Lecture 158: VPC lattice traffic flow
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：05:16
- 来源：Udemy Lecture 48015563
- Slide 数量：17
- 画面切换：00:14、00:54、01:33、01:46、02:00、02:24、02:26、02:31、03:02、03:31、03:41、03:54、04:11、04:21、04:34、04:53
扫描说明
逐条检查了 Udemy 页面中的 86 条 Transcript cue，并按时间轴扫描全长约 05:16 的视频。对 20 个主题与动画揭示时刻进行 Transcript 精确跳转截图，剔除 3 个只有讲师光标移动、没有新增内容的重复帧，最终保留 17 个有效画面阶段。每次截图前均把页面校正到播放器顶部并从视频元素中计算真实 16:9 媒体区域；最终图片无 Transcript 侧栏、无播放器控件、无黑边、无右侧或下方裁切，并输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC Lattice Traffic Flow 概览
时间范围：00:00–00:14
总结 / Summary
中文
本讲跟踪 Client 从消费者 VPC 访问 Service Provider VPC 中 Target 的端到端流量。
English
This lecture traces end-to-end traffic from a client in a consumer VPC to a target in a service-provider VPC.
Transcript
00:01 Okay.
00:01 So we have talked about the basics of VPC lattice.
00:05 And now before moving to the exercises let's quickly talk about VPC lattice traffic flow.
00:10 And then we will actually see this in action.
00:14 Okay.
2. Client、Service Network、Service 与 Target
时间范围：00:14–00:54
总结 / Summary
中文
常见架构包含通过 VPC Association 接入的 Client VPC、VPC Lattice Service Network、Service A，以及 Provider VPC 中的 Target。
English
A common architecture contains a client VPC attached through a VPC association, a VPC Lattice service network, Service A, and a target in the provider VPC.
Transcript
00:14 So as you can see here we have VPC lattice network here.
00:18 And then there is a client VPC which is connected over VPC association.
00:23 And then we have VPC lattice service which ultimately sends the traffic to the target in the service
00:30 provider VPC.
00:31 Right.
00:32 So this is a very common architecture for VPC lattice.
00:36 Now here the client wants to actually send the traffic to this service a right.
00:43 Now in that case let us see how this traffic flows and what are the different things which you need
00:49 to take care to establish this end to end connectivity okay.
3. VPC Lattice Managed DNS
时间范围：00:54–01:33
总结 / Summary
中文
创建 Service 后，VPC Lattice 提供 AWS 托管 DNS 名称（Managed DNS Name），客户端可以直接用该名称发现服务。
English
After a service is created, VPC Lattice provides an AWS-managed DNS name that clients can use directly for service discovery.
Transcript
00:54 So very first thing when you create a service in VPC lattice, as we said there is a service discovery.
01:00 And for that VPC lattice will provide its own DNS name, and it is in the format as service name that
01:08 you provide.
01:09 And then there is AWS managed DNS, which looks something like this.
01:14 And it ends in the region name on AWS.
01:19 So if you don't want to use your custom DNS, then this client here can access the VPC lattice service
01:25 using this particular DNS.
01:27 But as you know, you might want to have your own domain name for your services.
4. Route 53 Custom Domain
时间范围：01:33–01:46
总结 / Summary
中文
若需要自定义域名（Custom Domain Name），可在 Route 53 Hosted Zone 中创建 CNAME，指向 Lattice 托管 DNS 名称。
English
For a custom domain name, create a CNAME in a Route 53 hosted zone that points to the Lattice-managed DNS name.
Transcript
01:33 And in that case, you can create your own route 53 hosted zone.
01:36 And in that you can create the CNAME records to point your domain name to this VPC lattice provided
01:42 DNS name right.
01:44 So you have the DNS name.
5. 步骤 1：DNS Query
时间范围：01:46–02:00
总结 / Summary
中文
Client 首先发起 DNS Query；请求可由 VPC Lattice DNS 或自定义 Route 53 Hosted Zone 解析。
English
The client first issues a DNS query, which can be resolved by VPC Lattice DNS or by a custom Route 53 hosted zone.
Transcript
01:46 Now the first thing that client will do is make a DNS query.
01:50 Right now this DNS query might be resolved by this VPC lattice DNS.
01:55 Or it can be resolved by route 53 hosted zone that you created.
6. 解析得到 Link-Local Address
时间范围：02:00–02:24
总结 / Summary
中文
DNS 响应返回 VPC Lattice Endpoint 的 169.254.171.x 链路本地地址（Link-Local Address）；该地址只在关联 VPC 内可访问。
English
The DNS response returns the VPC Lattice endpoint's 169.254.171.x link-local address, which is reachable only inside the associated VPC.
Transcript
02:00 And as a result of this DNS query, client will receive the local link address for the VPC lattice network
02:07 endpoint.
02:09 And as we discussed, this local link address.
02:11 Is accessible only from within this VPC.
02:14 So now client has this IP address.
02:17 Okay.
02:18 So at this point client receives the IP address.
02:19 And now client wants to send the traffic to that IP address.
7. 步骤 2：检查 Security Groups
时间范围：02:24–02:26
总结 / Summary
中文
客户端向链路本地地址发送流量前，需要检查两层安全组（Security Group）。
English
Before the client sends traffic to the link-local address, two security-group layers must be checked.
Transcript
02:24 And there comes the security groups.
8. Client Outbound Security Group
时间范围：02:26–02:31
总结 / Summary
中文
EC2 Security Group 必须允许客户端向 Service Port 发出的 Outbound Traffic。
English
The EC2 security group must allow outbound traffic from the client to the service port.
Transcript
02:26 Now there are two security groups one for the client for the outbound traffic.
9. VPC Association Inbound Security Group
时间范围：02:31–03:02
总结 / Summary
中文
VPC Association 自身的 Security Group 必须允许来自客户端私有 IP 的 HTTP/HTTPS Inbound Traffic。
English
The VPC association's security group must allow inbound HTTP/HTTPS traffic from the client's private IP.
Transcript
02:31 And then this VPC lattice association itself has a security group.
02:36 So if you see the EC2 security group has to allow the outbound traffic.
02:41 And this VPC association security group has to allow the inbound traffic for the HTTP or Https protocol.
02:49 Right.
02:50 So in this you should have this security group rules added so that traffic can flow from this client
02:58 to this local link address okay.
10. 步骤 3：评估 Auth Policies
时间范围：03:02–03:31
总结 / Summary
中文
流量通过 Security Group 后，Service Network 与 Service 层评估授权策略（Auth Policy）。Auth Type 为 NONE 时默认允许；为 AWS_IAM 时必须存在显式允许（Explicit Allow）。
English
After security-group checks, auth policies at the service-network and service layers are evaluated. NONE permits by default, while AWS_IAM requires an explicit allow.
Transcript
03:02 So once it passes the security groups then it will check the auth policies at the VPC lattice service
03:09 network layer and the service layer.
03:12 Right.
03:13 And in the previous lecture we learned that if the auth policy is none then the traffic is allowed by
03:17 default.
03:18 But if the auth policy is set to aws IAM, then there should be explicit allow statement for this traffic
03:24 to flow right.
03:26 So it will check the auth policies and then traffic will go to the service.
03:30 Okay.
11. 到达 Service Listener
时间范围：03:31–03:41
总结 / Summary
中文
流量进入 Service Endpoint 后先到 Listener，再由 Listener Rules 决定后续动作。
English
After reaching the service endpoint, traffic arrives at the listener, whose rules determine the next action.
Transcript
03:31 So traffic reaches to the service end point.
03:34 And at this point as you know service has the listener.
03:37 And then service has rules and the target groups.
03:40 Right.
12. Rule 选择 Target Group
时间范围：03:41–03:54
总结 / Summary
中文
Listener Rule 根据已配置的条件选择特定 Target Group，再把请求交给该组中的 Target。
English
A listener rule evaluates its configured conditions, selects a target group, and forwards the request toward a target in that group.
Transcript
03:41 So according to the rule that you have specified, it will take action and will send that traffic to
03:46 specific target group.
03:49 Now once it reaches the target group then it will be sent to the target.
13. 步骤 4：Target Security Group
时间范围：03:54–04:11
总结 / Summary
中文
Target 所在 EC2、ALB、ECS 或 EKS 的 Security Group 必须允许来自 VPC Lattice 的 Inbound Traffic。
English
The security group on the target—such as EC2, ALB, ECS, or EKS—must allow inbound traffic from VPC Lattice.
Transcript
03:54 And at this point as well there is a security group, right.
03:59 Now this security group should allow the inbound traffic from VPC lattice network Cidr range.
04:07 Right.
04:07 And that range is 169.254.
14. 使用 VPC Lattice Managed Prefix List
时间范围：04:11–04:21
总结 / Summary
中文
最佳实践是把 VPC Lattice 托管前缀列表（Managed Prefix List）作为 Security Group Source，而不是允许整个 169.254.0.0/16。
English
Best practice is to use the VPC Lattice managed prefix list as the security-group source rather than allowing the entire 169.254.0.0/16 range.
Transcript
04:11 But the best practice is to allow only to VPC lattice managed prefix list, and it pops up when you
04:17 create that inbound rule in the security group.
15. 请求到达 Target 并返回
时间范围：04:21–04:34
总结 / Summary
中文
所有检查通过后，请求到达 Target；响应作为 Return Traffic 沿已建立的路径回到 Client。
English
After all checks succeed, the request reaches the target and the response returns to the client along the established flow.
Transcript
04:21 Now, once you do that, then this traffic reaches to the target, and then it goes back to the client
04:27 as a return traffic.
04:30 Right.
04:30 So I hope it is clear.
04:32 Now just one more thing to understand.
16. 不需要 Route Tables
时间范围：04:34–04:53
总结 / Summary
中文
整个 Lattice Traffic Flow 不依赖用户配置 Route Table；DNS 解析、链路本地地址和托管数据面完成转发。
English
The entire Lattice traffic flow requires no user-configured route tables; DNS resolution, link-local addressing, and the managed data plane perform forwarding.
Transcript
04:34 In this entire flow, there are no route tables.
04:37 We haven't configured any route table.
04:40 All this traffic flows just based on the DNS and this local IP address.
04:46 So there are no route tables to be configured for this VPC lattice traffic flow.
04:52 Okay.
04:52 So I hope it is clear.
17. End-to-End Flow 总结
时间范围：04:53–05:16
总结 / Summary
中文
完整路径依次是 DNS、Client 与 Association Security Groups、Auth Policies、Listener Rule、Target Group、Target Security Group 和 Return Traffic；关键结论是无需 Route Table Changes。
English
The complete path is DNS, client and association security groups, auth policies, listener rule, target group, target security group, and return traffic; the key conclusion is that no route-table changes are needed.
Transcript
04:53 And now you have sufficient knowledge to get into the exercise.
04:58 So in the next lecture let's do similar exercise.
05:01 What you see here we are client from one VPC will connect to the service in another VPC through the
05:08 VPC lattice network.
05:09 Right.
05:10 So let's stop here for this lecture.
05:12 And let's go to the exercise.
05:15 Thank you.
整讲总结 / Overall Summary
中文
本讲沿一次完整请求说明 VPC Lattice 流量路径。客户端先解析 VPC Lattice 托管 DNS 名称（Managed DNS Name），或通过 Route 53 CNAME 使用自定义域名（Custom Domain Name），得到 169.254.171.x 链路本地地址（Link-Local Address）。流量离开客户端前要通过 EC2 Security Group 的出站规则，并由 VPC Association Security Group 的入站规则允许 HTTP/HTTPS。随后 Service Network 和 Service 层的授权策略（Auth Policy）进行检查：NONE 默认允许，AWS_IAM 必须显式允许。Service Listener 根据 Rule 把请求发送到 Target Group，再到具体 Target；目标 Security Group 最佳实践是允许 VPC Lattice 托管前缀列表（Managed Prefix List），而不是放开整个 169.254.0.0/16。返回流量按会话回到客户端。整个过程依赖 DNS、链路本地地址和 Lattice 数据面，不需要配置 Route Table。
English
This lecture follows a complete VPC Lattice request path. The client first resolves the VPC Lattice managed DNS name, or a custom domain backed by a Route 53 CNAME, and receives a 169.254.171.x link-local address. Before leaving the client, traffic must pass the EC2 security group's outbound rules and the VPC association security group's inbound HTTP/HTTPS rules. Auth policies at the service-network and service layers are then evaluated: NONE permits by default, while AWS_IAM requires an explicit allow. The service listener applies rules to select a target group and then a target. The target security group should allow the VPC Lattice managed prefix list rather than the entire 169.254.0.0/16 range. Return traffic flows back to the client. The path relies on DNS, link-local addressing, and the Lattice data plane, so no route-table configuration is required.