Lecture 157: VPC lattice network associations
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:04
- 来源：Udemy Lecture 48015551
- Slide 数量：15
- 画面切换：00:17、00:25、00:40、00:53、01:17、01:43、02:12、03:17、03:53、04:00、04:49、05:04、05:12、06:00
扫描说明
逐条检查了 Udemy 页面中的 103 条 Transcript cue，并按时间轴扫描全长约 07:04 的视频。播放器在早期候选批次中出现过暂停按钮遮罩和视频错误弹窗；这些画面全部移入临时备份并未采用。随后在干净页面通过 Transcript 精确跳转、连续播放重截，并在每张截图前校正视频媒体边界。最终从 31 个初始候选与 23 个重截候选中保留 15 个无错误、无控件、无侧栏的不同画面阶段；所有最终图片均为完整 16:9 画面并输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC Lattice Network Associations 概览
时间范围：00:00–00:17
总结 / Summary
中文
网络关联（Network Association）描述哪些服务、资源和客户端网络能够连接到 VPC Lattice 服务网络。
English
Network associations describe which services, resources, and client networks can connect to a VPC Lattice service network.
Transcript
00:00 Hi.
00:01 Now in this lecture let's look at the VPC lattice network associations.
00:05 And this is one of the important lecture in this section.
00:09 So when we say VPC lattice network association we are saying which all things can be connected to the
00:16 VPC lattice network.
2. Service 与 Resource Configuration Associations
时间范围：00:17–00:25
总结 / Summary
中文
服务关联（Service Association）把 Service 接入服务网络；资源配置关联（Resource Configuration Association）通过 Resource Gateway 把 Resource 接入服务网络。
English
A service association connects a service to the service network, while a resource configuration association connects a resource through a resource gateway.
Transcript
00:17 And in there there are four types.
00:20 First is a service association.
00:22 Second the resource association.
3. VPC Association
时间范围：00:25–00:40
总结 / Summary
中文
VPC 关联（VPC Association）让关联 VPC 内的客户端可以发起对 Lattice Service 或 Resource 的请求。
English
A VPC association allows clients in the associated VPC to initiate requests to Lattice services or resources.
Transcript
00:25 Then the third type is VPC association.
00:28 Now this is the association which allows clients to access VPC lattice services and the resources.
00:36 So these are the three primary associations in the VPC lattice network.
4. 四类 Association
时间范围：00:40–00:53
总结 / Summary
中文
第四类是 VPC 端点关联（VPC Endpoint Association），用于从远程网络访问 Service Network；至此四类关联共同覆盖提供方与消费者接入。
English
The fourth type is a VPC endpoint association for accessing the service network from remote networks; together the four types cover provider and consumer attachment.
Transcript
00:40 And the fourth type is VPC endpoint association.
00:43 And it is used when you have to access the VPC lattice network from some remote network.
00:50 Right.
00:50 So these are the four types of the network association.
5. Service Association 与跨账户共享
时间范围：00:53–01:17
总结 / Summary
中文
Service 一旦关联到 Service Network 就可被发现和访问。服务可以位于同一 AWS Account，也可以通过 AWS Resource Access Manager（RAM）从其他账户共享。
English
Once associated with a service network, a service becomes discoverable and reachable. It may be in the same AWS account or shared from another account through AWS Resource Access Manager.
Transcript
00:53 And let's begin with service association.
00:55 So once you create the service and associate that with the VPC lattice network then that service is
01:01 discoverable and it becomes the part of that VPC lattice network.
01:05 Further, this service can be in the same AWS account, or it can be shared by some other AWS account
01:11 using the Resource Access Manager.
01:14 Okay.
01:15 So that's service association.
6. Resource Configuration Association
时间范围：01:17–01:43
总结 / Summary
中文
资源接入需要先创建资源网关（Resource Gateway），再通过资源配置关联把资源连接到 Service Network；资源同样支持跨账户共享。
English
Resource access first requires a resource gateway and then a resource configuration association to the service network; resources can also be shared across accounts.
Transcript
01:17 Similarly there is resource configuration associations.
01:20 And for that you have to first create the resource gateway.
01:23 And then using that gateway you create resource configuration association with the VPC lattice service
01:29 network.
01:30 So it works exactly in the same fashion as service will work.
01:33 And you can also share the resources across AWS accounts.
01:39 Okay.
01:39 So far so good.
01:40 So these are the simplest form of the association.
7. VPC Association 允许客户端发起请求
时间范围：01:43–02:12
总结 / Summary
中文
只有建立 VPC Association 后，消费者 VPC 内的 Client 才能对 Service Network 中的服务或资源主动发起请求。
English
Clients in a consumer VPC can initiate requests to services or resources in the service network only after the VPC association is created.
Transcript
01:43 And now let's talk about the VPC association.
01:46 Now here I said that if you want to access the VPC lattice network and the services from a particular
01:53 VPC, then that VPC has to be associated with the VPC lattice network using the VPC association.
02:02 And once you do that, then the clients in that VPC can access or they can initiate the request for
02:10 the VPC lattice services.
8. Link-Local Address 169.254.171.x
时间范围：02:12–03:17
总结 / Summary
中文
VPC Association 使用 169.254.171.x 链路本地地址（Link-Local Address）。该地址只在关联 VPC 内可达，不能从 Peered VPC 传递访问；请求仍需满足授权策略（Auth Policy）。
English
A VPC association uses the 169.254.171.x link-local range. It is reachable only within the associated VPC and cannot be accessed transitively from a peered VPC; requests must still satisfy auth policies.
Transcript
02:12 And all this communication happens over the local link address inside the VPC.
02:17 And if you know this addresses start with 169.254 range.
02:22 So for VPC lattice that range is 169.254.171.
02:28 And then some IP address.
02:30 So when you create the VPC association AWS will have this IP configured.
02:36 And this particular local link IP is accessible only from within the VPC.
02:41 Which means if there is another VPC which is peer to this VPC, it cannot access this IP address.
02:49 And that's where only client inside this VPC can access the VPC lattice service network.
02:57 So please remember this right.
03:00 So once you do this VPC association.
03:02 Now this client here in this VPC can access other VPC lattice services and the resources given that
03:10 there are write auth policies.
03:12 So the communication would happen something like this okay.
9. VPC Endpoint Association 用于远程网络
时间范围：03:17–03:53
总结 / Summary
中文
当 VPN、Direct Connect 或其他远程网络需要通过 Shared Services VPC 访问 Lattice 时，链路本地地址无法使用，因此应创建 VPC Endpoint Association。
English
When VPN, Direct Connect, or other remote networks need access through a shared-services VPC, the link-local address cannot be used, so a VPC endpoint association is required.
Transcript
03:17 The next association type is VPC endpoint association.
03:21 Now as we discussed if you have say some shared services VPC through which you want to allow access
03:26 to other networks for the VPC lattice network, then the VPC association won't help because this IP
03:33 address here is not accessible from this network.
03:36 Right.
03:37 And hence in this case instead you have to create VPC endpoint association.
03:44 So this is the VPC private link or the endpoint feature where you are creating the VPC endpoint in this
03:49 VPC for the VPC lattice service network.
10. Endpoint ENI 与 VPC Private IP
时间范围：03:53–04:00
总结 / Summary
中文
Service Network Endpoint 会在 VPC 中创建弹性网络接口（Elastic Network Interface，ENI），并从 VPC CIDR 分配私有 IP，因此远程路由可以到达它。
English
A service-network endpoint creates an elastic network interface in the VPC with a private IP from the VPC CIDR, making it reachable through remote routing.
Transcript
03:53 Now because this is a endpoint, it creates the Eni.
03:56 And there is a private IP address from the range of the VPC.
11. 通过 VPN、DX、Peering 或 TGW 访问
时间范围：04:00–04:49
总结 / Summary
中文
来自 VPC 外部的流量可经 VPN、Direct Connect（DX）、VPC Peering 或 Transit Gateway（TGW）到达 Endpoint，再进入 VPC Lattice Service Network。
English
Traffic from outside the VPC can reach the endpoint through VPN, Direct Connect, VPC peering, or Transit Gateway and then enter the VPC Lattice service network.
Transcript
04:00 And now this IP can be accessed from the clients which are connected over VPN or DD or VPC peering or
04:09 transit gateway.
04:10 So once you do that, these clients can access the VPC lattice network.
04:15 So remember this.
04:17 So in order to access the VPC lattice network from the remote network you have to create a VPC endpoint
04:23 of type service network.
04:25 And it connects VPC to the service network.
04:28 Further clients traffic that comes from outside of the VPC over all these connections then can reach
04:35 to the VPC lattice network.
04:37 Now when you create a VPC endpoint in a VPC, as I said, IP is from the VPC are used to establish this
04:44 connectivity, right.
04:46 So I hope this is clear.
12. 创建 Service Network Endpoint
时间范围：04:49–05:04
总结 / Summary
中文
在 VPC Console 的 Endpoints 页面创建端点，选择面向 VPC Lattice Service Network 的 Endpoint Type 和相应服务名称。
English
Create the endpoint from the VPC console Endpoints page by selecting the endpoint type and service name for a VPC Lattice service network.
Transcript
04:49 So how do you create VPC endpoint.
04:51 So you go to the VPC console.
04:53 And there in the endpoint you can create the endpoint with the name this com dot Amazon AWS.
04:58 And then region dot VPC lattice.
05:03 Right.
13. Endpoint Service Name
时间范围：05:04–05:12
总结 / Summary
中文
端点服务名称采用区域化的 VPC Lattice Service Network 服务标识；创建时还需选择 VPC、Subnet 和 Security Group 等参数。
English
The endpoint service name uses the regional VPC Lattice service-network identifier, and creation also requires choosing the VPC, subnets, security groups, and related settings.
Transcript
05:04 So we talked about all four types of the association.
05:06 Now before we stop for this lecture I just want to bring up an important point.
14. Service Association 不赋予发起能力
时间范围：05:12–06:00
总结 / Summary
中文
Service Association 只让 Service A 和 Service B 成为 Service Network 中的目标。如果 Service A 所在 VPC 没有 VPC Association，Service A 不能主动调用 Service B；它只能响应请求。
English
A service association only makes Service A and Service B targets in the service network. If Service A's VPC lacks a VPC association, Service A cannot initiate a call to Service B and can only respond to requests.
Transcript
05:12 So in this lecture we said that VPC associations allows the client to access the VPC lattice network
05:19 and services.
05:20 And these green arrows represents the same.
05:24 But what if say service A wants to communicate with service B through the VPC lattice network.
05:30 Now it is not allowed.
05:32 That's because these services are just associated with service association.
05:38 This VPC here and the VPC lattice network are not connected over the VPC association.
05:45 So remember this thing.
05:47 And this also means that if service A needs to initiate the traffic for service B, this VPC has to
05:55 be associated with the VPC lattice network over the VPC association.
15. VPC Association 决定流量方向
时间范围：06:00–07:04
总结 / Summary
中文
为 Service A 所在 VPC 添加 VPC Association 后，Service A 才能主动访问 Service B。若 Service B 所在 VPC 没有关联，Service B 仍不能反向发起到 Service A，说明关联具有明确的方向性。
English
After adding a VPC association for Service A's VPC, Service A can initiate access to Service B. If Service B's VPC is not associated, Service B still cannot initiate the reverse call, demonstrating the directional nature of associations.
Transcript
06:00 So you would have to do something like this.
06:03 And now service A can also initiate the traffic.
06:07 And at the same time service B can only respond to the request from service A.
06:13 So service B will not be able to initiate the traffic to service A.
06:18 That's because there is no VPC association between this VPC and the VPC lattice network.
06:25 So this is very important to understand because many a times people will just set this up and they expect
06:32 that all services should be able to communicate with each other by default.
06:36 It doesn't happen like that, right?
06:39 So with that I hope it is clear.
06:41 And now you understand all these different types of the associations and with this knowledge.
06:46 Now let's go to the next lecture where we will see end to end traffic flow, where client initiates
06:52 the traffic flow or the request for the VPC lattice service.
06:57 Right.
06:58 So with that let's stop for this lecture and let's go to the next lecture.
07:02 Thank you.
整讲总结 / Overall Summary
中文
本讲说明 VPC Lattice 服务网络（Service Network）的四类关联：服务关联（Service Association）、资源配置关联（Resource Configuration Association）、VPC 关联（VPC Association）和 VPC 端点关联（VPC Endpoint Association）。服务或资源关联决定哪些提供方加入服务网络，并可通过 AWS Resource Access Manager（RAM）跨账户共享；VPC 关联决定某个 VPC 内的客户端是否能够发起访问。VPC 关联使用链路本地地址（Link-Local Address）169.254.171.x，该地址不能通过 VPC Peering 等连接传递。远程网络若经 VPN、Direct Connect、VPC Peering 或 Transit Gateway 访问 Lattice，应创建类型为服务网络（Service Network）的 VPC Endpoint，使流量使用 VPC 地址范围内的 ENI 私有 IP。关键方向性规则是：Service Association 只让服务成为目标，并不自动让服务所在 VPC 发起请求；要让 Service A 主动调用 Service B，Service A 所在 VPC 也必须具有 VPC Association。
English
This lecture explains the four association types for a VPC Lattice service network: service association, resource configuration association, VPC association, and VPC endpoint association. Service and resource associations determine which providers join the service network and may be shared across accounts through AWS Resource Access Manager. A VPC association determines whether clients in a VPC can initiate access. It uses the link-local 169.254.171.x range, which is not reachable transitively through VPC peering or other connections. Remote networks connected through VPN, Direct Connect, VPC peering, or Transit Gateway should use a service-network VPC endpoint, whose ENI has a private IP from the VPC range. A crucial directional rule is that a service association only makes a service a target; it does not automatically let the service's VPC initiate requests. For Service A to call Service B, Service A's VPC must also have a VPC association.