Lecture 156: VPC lattice components - Lattice Network, Service, Resource and more
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:57
- 来源：Udemy Lecture 48015535
- Slide 数量：19
- 画面切换：00:17、00:35、00:48、01:05、01:23、01:52、02:06、02:42、02:50、03:09、03:16、03:37、04:09、04:40、04:50、05:09、05:31、05:50
扫描说明
逐条检查了 Udemy 页面中的 107 条 Transcript cue，并按时间轴扫描全长约 06:57 的视频。对 32 个主题或揭示时刻截图，剔除只有讲师光标移动而没有新增内容的重复帧，最终保留 19 个不同画面阶段。截图直接取完整 16:9 视频媒体区（1264×711），没有 Transcript 侧栏、播放器控件、黑边、右侧或下方裁切，并统一输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC Lattice Components 概览
时间范围：00:00–00:17
总结 / Summary
中文
VPC Lattice 的高层组成包括服务网络（Service Network）、服务（Service）、资源（Resource）、服务发现（Service Discovery）和授权策略（Auth Policy）。
English
At a high level, VPC Lattice consists of a service network, services, resources, service discovery, and auth policies.
Transcript
00:00 Okay.
00:01 So now let's understand different components of VPC lattice.
00:07 So at high level VPC lattice contains these five components.
00:10 That is VPC lattice service network service resources service discovery and auth policies.
2. 跨 VPC 的应用与资源
时间范围：00:17–00:35
总结 / Summary
中文
应用服务和资源可以分布在多个 VPC 中，Lambda 等目标甚至不一定直接位于 VPC 内；VPC Lattice 为它们提供共同的应用网络层。
English
Application services and resources can be distributed across multiple VPCs, while targets such as Lambda may not reside directly in a VPC; VPC Lattice provides a common application networking layer.
Transcript
00:17 So as you can see in this diagram, there are different applications or services hosted across different
00:22 VPCs.
00:23 And there is also a lambda function which doesn't typically sit into the VPC.
00:28 Now in order to connect all these different services together, you have to create the VPC lattice service
00:34 network.
3. Service Network 逻辑边界
时间范围：00:35–00:48
总结 / Summary
中文
创建服务网络（Service Network）后，可把应用配置为 VPC Lattice 服务或资源，并把这些组件纳入同一逻辑边界。
English
After creating a service network, applications can be configured as VPC Lattice services or resources and placed within one logical boundary.
Transcript
00:35 And then you have to configure all these applications as VPC lattice services or the resources.
00:41 And in the rest of this lecture we will see what is service, what is resource and how to really configure
00:46 those.
4. 关联 Services 与 Resources
时间范围：00:48–01:05
总结 / Summary
中文
服务关联（Service Association）与资源配置关联（Resource Configuration Association）把服务和资源接入服务网络，形成可治理的连接关系。
English
Service associations and resource configuration associations connect services and resources to the service network as governed relationships.
Transcript
00:48 Now once you create this service network and associate your services to that network VPC lattice also
00:53 enables the service discovery so that all these services or resources can be accessed using the VPC
01:00 lattice provided DNS name.
01:02 So we will also talk about that.
5. Service Discovery 与 Auth Policies
时间范围：01:05–01:23
总结 / Summary
中文
VPC Lattice 为关联组件提供服务发现（Service Discovery）和 DNS 名称，并使用授权策略（Auth Policy）控制身份验证与授权。
English
VPC Lattice provides service discovery and DNS names for associated components and uses auth policies for authentication and authorization.
Transcript
01:05 And finally, in order to enable the authentication and authorization you can apply the auth policies.
01:12 So let's also talk about those right.
01:15 So at high level these are the components of the VPC lattice.
01:19 And now let's dive deep into individual components.
6. Service Network Associations
时间范围：01:23–01:52
总结 / Summary
中文
服务网络是服务与资源配置集合的逻辑边界，可关联 VPC、Service 和 Resource Configuration，把它们连接在一起。
English
A service network is the logical boundary for a collection of services and resource configurations and can associate VPCs, services, and resource configurations.
Transcript
01:23 So the service network as we said it's a logical boundary for a collection of services and resource
01:29 configuration.
01:30 So you create a lattice service network and you associate the services or the resources or the VPCs
01:36 to this service network.
01:38 Now we have a dedicated lecture which talks about all these associations.
01:42 So just hold on until we reach there.
01:45 But just understand that VPC lattice network connects all the services and resources together.
7. Service Network 的完整逻辑模型
时间范围：01:52–02:06
总结 / Summary
中文
图示区分 VPC 关联（VPC Association）、服务关联（Service Association）和资源配置关联（Resource Configuration Association），三类关联承担不同接入职责。
English
The diagram distinguishes VPC associations, service associations, and resource configuration associations, each with a different attachment role.
Transcript
01:52 Next is the service.
01:54 Now if you look at the service it is made up of multiple things right.
01:58 So it's an independently deployable unit of software that delivers specific task or function.
02:03 That's the definition.
02:05 But what it means.
8. VPC Lattice Service 结构
时间范围：02:06–02:42
总结 / Summary
中文
服务（Service）是独立部署的软件单元，可运行在 EC2、ALB、ECS、EKS、Fargate、Lambda 或 IP 地址上。其配置类似 Application Load Balancer，由监听器（Listener）、规则（Rule）、目标组（Target Group）和目标（Target）组成。
English
A service is an independently deployable software unit that can run on EC2, ALB, ECS, EKS, Fargate, Lambda, or IP addresses. Its configuration resembles an Application Load Balancer with listeners, rules, target groups, and targets.
Transcript
02:06 It means service can be hosted on, say, EC2 instances or on the application load balancer or ECS EKS
02:13 cluster, or on a Lambda function, or even on the IP addresses.
02:17 Now, how do you create a service?
02:19 For that, you have to create a listener.
02:21 You have to create the rules.
02:22 You have to create target groups.
02:24 And finally your actual service will run on any of these targets that we just talked about.
02:30 So if you remember, this setup is quite similar to how we configure the application load balancer.
02:35 But here we are talking about the VPC lattice service.
02:39 So it has a target group listeners and the rules.
9. Weighted Target Groups
时间范围：02:42–02:50
总结 / Summary
中文
目标组（Target Group）支持权重，可按比例把流量分配到不同目标组，例如 10% 与 90%。
English
Target groups support weights, allowing proportional traffic distribution such as 10 percent to one group and 90 percent to another.
Transcript
02:42 Now further target groups can have weights like you can send 10% traffic to first target group and 90%
02:48 to another target group.
10. Rule Priorities 与 Conditions
时间范围：02:50–03:09
总结 / Summary
中文
规则（Rule）具有优先级（Priority）和匹配条件（Condition），可按路径、HTTP 方法等属性选择目标组。
English
Rules have priorities and matching conditions and can select target groups based on attributes such as path or HTTP method.
Transcript
02:50 And then there are rules which has priorities and also conditions.
02:56 Now again this is very similar to how we configure the application load balancer.
03:00 Right.
03:01 So that's in a nutshell is VPC lattice service.
03:04 And we will see this in action when we will do the exercise.
03:09 Okay.
11. VPC Lattice Resource
时间范围：03:09–03:16
总结 / Summary
中文
资源（Resource）与服务相似，但表示要被访问的实体，而不一定是完整的应用服务。
English
A resource is similar to a service but represents an entity to be accessed rather than necessarily a complete application service.
Transcript
03:09 Next is VPC lattice resource.
03:12 Now resource is quite similar to service but not exactly a service.
12. Resource 类型
时间范围：03:16–03:37
总结 / Summary
中文
资源可以是 Amazon RDS、节点集群、实例、应用端点、域名或 IP 地址，也可以把本地服务器纳入 VPC Lattice 网络。
English
A resource can be Amazon RDS, a cluster of nodes, an instance, an application endpoint, a domain name, an IP address, or even an on-premises server.
Transcript
03:16 So VPC lattice resource is an entity which can be Amazon RDS database or cluster of nodes behind the
03:23 auto scaling group.
03:24 Or it can be a simple instance or an application endpoint, domain name or IP address.
03:29 So it can be anything basically.
03:31 So that even you can bring in your on premises servers as a part of your VPC lattice network.
13. Resource Gateway 与 Resource Configuration Association
时间范围：03:37–04:09
总结 / Summary
中文
资源网关（Resource Gateway）是资源所在位置的入口点；资源配置关联（Resource Configuration Association）再把该资源配置连接到服务网络。
English
A resource gateway is the ingress point where resources reside, and a resource configuration association connects that resource configuration to the service network.
Transcript
03:37 And for using this resource you have to create something called resource gateway, which is like an
03:42 ingress endpoint for that resource.
03:45 And finally, if you want to associate this resource gateway with the VPC lattice network, you have
03:50 to create resource configuration association.
03:53 So like you associate the services you can also associate it.
03:57 Resources.
03:58 Using this resource configuration association.
04:02 Right.
04:02 So we talked about VPC lattice network VPC lattice service and VPC lattice resource.
14. VPC Lattice Auth Policies
时间范围：04:09–04:40
总结 / Summary
中文
授权策略（Auth Policy）定义服务的细粒度访问权限，可附加到单个 Service 或整个 Service Network。
English
Auth policies define fine-grained access to services and can be attached to an individual service or to the entire service network.
Transcript
04:09 Next is auth policies.
04:12 So VPC lattice auth policies are fine grained authorization policies that can be used to define the
04:18 access to different VPC lattice services.
04:21 And this auth policies can be attached either VPC lattice network level or individual VPC lattice services
04:28 level.
04:30 Now it is not necessary that you always define the auth policy.
04:33 You can go with the default that is none policy.
04:37 And in that case by default the communication will be allowed.
15. Auth Type：NONE 或 AWS_IAM
时间范围：04:40–04:50
总结 / Summary
中文
授权类型（Auth Type）可以是 NONE 或 AWS_IAM。NONE 不应用身份验证或授权策略，默认允许通信。
English
Auth type can be NONE or AWS_IAM. NONE applies no authentication or authorization policy and permits communication by default.
Transcript
04:40 So auth type can be either none or aws IAM.
04:45 And none means you are not applying any authorization or authentication policies.
16. AWS_IAM 默认拒绝
时间范围：04:50–05:09
总结 / Summary
中文
选择 AWS_IAM 时，请求默认隐式拒绝（Implicit Deny）；只有显式允许（Explicit Allow）的请求才能通过。
English
With AWS_IAM, requests are implicitly denied by default and are allowed only when an explicit allow applies.
Transcript
04:50 And when the auth type is aws, IAM, then by default all the requests will be denied.
04:57 So if you understand how IAM policies are evaluated, it is exactly the same thing.
05:02 If you do not explicitly mention the allow policy, then the access will be denied, right?
17. Authorization Evaluation
时间范围：05:09–05:31
总结 / Summary
中文
授权评估（Authorization Evaluation）同时检查调用方身份和被调用服务的访问策略，而不是只依赖网络可达性。
English
Authorization evaluation checks both the caller identity and the accessed service's policy rather than relying only on network reachability.
Transcript
05:09 So when one service talks to another service, there are some evaluation criteria.
05:14 For example, the requester should have the IAM policy which allows to access the VPC lattice service.
05:22 So these are called IAM identity based policies.
05:25 And the requester can have this access using either IAM user credentials or IAM role.
18. Identity Policy 与 Resource Policy 双重允许
时间范围：05:31–05:50
总结 / Summary
中文
调用方必须通过 IAM 身份策略（IAM Identity-Based Policy）获得权限；同时 Service Network 或 Service 的授权策略必须显式允许该主体（Principal）。两侧均允许后请求才会成功。
English
The caller must be allowed by an IAM identity-based policy, and the service network or service auth policy must also explicitly allow that principal. The request succeeds only when both sides permit it.
Transcript
05:31 Further VPC lattice service network or the individual service auth policy should explicitly allow the
05:38 access to the requester.
05:40 And that is called principal.
05:42 Right.
05:42 And in that case the access will be allowed.
05:46 So just remember this about the VPC lattice auth policies.
19. Example Auth Policies
时间范围：05:50–06:57
总结 / Summary
中文
示例策略展示两种粒度：允许某 AWS Organization 内的服务访问，或只允许特定 IAM Role 对特定 VPC Lattice Service 执行 GET 方法。
English
The example policies show two levels of granularity: allowing services from a particular AWS Organization, or allowing only a specific IAM role to invoke the GET method on a particular VPC Lattice service.
Transcript
05:50 And if I just have to show you some examples then it could be like this right.
05:55 So here we are saying that you are allowing the communication between the services inside this particular
06:01 AWS organization.
06:03 So all services can communicate because principle is star.
06:07 Whereas if you see this policy, we are saying that you can only invoke the Get method for this particular
06:14 service.
06:15 And for that the requester or a principal should be having this IAM role.
06:21 So you can go that granular with respect to the communication at the IAM level.
06:27 Right.
06:28 So this is how you use the auth policies with VPC lattice service network or the service right.
06:35 So with that I hope now you understand what are the different components in the VPC lattice.
06:40 And now in the next lecture let's talk about the VPC lattice associations.
06:45 We have talked about that at a very high level.
06:47 But now let's closely look at those associations.
06:51 Okay.
06:51 So with that let's stop here.
06:53 And now let's go to the next lecture.
06:55 Thank you.
整讲总结 / Overall Summary
中文
本讲拆解 Amazon VPC Lattice 的五个核心组成：服务网络（Service Network）、服务（Service）、资源（Resource）、服务发现（Service Discovery）和授权策略（Auth Policy）。服务网络是把 VPC、服务和资源配置组织在一起的逻辑边界。服务由监听器（Listener）、规则（Rule）、目标组（Target Group）和实际目标构成，可运行在 EC2、ALB、ECS、EKS、Fargate、Lambda 或 IP 地址上，并支持加权路由。资源可以是 RDS、实例、域名、IP 地址或本地服务器；资源网关（Resource Gateway）充当资源入口，通过资源配置关联（Resource Configuration Association）加入服务网络。授权类型（Auth Type）可为 NONE 或 AWS_IAM；选择 AWS_IAM 时默认拒绝，调用方既需要 IAM 身份策略（IAM Identity-Based Policy），服务网络或服务的资源策略也必须允许该主体（Principal）。
English
This lecture explains the five core Amazon VPC Lattice components: service network, service, resource, service discovery, and auth policy. A service network is the logical boundary that organizes VPCs, services, and resource configurations. A service consists of listeners, rules, target groups, and actual targets, which may run on EC2, ALB, ECS, EKS, Fargate, Lambda, or IP addresses and can use weighted routing. A resource can be RDS, an instance, a domain name, an IP address, or an on-premises server; a resource gateway is its ingress point, and a resource configuration association connects it to the service network. Auth type can be NONE or AWS_IAM; with AWS_IAM, access is denied by default, and both the caller's IAM identity policy and the service-network or service resource policy must allow the principal.