Lecture 161: VPC lattice common architectures
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：04:12
- 来源：Udemy Lecture 48015683
- Slide 数量：12
- 画面切换：00:39、00:52、01:07、01:17、01:34、01:52、02:22、02:44、03:21、03:33、03:48
扫描说明
逐条读取了 Udemy 页面中的 69 条英文 Transcript cue，并按时间轴扫描全长约 04:12 的视频。按每 4 条 cue 截取 18 个候选画面，通过联系表确认无 Transcript 侧栏、无播放器控件、无错误弹窗、无黑边和无右侧或下方裁切；再移除 6 个标题重复、过渡停留或没有新增信息的帧，最终保留 12 个独立架构或有意义的流量路径揭示。所有图片均从 video 元素计算真实 16:9 媒体区域，并统一输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 四类 Common Architecture 概览
时间范围：00:00–00:39
总结 / Summary
中文
本讲用四种真实世界模式帮助识别考试中的 VPC Lattice 使用场景：VPC 间通信、本地访问 AWS、AWS 访问本地目标，以及互联网访问。
English
The lecture uses four real-world patterns to help identify exam scenarios: VPC-to-VPC communication, on-premises access to AWS, AWS access to on-premises targets, and internet access.
Transcript
00:00 Okay.
00:00 So in this lecture let's see some of the common VPC lattice architecture that you will see in the real
00:07 world.
00:07 And these architectures might give you good understanding when the problem is given to you around the
00:13 VPC lattice usage in your exam.
00:16 Right.
00:17 So there are typically four architecture that we are going to talk about.
00:20 And we have already talked about that in the previous lecture.
00:23 So it should be very easy for you to understand right.
00:27 So very first and a common architecture is to allow the connectivity between different VPCs.
00:33 And we have already done the exercise around this.
00:35 So nothing very special about this architecture as you can see here.
2. Pattern 1：VPC Lattice 位于服务之间
时间范围：00:39–00:52
总结 / Summary
中文
服务网络（Service Network）位于多个 VPC 和服务之间；图中的绿色箭头表示 VPC 关联（VPC Association）。
English
The service network sits between multiple VPCs and services, while green arrows represent VPC associations.
Transcript
00:39 VPC lattice is in the middle.
00:41 And then you connect your VPCs services with the VPC lattice network.
00:46 Now important thing here to look at these arrows.
00:49 So the green arrow represents the VPC association.
3. 双向 VPC Associations
时间范围：00:52–01:07
总结 / Summary
中文
两个 VPC 都建立 VPC 关联（VPC Association）后，各自的客户端和服务都可以访问服务网络中的 Lattice 服务。
English
When both VPCs have VPC associations, clients and services in either VPC can consume the Lattice services in the service network.
Transcript
00:52 So the client in that VPC can access the services.
00:55 And here as you can see both VPCs are connected using this VPC association.
01:00 That means all services and client can access the VPC lattice network and the services.
01:06 Right.
4. Application-to-Application Pattern
时间范围：01:07–01:17
总结 / Summary
中文
这种应用间连接（Application-to-Application Connectivity）是最常见的 VPC Lattice 架构，适合在不直接建立 VPC Peering 的情况下共享服务。
English
This application-to-application connectivity pattern is the most common VPC Lattice architecture and avoids direct VPC peering between consumers and providers.
Transcript
01:07 So a very common architecture that you will see.
01:09 And if you want to read more about this architecture then you can visit this AWS blog.
01:15 Right.
01:16 Now the next architecture.
5. Pattern 2：On-Premises 访问 AWS Service
时间范围：01:17–01:34
总结 / Summary
中文
从本地网络（On-Premises Network）访问 AWS 中的 Lattice 服务时，需要在入口 VPC（Ingress VPC）中创建服务网络 VPC 端点（Service Network VPC Endpoint）。
English
To access an AWS-hosted Lattice service from an on-premises network, create a service-network VPC endpoint in an ingress VPC.
Transcript
01:17 If you want to access VPC lattice services from your on premises network.
01:23 And if you remember, we said that if you want to access VPC lattice from outside the VPC, you have
01:29 to use VPC endpoint for the VPC lattice service network.
01:32 So if you see this is my ingress VPC.
6. VPN、Direct Connect 或 Transit Gateway
时间范围：01:34–01:52
总结 / Summary
中文
入口 VPC 可通过站点到站点虚拟专用网络（Site-to-Site VPN）、专线连接（Direct Connect）或中转网关（Transit Gateway）连接本地；关键是本地必须能路由到端点的私有 IP（Private IP）。
English
The ingress VPC can connect to on premises through Site-to-Site VPN, Direct Connect, or Transit Gateway. The essential requirement is routability to the endpoint's private IP.
Transcript
01:34 And in that there is this VPC endpoint.
01:38 And this VPC is connected with the on premises network using over say IPsec VPN or Direct Connect or
01:44 say Transit Gateway.
01:46 The point is, you should be able to access the private IP of this VPC endpoint from your on premises
7. 从 Endpoint 进入 Lattice Service
时间范围：01:52–02:22
总结 / Summary
中文
只要本地网络可以到达 VPC Endpoint 的私有 IP，流量就能进入服务网络（Service Network）并访问 AWS 中的 Lattice 服务；随后引出本地应用作为目标的反向场景。
English
Once the on-premises network can reach the VPC endpoint's private IP, traffic can enter the service network and consume AWS-hosted Lattice services. The lecture then introduces the reverse scenario with on-premises targets.
Transcript
01:52 network.
01:53 And if that connectivity is there, then you can access the VPC lattice services.
01:57 So this is another architecture that you will see right.
02:02 So in this architecture our services are hosted in AWS and we are accessing it from on premises.
02:08 But what if we want to use VPC lattice.
02:11 But the targets are there in the on premises network.
02:14 And you know that VPC Lattice Services supports IP address as a target.
02:19 And that IP can be from your on premises application.
8. Pattern 3：On-Premises IP Target
时间范围：02:22–02:44
总结 / Summary
中文
VPC Lattice 支持 IP Address 目标，因此服务可以把本地数据中心应用的 IP 或 DNS 作为目标；承载目标的 VPC 仍需通过 VPN、Direct Connect 或 Transit Gateway 到达本地。
English
VPC Lattice supports IP-address targets, so a service can point to an on-premises application's IP or DNS name. The target-side VPC still needs VPN, Direct Connect, or Transit Gateway connectivity to the data center.
Transcript
02:22 So in that case the architecture will be something like this.
02:26 Now here in this VPC we are saying that VPC lattice has the target and the target IP or DNS is there
02:35 in the on premises data center.
02:37 And there is a connectivity between your this VPC and the data center again over a VPN or a direct connect
9. 用 NLB/ALB 连接 On-Premises Targets
时间范围：02:44–03:21
总结 / Summary
中文
若需要负载均衡，可让网络负载均衡器（NLB）或应用负载均衡器（ALB）作为 Lattice 目标，再由负载均衡器把流量转发到本地 IP Target。
English
For load balancing, an NLB or ALB can act as the Lattice target and then forward traffic to on-premises IP targets.
Transcript
02:44 or a transit gateway.
02:45 Now another way to do that is you can also have your VPC lattice service behind NLB or Alb.
02:53 And for NLB and Alb the target can be the IP address.
02:57 So if you want to load balance the application then you can also use this NLB or Alb here.
03:03 So this is the other way around where your target is sitting in the on premises network right?
03:09 So I hope it is clear.
03:12 Then the final architecture is when you want to access the VPC lattice services from the internet right
03:19 now for that as well.
10. Pattern 4：Internet Access 的入口
时间范围：03:21–03:33
总结 / Summary
中文
从互联网访问 VPC Lattice 时，仍先创建服务网络 VPC 端点（Service Network VPC Endpoint），然后需要一个面向公网的入口暴露该私有端点。
English
Internet access still begins with a service-network VPC endpoint, after which a public-facing entry point must expose that private endpoint.
Transcript
03:21 Again, first thing you need to create the VPC endpoint for the lattice network.
03:25 And now you have to expose this endpoint to the internet.
03:29 And how do you do that.
03:30 So you would have to bring in some publicly facing entity.
11. Public ALB/NLB 指向 Endpoint IP
时间范围：03:33–03:48
总结 / Summary
中文
公有子网（Public Subnet）中的 NLB 或 ALB 经互联网网关（Internet Gateway）接收流量，并把 VPC Endpoint 的 IP Address 配置为目标。
English
An NLB or ALB in public subnets receives traffic through an internet gateway and uses the VPC endpoint IP addresses as its targets.
Transcript
03:33 And that could be your network load balancer or the application load balancer which are sitting in the
03:38 public network.
03:40 Then through the internet gateway, the traffic will go to the load balancer and the target will be
03:45 the IP address of this VPC endpoint.
12. Internet-to-Lattice 完整流量路径
时间范围：03:48–04:12
总结 / Summary
中文
完整路径是 Internet Client → Internet Gateway → Public Load Balancer → Service Network VPC Endpoint → VPC Lattice Service → Target；它把托管服务网络安全地暴露给外部访问者。
English
The complete path is Internet client, internet gateway, public load balancer, service-network VPC endpoint, VPC Lattice service, and target. This pattern exposes the managed service network to external consumers.
Transcript
03:48 Right.
03:49 And this is how you expose your VPC lattice services to the outside network.
03:55 Okay.
03:56 So these are the very common architecture that you will see with VPC lattice.
03:59 And I hope it is clear.
04:02 So with that we will stop here.
04:04 And in the next lecture we will just quickly summarize VPC lattice service.
04:08 So thanks for watching.
04:09 And let's go to the next lecture.
整讲总结 / Overall Summary
中文
本讲总结四种常见 VPC Lattice 架构。第一种通过服务网络（Service Network）连接多个虚拟私有云（VPC），绿色 VPC 关联（VPC Association）表示其中的客户端可以消费网络中的服务。第二种让本地网络（On-Premises Network）访问 AWS 内的 Lattice 服务：在入口 VPC（Ingress VPC）中创建服务网络 VPC 端点（Service Network VPC Endpoint），再用站点到站点虚拟专用网络（Site-to-Site VPN）、专线连接（Direct Connect）或中转网关（Transit Gateway）提供到端点私有 IP 的可达性。第三种把本地应用作为目标：Lattice 可直接使用本地 IP Address，或先通过网络负载均衡器（NLB）/应用负载均衡器（ALB）进行负载均衡。第四种从互联网访问 Lattice：公有 NLB/ALB 接收经互联网网关（Internet Gateway）的流量，并把 VPC Endpoint 的 IP 作为目标。四种模式的核心都是明确消费者入口、服务网络关联与目标可达路径。
English
This lecture presents four common VPC Lattice architectures. First, a service network connects multiple VPCs, and a VPC association allows clients in an associated VPC to consume the network's services. Second, an on-premises network reaches Lattice services in AWS by using a service-network VPC endpoint in an ingress VPC, with Site-to-Site VPN, Direct Connect, or Transit Gateway connectivity to the endpoint's private IP. Third, an on-premises application becomes a target: Lattice can use its IP address directly or reach it through an NLB or ALB for load balancing. Fourth, internet clients reach Lattice through a public NLB or ALB whose target is the VPC endpoint IP. Across all four patterns, the key is to identify the consumer entry point, service-network associations, and the reachable path to the target.
返回顶部 ↑