Lecture 159: Hands on: VPC lattice service access with custom domain name
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：21:47
- 来源：Udemy Lecture 48015637
- Slide 数量：42
- 画面切换：00:24、01:52、02:22、03:19、03:50、04:15、04:47、05:11、05:39、06:13、06:37、07:23、07:41、08:15、08:43、09:29、09:59、10:24、10:45、11:11、11:34、11:57、12:25、12:51、13:20、13:51、14:10、14:39、15:00、15:20、16:04、16:37、17:05、17:33、18:01、18:32、19:09、19:32、20:00、20:30、21:03
扫描说明
逐条读取了 Udemy 页面中的 374 条 Transcript cue，并按时间轴扫描全长约 21:47 的视频。先按约每 8 条 cue 精确跳转并截取 47 个候选画面，再通过联系表逐张检查，移除 4 张纯重复帧和 1 张仅显示加载状态的画面，最终保留 42 个独立幻灯片或有意义的控制台步骤。每次截图均关闭 Transcript 侧栏、校正页面到播放器顶部，并依据 video 元素实时计算真实 16:9 媒体区域；成品无播放器控件、无错误弹窗、无黑边，也没有右侧或下方裁切，统一输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 实验架构概览
时间范围：00:00–00:24
总结 / Summary
中文
实验从客户端虚拟私有云（Client VPC）中的弹性计算云（EC2）实例发起请求，访问应用侧的两个目标。
English
The exercise begins with an EC2 client in a client VPC that sends requests to two application-side targets.
Transcript
00:00 Hi.
00:01 Now let's do the exercise for VPC lattice.
00:04 And this exercise is very similar to what we just saw in the traffic flow lecture.
00:08 Right.
00:09 So on the left side we will have the client VPC in which we will have a simple EC2 instance from where
00:15 we will check the connectivity to the VPC lattice service.
00:18 And on the right side we have two targets.
00:22 One is inside the VPC.
2. EC2、Lambda 与 Custom Domain 架构
时间范围：00:24–01:52
总结 / Summary
中文
应用服务（Application Service）通过路径把流量分别转发到 EC2 Web 目标和无服务器函数（Lambda）目标；客户端 VPC 通过 VPC 关联（VPC Association）接入服务网络（Service Network），并使用 Route 53 私有托管区域（Private Hosted Zone）提供自定义域名（Custom Domain Name）。两个 VPC 故意使用重叠的无类别域间路由（CIDR），以验证 VPC Lattice 对重叠地址空间的支持。
English
The application service routes requests by path to EC2 and Lambda targets. The client VPC joins the service network through a VPC association, while a Route 53 private hosted zone supplies a custom domain. Both VPCs deliberately use overlapping CIDRs to demonstrate that VPC Lattice handles overlapping address spaces.
Transcript
00:24 And that's a simple EC2 instance with a web server.
00:27 And it will listen on port 80.
00:29 Then we have another target which is the lambda function.
00:33 And then we will have VPC lattice service which will route the traffic to corresponding target group
00:39 based on the URL path.
00:40 For example, if you enter say service name slash EC2 then it goes to this target.
00:46 And if it is slash lambda then it goes to this target right.
00:50 So we will create this app service.
00:52 We will register this target groups and targets.
00:55 We will create a listener.
00:56 And then we will associate this app service with the VPC lattice network.
01:01 At the same time, we will also associate this client VPC with the VPC lattice network using VPC association.
01:10 And we want to access these services using the custom domain name.
01:13 And that domain name could be say example.com.
01:16 So we will create route 53 private hosted zone.
01:19 And in that we will create corresponding records.
01:22 So this is the premise of this exercise.
01:25 And to be honest just looking at this architecture you should be able to implement this.
01:29 And for that I have also provided high level steps here.
01:33 So you can follow these steps and try to implement this.
01:37 Now a few interesting thing here that you should note is that we are creating both the client VPC and
01:43 the application VPC with the same Cidr range.
01:46 So VPC lattice solves the problem of overlapping cidrs right.
01:51 That's one thing.
3. Security Group 检查要点
时间范围：01:52–02:22
总结 / Summary
中文
实验需要同时关注客户端实例、安全组（Security Group）、VPC 关联和目标侧的入站与出站规则；讲师已预先创建两个 VPC 及其公有子网（Public Subnet）。
English
The exercise requires careful attention to client, association, and target security-group rules. Two VPCs and their public subnets have already been created.
Transcript
01:52 Second, please pay attention to the security groups because as we talked in the earlier lecture, there
01:58 are different security groups that comes into play.
02:01 So you have to make sure right, inbound or outbound rules are there.
02:06 Right.
02:07 Okay.
02:08 So that is what we are going to do in this exercise.
02:10 And just to save some time, what I have already done, I have created just these two VPCs.
02:16 And in that I have just created two public subnets so that we can launch our instances.
4. 为什么暂用 Public Subnets
时间范围：02:22–03:19
总结 / Summary
中文
实例放入公有子网（Public Subnet）只是为了便于登录、安装 Web Server 和测试；生产环境可使用私有子网（Private Subnet），但需要网络地址转换网关（NAT Gateway）等出站能力。
English
The instances use public subnets only to simplify login, web-server installation, and testing. Private subnets could be used in production, but they would need outbound access such as a NAT gateway.
Transcript
02:22 Now to be honest, we don't need these instances to be public, but just because we want to connect
02:26 to this instance to test the connectivity.
02:29 And also for app instance we have to install the web server.
02:33 We are going to launch that in a public subnet.
02:35 But as I said you can very well have them in private subnet.
02:39 But then you will need Nat gateways and all those things.
02:42 So to simplify the architecture we will create that in the public subnets.
02:46 Okay with that.
02:47 Now let's go to the AWS console and let's proceed with the steps.
02:52 So as I said these VPCs and public subnets are already there.
02:55 I'll show you that first.
02:57 And then I will launch two EC2 instances in these two VPCs a client EC2 and the application EC2.
03:06 Okay, so as you can see here, this is client VPC and the Cidr range is this same for the application
03:11 VPC.
03:12 Then I have two public subnets and you can very well check the routes for this public subnet.
03:17 And it is nothing special right.
5. 创建 Client EC2
时间范围：03:19–03:50
总结 / Summary
中文
客户端弹性计算云（Client EC2）被部署到客户端 VPC 的普通公有子网，并使用现有路由表（Route Table）和互联网网关（Internet Gateway）。
English
The client EC2 instance is launched in a standard public subnet of the client VPC, using the existing route table and internet gateway.
Transcript
03:19 It's a normal public subnet.
03:21 And corresponding route tables are there and internet gateways are there.
03:25 So all very simple right.
03:27 Next as I said we will create the client EC2 and the app EC2 in corresponding VPCs.
03:34 So let's go to the EC2 and launch the instance.
03:37 Let's call it say client EC2 and we will go with the key pair.
03:46 Then network.
03:47 We want to create that in the client VPC.
6. Client EC2 网络与 SSH
时间范围：03:50–04:15
总结 / Summary
中文
客户端实例启用公有 IP（Public IP），安全组（Security Group）只需允许安全外壳协议（SSH）；随后将从该实例发起 HTTP 请求测试 Lattice 服务。
English
The client receives a public IP and its security group permits SSH. HTTP requests to the Lattice service will later originate from this instance.
Transcript
03:50 And I want a public IP so that I can connect and then can initiate the request to the VPC lattice later.
03:56 And the security group wise Twice.
03:58 I just need simple ssh.
04:01 Right.
04:02 Because that's what we are going to use for connection.
04:06 And then we will initiate the ping request or HTTP request from here.
04:12 Okay.
04:12 That's it I don't think I need anything else.
7. 创建 Application EC2
时间范围：04:15–04:47
总结 / Summary
中文
第二个弹性计算云（EC2）实例部署到应用 VPC，并新建应用安全组（Application Security Group）。
English
A second EC2 instance is launched in the application VPC with a new application security group.
Transcript
04:15 And let's launch the instance.
04:18 Cool.
04:19 Let's go back refresh.
04:22 And now let's launch our app EC2 instance in the app VPC.
04:37 So there is just one subnet.
04:38 We want public IP here as well.
04:40 And and we want to create a new security group.
04:43 So let's call it app SG.
8. 临时开放 SSH 与 HTTP
时间范围：04:47–05:11
总结 / Summary
中文
应用安全组（Application Security Group）暂时允许 SSH 以安装 Web Server，并允许 HTTP 以验证服务；HTTP 公网规则将在测试后删除。
English
The application security group temporarily permits SSH for installation and HTTP for web-server validation. The public HTTP rule will be removed after testing.
Transcript
04:47 Now with respect to its uh rules.
04:50 So we want to connect over SSH so that we can install the web server.
04:54 And additionally we want as of now HTTP traffic to be tested so that we can check whether web server
05:00 is installed properly or not.
05:02 And later we can remove this rule as well.
05:04 And I'll tell you why.
05:06 So let's launch the instance.
05:11 Okay.
9. 准备 Route 53 Private Hosted Zone
时间范围：05:11–05:39
总结 / Summary
中文
下一步创建 Route 53 私有托管区域（Private Hosted Zone）并关联客户端 VPC；为解析其中的 DNS 记录，还必须启用 VPC 的 DNS 设置。
English
Next, a Route 53 private hosted zone is associated with the client VPC. The VPC DNS settings must also be enabled so its records can resolve.
Transcript
05:11 Instance has been launched.
05:13 Let's go back to our steps and check what is next.
05:18 Okay.
05:18 Next is we want to create route 53 private hosted zone and associate that with the client VPC.
05:24 And in order to resolve the route 53 DNS records we have to enable DNS settings for the client VPC.
05:32 Now this is very important step so don't forget about that.
05:36 Okay.
05:37 So let's go to the route 53.
10. 创建 example.com Hosted Zone
时间范围：05:39–06:13
总结 / Summary
中文
创建 example.com 私有托管区域（Private Hosted Zone），将其关联到 Mumbai Region 的客户端 VPC，并启用 DNS 主机名（DNS Hostnames）与 DNS 解析（DNS Resolution）。
English
An example.com private hosted zone is created and associated with the client VPC in the Mumbai Region, with DNS hostnames and DNS resolution enabled.
Transcript
05:39 And let's create the hosted zone.
05:43 Let's call it say example.com.
05:48 And it is a private hosted zone.
05:50 And we want to associate that with the VPC in the Mumbai region that I'm using.
05:56 And it should be client VPC right.
05:59 So let's create the hosted zone.
06:01 And as I said don't forget to turn on the DNS settings for this VPC.
06:07 So let's go to the client VPC edit VPC settings and enable both these settings.
11. 登录 App EC2
时间范围：06:13–06:37
总结 / Summary
中文
保存 VPC DNS 设置后，复制应用实例的公有 IP（Public IP），通过 PuTTY 建立安全外壳协议（SSH）会话。
English
After saving the VPC DNS settings, the application instance's public IP is copied and a PuTTY SSH session is opened.
Transcript
06:13 And save it.
06:15 Okay that is done.
06:16 Now next we want to just log in to EC2 instance on the application side.
06:21 And we want to make sure that web server is installed and running.
06:25 So let's go there in the EC2.
06:30 And this is my VPC.
06:31 Let's copy the public IP.
06:33 And now I will log in over the putty session.
12. 安装并启动 httpd
时间范围：06:37–07:23
总结 / Summary
中文
在实例上使用 yum 安装 httpd，借助 systemctl 启动 HTTP 服务（HTTP Service），并创建简单的首页文件。
English
The instructor installs httpd with yum, starts the HTTP service with systemctl, and creates a simple home page.
Transcript
06:37 Okay so let's open the session with EC2 dash user.
06:43 Okay.
06:44 Now this is very simple.
06:45 Just say sudo yum install httpd.
06:50 Yes.
06:54 Then sudo systemctl start httpd dot service and you can just create a file.
07:15 Sorry.
07:20 And say.
13. 验证 Hello from EC2
时间范围：07:23–07:41
总结 / Summary
中文
浏览器通过实例公有 IP（Public IP）访问端口 80，成功返回 Hello from EC2，确认 Web Server 正常工作。
English
A browser reaches port 80 through the instance's public IP and receives Hello from EC2, confirming that the web server works.
Transcript
07:23 Hello from EC2.
07:25 That's it.
07:27 Okay.
07:27 And we can test the connectivity.
07:29 Okay.
07:30 So let's go here and let's say http colon slash slash and the IP address of the instance.
07:37 And you can see hello from EC2.
07:39 So it is working as expected.
14. 移除 Public HTTP Rule
时间范围：07:41–08:15
总结 / Summary
中文
验证完成后删除应用安全组（Application Security Group）的公网 HTTP 入站规则，使 Web 服务不能再被互联网直接访问。
English
After validation, the public HTTP inbound rule is removed from the application security group so the web service is no longer directly reachable from the internet.
Transcript
07:41 And as I said we just wanted the HTTP connectivity from outside only for testing whether web server
07:48 is running or not.
07:49 So at this point I can even just go to the security group of the app EC2 instance and can remove this
07:56 entry, which makes this instance kind of private, right?
08:01 We can't access HTTP service from outside.
08:05 Okay, so that's done.
08:08 So we have done up to step number six.
08:10 And now let's create a lambda function with the default hello world kind of function.
15. 创建 App Lambda
时间范围：08:15–08:43
总结 / Summary
中文
创建名为 app-lambda 的无服务器函数（Lambda Function），保留默认 Python Runtime 和其他默认配置。
English
An app-lambda function is created with the default Python runtime and the remaining default settings.
Transcript
08:15 And then we will move towards the VPC lattice configuration.
08:18 And in there we will create the target groups one for EC2 instance and one for lambda function.
08:24 So let's do that.
08:26 Okay so let's create the lambda function say author from scratch.
08:30 Let's call it app lambda.
08:32 So app dash Lambda.
08:35 And it could be Python.
08:39 Most of the settings as it is let's create the function.
16. 创建 EC2 Target Group
时间范围：08:43–09:29
总结 / Summary
中文
确认 Lambda 默认代码可返回 Hello World 后，进入 VPC Lattice 创建实例类型目标组（Instance Target Group），协议为 HTTP、端口为 80，并选择应用 VPC。
English
After confirming that the Lambda default code returns Hello World, an instance-type VPC Lattice target group is created for HTTP on port 80 in the application VPC.
Transcript
08:43 And by default if you see it will create hello world kind of lambda function.
08:52 Right.
08:52 So that's the lambda code.
08:53 And if you just go and test this lambda function, it will just have this kind of message.
08:59 And that is sufficient for us.
09:01 So lambda has been created.
09:03 Now let's go to the VPC lattice.
09:05 So all the settings are on the left side.
09:07 And there you see this target groups right.
09:10 So let's go to the target group.
09:12 And let's create a target group.
09:14 Now the target is instance first.
09:16 And the target group name is say EC2.
09:19 And the protocol is HTTP on port 80.
09:22 And this is for the app VPC.
09:25 Now rest of the settings as it is say next.
17. 注册 EC2 Target
时间范围：09:29–09:59
总结 / Summary
中文
将应用 EC2 注册到目标组（Target Group）。目标健康状态（Health Status）最初为 Pending，关联服务并开始健康检查（Health Check）后应变为 Healthy。
English
The application EC2 instance is registered in the target group. Its health initially remains Pending and should become Healthy after the service association enables health checks.
Transcript
09:29 And we need to include this particular instance.
09:33 Right now the health status is pending.
09:35 But as soon as we associate this target group with the VPC lattice service, then it will make the health
09:40 check, which is very similar to the Elastic Load balancer if you remember.
09:44 And it will turn to healthy.
09:47 So let's create this target group for the EC2 instance.
09:54 Okay, so target group has been created.
09:57 Now let's create another target group.
18. 创建 Lambda Target Group
时间范围：09:59–10:24
总结 / Summary
中文
新建无服务器函数类型目标组（Lambda Target Group），选择 app-lambda 函数作为目标，完成第二个目标组。
English
A Lambda-type target group is created and the app-lambda function is selected as its target.
Transcript
09:59 And this time it is for the lambda function.
10:02 So let's call it say lambda target group.
10:06 And next we have to select our lambda function.
10:11 Rest of the settings as it is.
10:12 And let's create this target group.
10:17 Okay.
10:18 So both the target groups have been created.
10:22 And we are done with the step nine.
19. 规划 VPC Lattice Service
时间范围：10:24–10:45
总结 / Summary
中文
接下来创建 VPC Lattice 服务（Service），绑定自定义域名（Custom Domain Name），添加端口 80 监听器（Listener），并用规则把请求转发到两个目标组。
English
The next step is to create a VPC Lattice service, assign a custom domain, add a port 80 listener, and route requests to the two target groups.
Transcript
10:24 Now let's go to the next step where we are going to create VPC lattice service.
10:29 So in that we will also associate that with the custom domain name.
10:32 We will create a listener on port 80.
10:35 And then we will add rules to route the traffic to both these target groups.
10:41 Right.
10:41 So let's do that.
10:42 And then we will proceed with the next steps.
10:45 Okay.
20. 创建 app-service
时间范围：10:45–11:11
总结 / Summary
中文
创建 app-service，配置 app.example.com 自定义域名（Custom Domain Name），不启用 HTTPS 证书，并把认证类型（Auth Type）设为 NONE。
English
The app-service is created with the app.example.com custom domain, no HTTPS certificate, and an auth type of NONE.
Transcript
10:45 So let's go to the lattice services.
10:47 Let's create a service.
10:48 Let's give it a name say app service.
10:52 And we are going to use a custom domain name and it will be app dot example.com.
11:00 Now we are not going to have https.
11:01 So we don't have or don't need to provide the certificate.
11:05 Auth type is none as of now.
11:07 And that's where the request from the client will be automatically allowed.
21. 添加 HTTP Listener
时间范围：11:11–11:34
总结 / Summary
中文
若使用身份与访问管理认证（IAM Authentication），必须提供相应策略；本实验保持 NONE，并添加端口 80 的 HTTP 监听器（Listener）。
English
IAM authentication would require corresponding policies, but this exercise keeps NONE and adds an HTTP listener on port 80.
Transcript
11:11 So remember these steps.
11:13 If you put IAM then you have to put corresponding IAM policies.
11:17 Now we are not going to share the service with any other AWS account.
11:20 So let's not do anything here and let's go to the next.
11:24 And now let's add a listener.
11:26 So for us the listener is port 80.
11:29 That is HTTP.
11:31 And we need to add a listener rule.
22. Lambda Path Rule
时间范围：11:34–11:57
总结 / Summary
中文
创建优先级为 10 的路径规则（Path Rule）：当路径为 /lambda 时，将 100% 流量转发到 Lambda 目标组（Lambda Target Group）。
English
A priority-10 path rule sends 100 percent of requests whose path is /lambda to the Lambda target group.
Transcript
11:34 So let's create a rule from here.
11:36 And let's call it say lambda rule.
11:39 The priority is ten and the condition is path condition.
11:42 So we are saying if the rule is slash lambda then send it to the corresponding target group.
11:50 That is a lambda target group.
11:52 And the weight wait is one that is 100%.
11:54 So let's add a rule.
11:56 Now this is one rule.
23. EC2 Default Rule
时间范围：11:57–12:25
总结 / Summary
中文
由于 EC2 Web Server 服务于根路径（Root Path），不再单独创建 /EC2 规则，而把 EC2 目标组（EC2 Target Group）设为默认转发动作（Default Action）。
English
Because the EC2 web server serves the root path, the EC2 target group becomes the default forwarding action instead of using a separate /EC2 rule.
Transcript
11:57 Now we could have added another rule which says EC2 goes to the EC2, but in that case it goes to the
12:04 path slash EC2.
12:06 But in our case the web server is on the slash.
12:09 So what we can rather do is we can just add a default rule.
12:12 If it doesn't matches to slash lambda or anything else, then forward it to the EC2 target group.
12:19 So things are same, but we are just configuring it in a different fashion.
12:23 Right.
12:24 Next.
24. 先创建 Service 再建 Service Network
时间范围：12:25–12:51
总结 / Summary
中文
当前尚无服务网络（Service Network），因此先跳过网络关联并完成服务（Service）创建，再准备创建服务网络。
English
Because no service network exists yet, the network association is skipped while the service is completed, and the service network will be created next.
Transcript
12:25 Now we don't have VPC lattice network as of now.
12:28 So let's skip this.
12:29 Say next and just create the service right.
12:35 So VPC lattice service has been created.
12:38 And now we will do the important thing that is creating the VPC lattice network.
12:44 Okay.
12:44 As we are going to create the VPC lattice network there are some prerequisites that we will first implement
12:50 right.
25. VPC Association Security Group 原理
时间范围：12:51–13:20
总结 / Summary
中文
客户端 VPC 与服务网络关联时，需要给链路本地地址（Link-Local Address）附加关联安全组（Association Security Group），允许来自客户端 VPC 网段的 HTTP 流量。
English
When the client VPC joins the service network, an association security group is attached to the link-local address and must permit HTTP from the client VPC CIDR.
Transcript
12:51 And the important one is creating the security group.
12:54 When we associate the client VPC with the VPC lattice network.
12:58 And I had explained that in the previous lecture.
13:00 So we need to create a security group in the client VPC.
13:04 And if you remember this security group is attached to the local link address right.
13:09 So it should accept the HTTP traffic from the client VPC Cidr.
13:14 Right.
13:15 So what I'm talking about here is this particular security group right.
26. 创建 Client Association SG
时间范围：13:20–13:51
总结 / Summary
中文
在客户端 VPC 中创建客户端关联安全组（Client VPC Association Security Group），并准备添加 HTTP 入站规则。
English
A client VPC association security group is created in the client VPC and prepared with an HTTP inbound rule.
Transcript
13:20 So let's do that right.
13:23 So let's go to the security groups.
13:25 And let's create a new security group.
13:27 Let's call it app.
13:30 Now let's call it client VPC association security group.
13:35 So it is clear.
13:38 And this should be in the client VPC.
13:41 And we need to add inbound rule which says for the HTTP traffic it should allow the client VPC Cidr
27. 允许 10.10.0.0/16 HTTP
时间范围：13:51–14:10
总结 / Summary
中文
入站规则允许来自客户端 VPC 无类别域间路由（CIDR）10.10.0.0/16 的 HTTP 流量，然后保存安全组（Security Group）。
English
The inbound rule permits HTTP from the client VPC CIDR 10.10.0.0/16, and the security group is saved.
Transcript
13:51 range which is ten dot ten .00 slash 16.
13:54 That's it.
13:56 And let's create this security group.
13:58 Okay.
13:59 That is done.
14:00 Now we can go ahead and create the VPC lattice network.
14:05 So let's go to the service network on the left side.
14:07 And let's create the VPC lattice network.
28. 创建 App Lattice Network
时间范围：14:10–14:39
总结 / Summary
中文
创建 app lattice network 服务网络（Service Network），关联 app-service，并把客户端 VPC 连同刚创建的关联安全组（Association Security Group）加入网络。
English
The app lattice network is created, associated with app-service, and joined to the client VPC using the newly created association security group.
Transcript
14:10 And let's give it say app lattice network.
14:16 Then which services we want to associate.
14:19 So we just have app service.
14:20 So let's attach that.
14:23 And we don't have any resources like you know RDS databases or anything.
14:27 So we will skip that.
14:29 And in the VPC association we are going to associate this with the client VPC.
14:34 And the security group is the one that we had just created right.
29. Auth NONE 与 Associations
时间范围：14:39–15:00
总结 / Summary
中文
服务网络认证类型（Auth Type）保持 NONE；创建完成后同时具备服务关联（Service Association）和客户端 VPC 关联（VPC Association）。
English
The service network keeps an auth type of NONE and is created with both a service association and a client VPC association.
Transcript
14:39 So that's done again the auth policies.
14:41 We are setting it as none.
14:44 And the rest of the settings I don't think so.
14:46 We need to change anything.
14:49 Okay.
14:50 So VPC lattice network has been created and has been associated both with the service as well as with
14:56 the client VPC.
14:57 And you can very well see that here right.
30. 检查 Association 状态
时间范围：15:00–15:20
总结 / Summary
中文
控制台显示服务关联（Service Association）、资源关联（Resource Association）、端点关联（Endpoint Association）和 VPC 关联（VPC Association）；等待异步关联完成。
English
The console exposes service, resource, endpoint, and VPC association views while the asynchronous associations finish provisioning.
Transcript
15:00 So there is a service association.
15:02 There is resource association.
15:03 There is endpoint association.
15:05 Then there is a VPC association.
15:08 So we should see this VPC right.
15:11 So it will take maybe a couple of minutes.
15:13 So I'm just pausing this video and I'll come back here.
15:16 Okay so lattice network and associations have been created.
31. 从 Client EC2 发起测试
时间范围：15:20–16:04
总结 / Summary
中文
架构基本完成后，登录客户端 EC2，通过 curl 使用 Lattice 服务的 AWS 托管域名（Managed DNS Name）测试连通性。
English
With most of the architecture complete, the instructor logs in to the client EC2 instance and uses curl against the Lattice service's AWS-managed DNS name.
Transcript
15:20 So if you see our architecture we have done most of it right.
15:25 What we haven't done is probably some security group rule for this EC2 instance.
15:30 But rest of the things are done.
15:32 So at this point, let's try to just log in to this client EC2 instance over SSH, and then try to access
15:38 the VPC lattice service using the VPC lattice DNS.
15:42 Let's see if it works.
15:44 So again grabbing the public IP of the client EC2 instance And just going to open the SSH session there.
15:56 And in order to access the VPC lattice service we can use curl command and say http colon slash slash
32. EC2 默认路径首次失败
时间范围：16:04–16:37
总结 / Summary
中文
从服务详情复制 AWS 托管端点（Managed Endpoint）；访问默认路径失败，说明服务路由存在但目标侧仍缺少允许流量的配置。
English
The AWS-managed endpoint is copied from the service details. A request to the default path fails, indicating that the routing exists but the target-side access configuration is incomplete.
Transcript
16:04 and the endpoint of the VPC lattice service.
16:06 And for that we can just go to the VPC lattice network or the service.
16:06 Rather we should go to the services and select the app service.
16:16 And here we should be able to see the end point of this service.
16:20 So right now we are just going to do that with the AWS provided DNS name which is this right.
16:27 And if I go back to the putty session, if I do this should it work or not.
16:34 So it doesn't work.
16:35 Can you think why?
33. Lambda Path 成功
时间范围：16:37–17:05
总结 / Summary
中文
访问 /lambda 成功，因为无服务器函数（Lambda Function）没有 EC2 安全组（Security Group）限制；故障范围由此缩小到 EC2 目标侧。
English
A request to /lambda succeeds because the Lambda function is not governed by an EC2 security group, narrowing the failure to the EC2 target side.
Transcript
16:37 And the problem is this particular security group of the EC2 instance.
16:42 Because by default the target group will send the traffic to this particular instance, but which also
16:48 means we should be able to at least access the Lambda service, right?
16:52 So let's try that first.
16:54 So now I'm just doing this slash lambda.
17:00 And it works.
17:00 Right.
17:01 Because there is no security group for the lambda function.
34. 补充 App EC2 Inbound Rule
时间范围：17:05–17:33
总结 / Summary
中文
打开应用 EC2 的目标安全组（Target Security Group），添加 HTTP 入站规则；来源应是 VPC Lattice 内部网络对应的托管地址范围。
English
The application EC2 target security group is opened and an HTTP inbound rule is added using the managed address range for VPC Lattice traffic.
Transcript
17:05 So let's go back to the EC2 instance and add that missing security group inbound rule.
17:11 Okay.
17:11 So let's go here for the app EC2 instance.
17:14 Let's go to the security.
17:16 And let's open this security group.
17:20 And in the inbound rule we should add HTTP traffic.
17:25 And do you know what should be the source Cidr range.
17:29 Now this is a range of VPC lattice internal network right.
35. 使用 IPv4 Managed Prefix List
时间范围：17:33–18:01
总结 / Summary
中文
安全组来源选择 VPC Lattice IPv4 托管前缀列表（Managed Prefix List），而不是 IPv6 条目。保存后，默认路径成功返回 Hello from EC2。
English
The VPC Lattice IPv4 managed prefix list—not the IPv6 entry—is selected as the security-group source. After saving, the default path returns Hello from EC2.
Transcript
17:33 And I told you for that we need to have the prefix list for the VPC lattice.
17:38 And do remember IPv4 prefix list because there are both IPv6 which is this.
17:44 But we need VPC lattice IPv4 prefix list which is this?
17:49 Right.
17:49 So let's save the rule.
17:51 And now let's go back to our client EC2 instance.
17:54 And now let's try to just remove this.
17:58 And you see hello from EC2.
36. Custom Domain 首次解析失败
时间范围：18:01–18:32
总结 / Summary
中文
客户端已经能访问 AWS 托管域名（Managed DNS Name），但 app.example.com 仍失败，因为私有托管区域（Private Hosted Zone）中尚未创建对应 DNS 记录。
English
The client can now reach the AWS-managed name, but app.example.com still fails because its DNS record has not yet been created in the private hosted zone.
Transcript
18:01 So traffic is going.
18:03 So that's really great.
18:04 That means we can access the VPC lattice service from the client.
18:09 And now just let's try one more thing that is curl http app dot example.com.
18:15 Should it work or not.
18:18 It doesn't because we had created the route 53 hosted zone, but we did not create corresponding records
18:25 in that hosted zone.
18:27 Now for that, we need to have our domain name that is provided by the AWS.
37. 创建 Route 53 CNAME
时间范围：18:32–19:09
总结 / Summary
中文
在 Route 53 中创建 app.example.com 的规范名称记录（CNAME Record），目标指向 Lattice 服务的 AWS 托管域名（Managed DNS Name）。
English
A Route 53 CNAME record is created for app.example.com and points to the Lattice service's AWS-managed DNS name.
Transcript
18:32 Which is this right.
18:34 And we need to create corresponding record in the route 53.
18:37 So let's create a record say app dot example.com.
18:43 And it should be pointing as a c name To our domain name of the lattice service.
18:55 Sorry.
18:55 I think it did not get copied properly, but it should be something like this, right?
19:01 So let's create the record.
19:04 And now if we go back to the client.
38. 等待 DNS 生效并 Reboot
时间范围：19:09–19:32
总结 / Summary
中文
记录创建后最初仍未解析；等待 DNS 传播（DNS Propagation），必要时重启客户端 EC2，使新的 DNS 设置生效。
English
Resolution still fails immediately after record creation, so the instructor waits for DNS propagation and reboots the client EC2 instance if needed.
Transcript
19:09 So let's try again.
19:11 And still it doesn't resolve.
19:13 So let's wait for maybe a second or so.
19:16 And sometimes you might have to just reboot your client EC2 instance so that new DNS settings takes
19:22 into effect.
19:23 Okay, so let me try to just reboot this instance and wait for maybe a minute or so.
19:29 Okay.
19:30 So let's just restart this particular session.
39. Custom Domain End-to-End Success
时间范围：19:32–20:00
总结 / Summary
中文
重启会话后，curl app.example.com 返回 EC2 响应，curl app.example.com/lambda 返回 Lambda 响应，确认自定义域名（Custom Domain Name）端到端工作。
English
After restarting the session, curl app.example.com returns the EC2 response and /lambda returns the Lambda response, confirming end-to-end custom-domain access.
Transcript
19:32 So let's say restart EC2 user.
19:37 And now let's try this again.
19:38 So curl HTTP app dot example.com.
19:44 And it works right.
19:45 And you can also test slash lambda.
19:50 And it is hello from the lambda.
19:52 So it is working with the custom domain name as well right.
19:56 So essentially we have done what we wanted to do.
40. Overlapping CIDR 验证
时间范围：20:00–20:30
总结 / Summary
中文
客户端 VPC 与应用 VPC 即使使用重叠的无类别域间路由（CIDR），仍能经 VPC Lattice 成功通信；这验证了该服务对地址重叠场景的支持。
English
The client and application VPCs communicate successfully through VPC Lattice despite overlapping CIDRs, validating support for overlapping address spaces.
Transcript
20:00 So we could successfully test the end to end connectivity using the client VPC and the app VPC.
20:07 Right.
20:07 And as I said we had the overlapping sides for the VPC as well.
20:12 And VPC lattice allows that right.
20:15 So we are done for this exercise.
20:17 Now before I let you go there is an additional thing that you can try.
20:22 Now if you just go or log in to an EC2 instance, then from there you cannot access the VPC lattice
20:29 service.
41. App VPC 也需 Association
时间范围：20:30–21:03
总结 / Summary
中文
应用 VPC 当前没有建立 VPC 关联（VPC Association），因此其中的 EC2 不能作为客户端访问服务。扩展练习是为应用 VPC 增加关联安全组（Association Security Group）和 VPC 关联，以实现服务间通信（Service-to-Service Communication）。
English
The application VPC is not associated with the service network, so its EC2 instance cannot consume the service. The suggested extension is to add an association security group and VPC association for service-to-service communication.
Transcript
20:30 That's because the app VPC is not associated with the service network using the VPC association.
20:37 And we had discussed that in the previous lecture.
20:39 So again the next step of this exercise if you want to do is to allow the inter services communication.
20:46 So from the app EC2 instance, you should be able to access the VPC lattice service.
20:51 And for that you would have to create that additional association.
20:54 So I'll leave it up to you if you want to implement and test that.
20:58 So I am talking about this green line here right which you need to create.
21:03 Okay.
42. Cleanup
时间范围：21:03–21:47
总结 / Summary
中文
清理顺序包括终止两台 EC2、删除 Lambda、删除服务关联（Service Association）和 VPC 关联（VPC Association）、删除 Lattice 服务与服务网络、删除目标组（Target Group）、VPC 和 Route 53 私有托管区域（Private Hosted Zone），以避免持续计费。
English
Cleanup includes terminating both EC2 instances; deleting Lambda; removing service and VPC associations; deleting the Lattice service, service network, target groups, VPCs, and Route 53 private hosted zone; and thereby avoiding ongoing charges.
Transcript
21:03 So that's it for this exercise.
21:05 Just last and most important thing clean up everything that you created.
21:09 So please terminate the EC2 instances that you created the lambda functions, the VPC lattice network
21:15 services, target groups.
21:16 And then finally the VPCs and the route 53 private hosted zone.
21:22 Otherwise there will be some charge for the VPC lattice usage.
21:26 So remember this.
21:28 Okay.
21:29 So that's it for this exercise.
21:31 So I hope it is now very clear how VPC lattice services work together.
21:35 So thanks for watching.
21:36 And with that now let's go towards some additional things about VPC lattice.
21:41 And then we will conclude this section.
21:43 So thanks for watching and stay tuned.
整讲总结 / Overall Summary
中文
本讲完成了一套 VPC Lattice 端到端实操。客户端虚拟私有云（Client VPC）和应用虚拟私有云（Application VPC）使用重叠的无类别域间路由（CIDR），应用侧同时提供弹性计算云（EC2）Web 目标与无服务器函数（Lambda）目标。配置过程依次创建私有托管区域（Private Hosted Zone）、目标组（Target Group）、Lattice 服务（Service）、监听器（Listener）、路径规则（Path Rule）、服务网络（Service Network）、服务关联（Service Association）和 VPC 关联（VPC Association）。客户端关联安全组（Association Security Group）允许客户端网段访问 HTTP；EC2 目标安全组（Target Security Group）则使用 VPC Lattice 托管前缀列表（Managed Prefix List）作为来源。测试先用 AWS 托管域名（Managed DNS Name）验证 Lambda 路径，再修复 EC2 入站规则，最后以 Route 53 CNAME 将 app.example.com 指向服务域名并验证两类目标。实验同时证明 VPC Lattice 支持重叠网段，并强调只有与服务网络建立 VPC 关联的 VPC 才能作为服务消费者。
English
This lecture builds an end-to-end VPC Lattice exercise. The client and application VPCs deliberately use overlapping CIDRs, while the application side exposes both an EC2 web target and a Lambda target. The workflow creates a private hosted zone, target groups, a Lattice service, listener, path rule, service network, service association, and VPC association. The association security group permits HTTP from the client CIDR, while the EC2 target security group uses the VPC Lattice managed prefix list as its source. Testing first uses the AWS-managed service name to validate the Lambda path, then fixes the EC2 inbound rule, and finally maps app.example.com to the service through a Route 53 CNAME and verifies both targets. The exercise also demonstrates support for overlapping CIDRs and reinforces that a VPC must be associated with the service network before it can consume the service.
返回顶部 ↑