35 And typically these services are built by different teams.
02:39 These services might reside in different VPCs or across different AWS accounts.
02:45 Now if you want to enable the communication between all these microservices, then probably your architecture
6. Microservices Application Architecture
时间范围：02:52–03:13
总结 / Summary
中文
微服务应用架构（Microservices Application Architecture）通常由多个团队独立拥有的服务组成，服务分散在不同 VPC 或账户中，并形成大量调用关系。
English
A microservices application architecture commonly consists of independently owned services spread across VPCs or accounts with many inter-service call relationships.
Transcript
02:52 might look something like this, right where different Microservices are running on different compute
02:58 environment, so some microservices might be running on EC2 instances.
03:02 Some microservices on the ECS or EKS or even as a Lambda function.
03:08 And further, as I said, these services may reside in different VPCs.
7. 跨 EC2、ECS、EKS 与 Lambda 的服务
时间范围：03:13–03:31
总结 / Summary
中文
示例中的服务运行在 EC2、ECS、EKS、Lambda 和数据库等不同计算目标上，说明应用网络层需要跨多种运行环境提供统一连接。
English
The example services run on EC2, ECS, EKS, Lambda, and databases, showing that the application networking layer must provide consistent connectivity across heterogeneous runtimes.
Transcript
03:13 So if I just have to redraw this picture, then it could be something like this where different services
03:19 have different domain names as well, and they are located across different VPCs.
03:24 Now at this point, if you want to enable this communication, you will think of say VPC peering or
03:30 transit gateway, right.
8. 没有 VPC Lattice 的直接依赖
时间范围：03:31–03:38
总结 / Summary
中文
没有 VPC Lattice 时，各服务通常依赖底层网络路径直接互联；随着服务和 VPC 增多，连接关系会快速复杂化。
English
Without VPC Lattice, services commonly depend directly on underlying network paths, and those relationships become increasingly complex as services and VPCs grow.
Transcript
03:31 So without VPC lattice you might have VPC peering where you have point to point connection between the
03:37 VPCs.
9. VPC Peering Mesh 的扩展问题
时间范围：03:38–04:17
总结 / Summary
中文
VPC Peering 会形成对等连接网格（Peering Mesh）：连接数量随 VPC 增长，并可能让整个 VPC 获得网络级可达性，而不是仅允许所需应用服务。
English
VPC peering creates a peering mesh whose connection count grows with the number of VPCs and may grant network-level reachability rather than access only to required application services.
Transcript
03:38 But as you can see here, as the number of microservices increases, number of VPCs increases.
03:44 This adds a lot of complexity.
03:46 And further, as I said, this is network to network connectivity, which means if this VPC has some
03:52 other resources, you might be able to reach to those resources from your another VPC.
03:58 And typically for application communication we don't want that right.
04:03 So clearly VPC peering is not a great solution for this use case.
04:08 Now you might be thinking then we can look for transit gateways.
04:12 Now again Transit Gateway simplifies the networking architecture.
04:15 But there is a same problem here.
10. Transit Gateway 仍是 Network-to-Network
时间范围：04:17–04:36
总结 / Summary
中文
Transit Gateway 将网格简化为中心辐射（Hub-and-Spoke）拓扑，但抽象仍然是网络到网络连接（Network-to-Network Connectivity），不能直接表达服务级策略。
English
Transit Gateway simplifies the mesh into a hub-and-spoke topology, but its abstraction remains network-to-network connectivity rather than direct service-level policy.
Transcript
04:17 Also we are connecting two networks and not really connecting to applications.
04:22 Okay, so even the transit gateway is not ideal for this use case.
04:27 Then let's look for VPC endpoints right.
04:30 In that case you might be exposing all these services through the endpoints.
04:34 Something like this right.
11. PrivateLink Endpoint Sprawl
时间范围：04:36–05:23
总结 / Summary
中文
AWS PrivateLink 能提供点到点私有访问，但每个消费者 VPC 通常需要为每个服务创建接口端点（Interface Endpoint）。服务和 VPC 增长后会出现端点膨胀（Endpoint Sprawl），且仍缺少统一服务发现和 IAM 授权层。
English
AWS PrivateLink provides point-to-point private access, but each consumer VPC generally needs an interface endpoint for each service. As services and VPCs grow, endpoint sprawl develops without a unified service-discovery and IAM-authorization layer.
Transcript
04:36 And then in all other VPCs from where the service needs to be communicated, you will create VPC endpoint
04:42 for that Privatelink service.
04:44 Now this might work, but you can imagine how many endpoints you would have to create because it is
04:50 between one service and one VPC.
04:53 So for every service you would have to create endpoints in every other VPC.
04:58 So while it is pretty close to what we want, but again it is very complex architecture and it is not
05:04 at all scalable.
05:06 Further, it doesn't provide you the service discovery.
05:09 And also it doesn't provide you IAM level authentication.
05:13 And for the same reason, we need more sophisticated service which allows this point to point application
05:20 to application or service to service communication.
12. 传统方案无法表达精确服务访问
时间范围：05:23–05:41
总结 / Summary
中文
图中的红色阻断路径说明传统网络连接无法自然表达“只有指定应用可以访问指定服务”的细粒度意图；需要一个面向应用的连接与授权层。
English
The blocked paths illustrate that traditional network connectivity does not naturally express the fine-grained intent that only selected applications may access selected services; an application-oriented connectivity and authorization layer is needed.
Transcript
05:23 And exactly for that we have Amazon VPC lattice.
05:28 Now in this case you create your services and you attach these services to the VPC lattice network.
05:35 Now once all these services are part of the network then all these services can communicate with each
05:41 other.
13. 通过 VPC Lattice Service Network 连接服务
时间范围：05:41–05:56
总结 / Summary
中文
VPC Lattice 把各 VPC 中的服务关联到服务网络（Service Network），由统一层处理服务发现、路由和访问策略，避免为每对服务维护独立网络连接。
English
VPC Lattice associates services in different VPCs with a service network that centrally handles discovery, routing, and access policy, avoiding a separate network connection for every service pair.
Transcript
05:41 And there you can also apply some authorization policies so that you can control which services can
05:47 communicate with each other.
05:50 So while using the VPC lattice, typically there are two personas the administrator and the developer.
14. Admin 与 Developer 的职责划分
时间范围：05:56–06:50
总结 / Summary
中文
管理员（Administrator）创建服务网络、定义访问控制并把服务网络关联到 VPC；开发者（Developer）创建服务、定义流量路由与授权，再将服务关联到服务网络。这种职责分离让平台治理与应用交付可以独立演进。
English
Administrators create the service network, define access control, and associate it with VPCs. Developers create services, define traffic routing and authorization, and associate the services with the service network, separating platform governance from application delivery.
Transcript
05:56 So the administrator will create the service network and they will define the access control for that
06:01 network.
06:02 And then developer will create their own service and associate this service with the VPC lattice service
06:08 network.
06:09 So you can see that VPC lattice is more developer friendly service where developer can take their own
06:14 decisions to create the service.
06:17 And then enabling the connectivity for that service.
06:21 Right.
06:22 So that's in a nutshell is VPC lattice.
06:25 I know that we just talked at a very high level.
06:27 But as we go through this section you will understand how exactly it works.
06:31 And then what are the architectures that evolves using VPC lattice service.
06:36 So in the following lectures let's dive deep into the VPC lattice component and how it works right.
06:44 So we'll stop for this lecture.
06:46 And with that I'll see you into the next lecture.
06:48 Thank you.
整讲总结 / Overall Summary
中文
本讲介绍 Amazon VPC Lattice 的定位：它是应用网络服务（Application Networking Service），把关注点从传统的网络到网络连接（Network-to-Network Connectivity）提升到服务到服务通信（Service-to-Service Communication）。传统 VPC Peering、Transit Gateway 和 PrivateLink 分别会带来全网可达、连接网状增长或端点数量膨胀等问题，而且不天然提供服务发现（Service Discovery）和基于身份的授权。VPC Lattice 通过服务网络（Service Network）把跨 VPC、跨账户的应用服务连接起来，并提供动态路由（Dynamic Routing）、IAM 身份验证与授权（IAM Authentication and Authorization）以及零信任（Zero Trust）访问控制。管理员（Administrator）负责创建服务网络、定义访问控制并关联 VPC；开发者（Developer）负责创建服务、配置流量路由与授权，并将服务关联到服务网络。
English
This lecture introduces Amazon VPC Lattice as an application networking service that shifts the abstraction from network-to-network connectivity to service-to-service communication. Traditional VPC peering, Transit Gateway, and PrivateLink can create overly broad reachability, mesh growth, or endpoint sprawl, while not inherently providing service discovery or identity-based authorization. VPC Lattice connects application services across VPCs and accounts through a service network and provides dynamic routing, IAM authentication and authorization, and Zero Trust access control. Administrators create the service network, define access controls, and associate VPCs; developers create services, configure traffic routing and authorization, and associate services with the service network.
返回顶部 ↑