Day-2_AWS_Assignment
(EC2 Security Groups, VPC and Subnets)
What are AWS security groups?
AWS Security Groups are virtual firewalls that help secure Amazon EC2 resources by controlling incoming and outgoing traffic. Inbound rules control the flow of traffic to and from the instance, while outbound rules control the flow of traffic from the instance.
Security groups are stateful firewalls.
What is VPC?
With Amazon Virtual Private Cloud (Amazon VPC), you can launch AWS resources in a logically isolated virtual network that you've defined. This virtual network closely resembles a traditional network that you'd operate in your own data center, with the benefits of using the scalable infrastructure of AWS.
What is meant by subnet?
A Subnet is a segmented part of an Amazon VPC's IP address range. Each subnet resides in a specific Availability Zone and acts as a logical network segment for resources.
How can you convert a public subnet to a private subnet?
1. Confirm there is already an IGW (Internet Gateway) attached to the VPC. This should be the case since you already have the public subnet.
2. Update the route table applied to the subnet (AWS Management Console -> VPC -> Route Tables) to include a route to 0.0.0.0/0 -> IGW.
3. Assign public IP addresses to your resources.
What is the difference between security groups and network access control lists?
A security group is associated with an EC2 instance, whereas a network ACL is associated with a subnet. You can modify the rules for a security group at any time; you can't modify the rules for a network ACL until you disassociate it from the subnet. Security groups are stateful; network ACLs are stateless.
Security groups control inbound and outbound traffic for your EC2 instances. Network ACLs control inbound and outbound traffic for your subnets.
By default how many IP addresses does AWS reserve in a subnet?
Amazon reserves the first four (4) IP addresses and the last one (1) IP addresses of every subnet for IP networking purposes.
(10.0.0.0),(10.0.0.1),(10.0.0.2),(10.0.0.3) and (10.0.3.255)
What are route tables? What is the difference between Private Route and Public Route tables?
AWS Route Tables are used to control the routing of network traffic within a Virtual Private Cloud (VPC). They contain a set of rules called routes that specify which network traffic is directed to which network interface. Each subnet in a VPC must be associated with a route table, which controls the traffic for that subnet.
A public subnet is a subnet that is associated with a route table that has a route to an Internet gateway. This connects the VPC to the Internet and other AWS services. A private subnet is a subnet that is associated with a route table that doesn't have a route to an internet gateway.
What are VPC flow logs?
VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to Amazon CloudWatch Logs and Amazon S3. After you've created a flow log, you can retrieve and view its data in the chosen destination.
What is VPC peering?
A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses. Instances in either VPC can communicate with each other as if they are within the same network.
Create a NAT Gateway, attach it to a private subnet and run an apt update to check it works. Identify the difference between IGW and NAT Gateway
Internet Gateway
Internet Gateway (IGW) is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet.
Internet Gateway enables resources (like EC2 instances) in public subnets to connect to the internet. Similarly, resources on the internet can initiate a connection to resources in your subnet using the public.
If a VPC does not have an Internet Gateway, then the resources in the VPC cannot be accessed from the Internet (unless the traffic flows via a Corporate Network and VPN/Direct Connect).
Internet Gateway supports IPv4 and IPv6 traffic.
NAT Gateway
NAT Gateway (NGW) is a managed Network Address Translation (NAT) service.
NAT Gateway does something similar to Internet Gateway (IGW), but it only works one way: Instances in a private subnet can connect to services outside your VPC but external services cannot initiate a connection with those instances.
NAT gateways are supported for IPv4 or IPv6 traffic.