Amazon Virtual Private Cloud (Amazon VPC) lets you provision a logically isolated section of the AWS cloud where you can launch AWS resources in a virtual network that you define. In this talk, we discuss advanced tasks in Amazon VPC, including the implementation of VPC peering, the creation of multiple network zones, the establishment of private connections, and the use of multiple routing tables. We also provide information for current EC2-Classic network customers and help you prepare to adopt Amazon VPC.

1. November 14, 2014 | Las Vegas, NV
Kevin Miller, Sr. Manager, AWS EC2 Networking

4. EC2-Classic
Simple to get started – all instances have Internet connectivity, auto-assigned private and public IP addresses
Inbound security groups
Default VPC
The best of both
Get started using the EC2-Classic experience
If and when needed, begin using any VPC feature you require
VPC
Advanced virtual networking services:
ENIs and multiple IPs
routing tables
egress security groups
network ACLs
private connectivity
Enhanced Networking
And more to come...

5. EC2-Classic
Simple to get started – all instances have Internet connectivity, auto-assigned private and public IP addresses
Inbound security groups
Default VPC
The best of both
Get started using the EC2-Classic experience
If and when needed, begin using any VPC feature you require
VPC
Advanced virtual networking services:
ENIs and multiple IPs
routing tables
egress security groups
network ACLs
private connectivity
Enhanced Networking
And more to come...
All accounts created after 12/4/2013 support VPC only and have a default VPC in each region

6. describe-account-attributes
VPC only

8. Corporate Data Center

9. Corporate Data Center
aws ec2 create-vpc --cidr 10.10.0.0/16
aws ec2 create-subnet --vpc vpc-c15180a4 --cidr 10.10.1.0/24 --a us-west-2a
aws ec2 create-subnet --vpc vpc-c15180a4 --cidr 10.10.2.0/24 --a us-west-2b

10. Corporate Data Center
aws ec2 create-vpn-gateway --type ipsec.1
aws ec2 attach-vpn-gateway --vpn vgw-f9da06e7 --vpc vpc-c15180a4
aws ec2 create-customer-gateway --type ipsec.1 --public 54.64.1.2 --bgp 6500
aws ec2 create-vpn-connection --vpn vgw-f9da06e7 --cust cgw-f4d905ea --t ipsec.1

11. Corporate Data Center
aws ec2 run-instances --image ami-d636bde6 --sub subnet-d83d91bd --count 3
aws ec2 run-instances --image ami-d636bde6 --sub subnet-b734f6c0 --count 3

12. Corporate Data Center
aws directconnect create-connection --loc EqSE2 --b 1Gbps --conn My_First
aws directconnect create-private-virtual-interface --conn dxcon-fgp13h2s --new
virtualInterfaceName=Foo, vlan=10, asn=60, authKey=testing,
amazonAddress=192.168.0.1/24, customerAddress=192.168.0.2/24,
virtualGatewayId=vgw-f9da06e7

13. Corporate Data Center
192.168.0.0/16
aws ec2 create-route --ro rtb-ef36e58a --dest 0.0.0.0/0 --gateway-id vgw-f9da06e7
Each VPC has a single
routing table at creation time,
used by all subnets

14. corporate data center
Availability Zone
Availability Zone
Each VPN connection consists of 2 IPSectunnels. Use BGP for failure recovery.

15. corporate data center
Availability Zone
Availability Zone
A pair of VPN connections (4 IPSectunnels total) protects against failure of your customer gateway.

16. Corporate Data Center
Availability Zone
Availability Zone
Redundant AWS Direct Connect connections with VPN backup

17. Corporate Data Center
192.168.0.0/16
aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway --internet igw-5a1ae13f --vpc vpc-c15180a4
aws ec2 delete-route --ro rtb-ef36e58a --dest 0.0.0.0/0
aws ec2 create-route --ro rtb-ef36e58a --dest 0.0.0.0/0 --gateway-id igw-5a1ae13f
aws ec2 create-route --ro rtb-ef36e58a --dest 192.168.0.0/16 --gateway-id vgw-f9da06e7

18. Corporate Data Center
192.168.0.0/16
aws ec2 delete-route --ro rtb-ef36e58a --dest 192.168.0.0/16
aws ec2 enable-vgw-route-propagation --ro rtb-ef36e58a --gateway-id vgw-f9da06e7
Used to automatically update
routing table(s) with routes
present in the VGW

19. Corporate
192.168.0.0/16
aws ec2 create-subnet --vpc vpc-c15180a4 --cidr 10.10.3.0/24 --a us-west-2b
aws ec2 create-route-table --vpc vpc-c15180a4
aws ec2 associate-route-table --ro rtb-fc61b299 --subnet subnet-60975a17
aws ec2 create-route --ro rtb-ef36e58a --dest 0.0.0.0/0 --gateway-id igw-5a1ae13f
Subnet with connectivity only
to other instances and the
Internet via the IGW

20. # VPC A
aws ec2 modify-network-interface-attribute --net eni-f832afcc --no-source-dest-check
aws ec2 create-route --ro rtb-ef36e58a --dest 10.20.0.0/16 --instance-id i-f832afcc
# VPC B
aws ec2 modify-network-interface-attribute --net eni-9c1b693a --no-source-dest-check
aws ec2 create-route --ro rtb-67a2b31c --dest 10.10.0.0/16 –-instance-id i-9c1b693a

21. Software VPN
between these
instances

22. Enabling communication
between instances in these
subnets; adding routes to the
default routing table

23. Routing all traffic from subnets
to the Internet via a firewall is
conceptually similar
# Default routing table directs traffic to the NAT/firewall instance
aws ec2 create-route --ro rtb-ef36e58a --dest 0.0.0.0/0 --instance-id i-f832afcc
# Routing table for 10.10.3.0/24 directs to the Internet
aws ec2 create-route --ro rtb-67a2b31c --dest 0.0.0.0/0 --gateway-id igw-5a1ae13f

25. aws ec2 create-vpc-peering-connection --vpc-id vpc-c15180a4 --peer-vpc vpc-062dfc63
aws ec2 accept-vpc-peering-connection --vpc-peer pcx-ee56be87
VPC A> aws ec2 create-route --ro rtb-ef36e58a --des 10.20.0.0/16 --vpc-peer pcx-ee56be87
VPC B> aws ec2 create-route --ro rtb-67a2b31c --des 10.10.0.0/16 --vpc-peer pcx-ee56be87
VPC A - 10.10.0.0/16
vpc-c15180a4
VPC B - 10.20.0.0/16
vpc-062dfc63

26. aws ec2 create-vpc-peering-connection --vpc-id vpc-c15180a4 --peer-vpc vpc-062dfc63
--peer-owner 472752909333
# In owner account 472752909333
aws ec2 accept-vpc-peering-connection --vpc-peer pcx-ee56be87
VPC A - 10.10.0.0/16
vpc-c15180a4
VPC B - 10.20.0.0/16
vpc-062dfc63
Account ID 472752909333

30. VPC A - 10.10.0.0/16 VPC B - 10.20.0.0/16
# Default routing table directs Peer traffic to the NAT/firewall instance
aws ec2 create-route --ro rtb-ef36e58a --dest 10.20.0.0/16 --instance-id i-f832afcc
# Routing table for 10.10.3.0/24 directs to the Peering
aws ec2 create-route --ro rtb-67a2b31c --dest 10.20.0.0/16 --vpc-peer pcx-ee56be87

36. Classic environment: 2 security groups, a load balancer,
and instances.
ELB

37. ELB

38. ELB
AMI
EBS
Snapshot

39. ELB
AMI
EBS
Snapshot

40. AMI
EBS
Snapshot

41. Pros
Cons
One time move
Requires(longer) maintenance window
Easy back-out plan
Testup-front
Easier for smaller deployments
Harderfor larger deployments
You can dry-run this whole sequence without turning off the Classic instances

43. ELB

46. Pros
Cons
Shorter,per-component maintenancewindows
Requires maintenance windows
Per component back-out plans
Takes longer to complete migration
Easier for larger deployments
Per component integration (EIPs/ElasticLoad Balancing, CIDR-based security group rules)

49. RDS DB
Instance
Amazon
Route 53
ELB

50. RDS DB
Instance
ELB
Amazon
Route 53

51. RDS DB
Instance
ELB
Amazon
Route 53

52. RDS DB
Instance
ELB
Amazon
Route 53

53. RDS DB
Instance
ELB
Amazon
Route 53

54. Amazon
Route 53
RDS DB
Instance

55. Amazon
Route 53
RDS DB
Instance

56. Pros
Cons
(Potentially) No maintenancewindow
Additional complexity during migration
Directprivate IP connectivity and security group integration
Still need toreplace EC2-Classic instances with new VPC instances
Designedfor the largest deployments

57. EC2-Classic
ClassicLink
RDS DB
Instance
ElastiCache
Cache Node
Elastic Load
Balancing
RDS DB
Instance
ElastiCache
Cache Node
Elastic Load
Balancing

60. vpc-4325f426
To use ClassicLink, the VPC must have this feature enabled. Can be restricted with IAM policy.

61. i-2b3ecd1c
vpc-4325f426 sg-da107fbf
Link this specific instance to the VPC using the specified VPC security groups.

62. i-2b3ecd1c
vpc-4325f426 sg-da107fbf
Link required after Run (new instance launch) or Start (stopped instance)

64. http://bit.ly/awsevals