AWS Certified Advanced Networking Official Study Guide: Specialty Exam

By Sidhartha Chauhan, Alan Halachmi, James Devine and 4 more

The official study guide for the AWS certification specialty exam

The AWS Certified Advanced Networking Official Study Guide – Specialty Exam helps to ensure your preparation for the AWS Certified Advanced Networking – Specialty Exam. Expert review of AWS fundamentals align with the exam objectives, and detailed explanations of key exam topics merge with real-world scenarios to help you build the robust knowledge base you need to succeed on the exam—and in the field as an AWS Certified Networking specialist. Coverage includes the design, implementation, and deployment of cloud-based solutions; core AWS services implementation and knowledge of architectural best practices; AWS service architecture design and maintenance; networking automation; and more. You also get one year of free access to Sybex’s online interactive learning environment and study tools, which features flashcards, a glossary, chapter tests, practice exams, and a test bank to help you track your progress and gauge your readiness as exam day grows near.

The AWS credential validates your skills surrounding AWS and hybrid IT network architectures at scale. The exam assumes existing competency with advanced networking tasks, and assesses your ability to apply deep technical knowledge to the design and implementation of AWS services. This book provides comprehensive review and extensive opportunities for practice, so you can polish your skills and approach exam day with confidence.

• Study key exam essentials with expert insight
• Understand how AWS skills translate to real-world solutions
• Test your knowledge with challenging review questions

• Access online study tools, chapter tests, practice exams, and more

Technical expertise in cloud computing, using AWS, is in high demand, and the AWS certification shows employers that you have the knowledge and skills needed to deliver practical, forward-looking cloud-based solutions. The AWS Certified Advanced Networking Official Study Guide – Specialty Exam helps you learn what you need to take this next big step for your career.

• Language: English
• Publisher: Wiley
• Release date: Feb 13, 2018
• ISBN: 9781119439905

Book preview

Chapter 1

Introduction to Advanced Networking

THE AWS CERTIFIED ADVANCED NETWORKING – SPECIALTY EXAM OBJECTIVES COVERED IN THIS CHAPTER MAY INCLUDE, BUT ARE NOT LIMITED TO, THE FOLLOWING:

Domain 1.0: Design and implement hybrid IT network architectures at scale

1.4 Evaluate design alternatives that leverage AWS Direct Connect

Domain 2.0: Design and Implement AWS Networks

2.1 Advanced knowledge of AWS networking concepts

Domain 4.0: Configure network integration with application services

4.1 Leverage the capabilities of Route 53

4.4 Given a scenario, determine an appropriate load balancing strategy within the AWS ecosystem

4.5 Determine a content distribution strategy to optimize for performance

Domain 5.0: Design and implement for security and compliance

5.3 Evaluate AWS security features for managing network traffic

Networks are foundational in our connected world. They are simultaneously critical to our everyday lives and frequently overlooked. Although network infrastructures, like the Internet, are likely the most distributed systems on Earth, they are not noticed unless they are operating poorly. This contrast makes networks quite interesting, both to learn about and to work with.

In addition to its distributed characteristics, modern networks are also a combination of new and old. The Internet Protocol (IP) and Transmission Control Protocol (TCP) were created in the 1970s, and though they have been updated over time, they still run the Internet. Meanwhile, new innovations, including advanced encapsulations, automation, and improved security mechanisms, continue to push the capabilities of the network forward. AWS has driven innovation in cloud networking with capabilities like Amazon Virtual Private Cloud (Amazon VPC), which provides customers with their own logical segment of the Amazon network—on demand and in minutes.

This study guide covers the breadth and depth of AWS networking in scope for the AWS Certified Advanced Networking – Specialty exam. The study guide reviews a broad array of topics relevant to the Amazon global infrastructure, various regional AWS networking features, on-premises hybrid networking, and AWS edge networking. The study guide’s contents assume that you have a strong understanding of networking concepts and that you have successfully completed the AWS Certified Solutions Architect – Associate exam.

AWS Global Infrastructure

AWS operates a global infrastructure. This network is operated by one company, Amazon, and it spans the continents where AWS has a presence. This infrastructure enables traffic to flow between AWS Regions, Availability Zones, edge locations, and customer cross-connect facilities. Traffic between nodes on this network uses the AWS global infrastructure, with the exception of AWS GovCloud (US) and China. A representation of the global infrastructure is shown in Figure 1.1.

World map shows the AWS global infrastructure which includes interconnected nodes representing the availability zones within geographic regions around the world.

FIGURE 1.1 AWS global infrastructure

Regions

A region is a geographic area in the world where AWS operates cloud services (for example, Amazon Elastic Compute Cloud, also known as Amazon EC2).

AWS Regions are designed to be completely independent from other regions. This approach provides fault isolation, fault tolerance, and stability.

Most AWS Cloud services operate within a region. Since these regions are separated, you only see the resources tied to the region that you have specified. This design also means that customer content that you put into a region stays in that region unless you take an explicit action to move it.

Availability Zones

Each region is composed of two or more Availability Zones. Each Availability Zone contains one or more data centers. The zones are engineered such that they have different risk profiles. That is, AWS considers factors like power distribution, floodplains, and tectonics when placing Availability Zones within a region. The zones are connected to one another by low-latency, high-bandwidth fiber optics. Availability Zones are typically less than 2 milliseconds apart.

Amazon operates state-of-the-art, highly-available data centers. Although rare, failures can occur that affect the availability of resources that are in the same location. If you host all of your Amazon EC2 instances in a single location that is affected by such a failure, for example, none of your instances would be available. When you launch an Amazon EC2 instance, you can select an Availability Zone or let AWS choose one for you. If you distribute your instances across multiple Availability Zones and then one instance fails, you can design your application so that an instance in another zone can handle requests.

Edge Locations

To deliver content to end users with low latency, AWS provides a global network of edge locations. This content distribution network is called Amazon CloudFront. As end users make requests, the AWS Domain Name System (DNS), Amazon Route 53, routes requests to the Amazon CloudFront edge location that can best serve the user’s request, typically the nearest edge location in terms of latency.

In the edge location, Amazon CloudFront checks its cache for the requested content. If the data is locally cached, Amazon CloudFront returns the content to the user. If the data is not in the cache, Amazon CloudFront forwards the request for the files to the applicable origin server for the corresponding file type. The origin servers then send the files back to the Amazon CloudFront edge location.

Amazon Virtual Private Cloud

Amazon Virtual Private Cloud (Amazon VPC) lets you provision a logically-isolated section of the AWS Cloud. You can launch AWS resources like Amazon EC2 instances in a virtual network that you define. You have complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways. You can use both IPv4 and IPv6 in your Amazon VPC for secure and easy access to resources and applications.

VPC Mechanics

Amazon VPC enables you to launch resources into a logical network that you define. This network closely resembles the traditional networks that you operate in your own data centers, with the additional scalability and capability benefits of AWS. Amazon VPC uses many traditional concepts, like subnets, IP addresses, and stateful firewalls.

The underlying Amazon VPC mechanics differ, however, from the composition of standard, on-premises networking infrastructures. AWS built a custom network environment that satisfies the scale, performance, flexibility, and security requirements of the millions of active customers who use AWS each day. Consider that each customer has their own isolated network, and many customers are making thousands of changes per day. While the technology underlying Amazon VPC is not within the scope of the exam, understanding how it works will help you reason about its operation and functionality.

The Amazon VPC infrastructure is composed of various support components (such as the Amazon DNS server, instance metadata, and the Dynamic Host Configuration Protocol [DHCP] server) and the underlying physical servers onto which customers launch their Amazon EC2 instances. Each of these physical servers has its own IP address. As customers launch Amazon EC2 instances into their VPCs, AWS determines the physical server on which the instance will run. This decision is based on multiple factors, including the desired Availability Zone, instance type, instance tenancy, and whether the instance is part of a placement group. When different AWS accounts launch instances using Amazon VPC, these instances are not visible to each other.

Tenant isolation is a core function of Amazon VPC. In order to understand which resources are part of a given VPC, Amazon VPC uses a mapping service. The mapping service abstracts your VPC from the underlying AWS infrastructure. For any given VPC, the mapping service maintains information about all of its resources, their VPC IP addresses, and the IP addresses of the underlying physical server on which the resource is running. It is the definitive source of topology information for each VPC.

When an Amazon EC2 instance, say Instance A, in your VPC initiates communication with another Amazon EC2 instance, say Instance B, over IPv4, Instance A will broadcast an Address Resolution Protocol (ARP) packet to obtain the Instance B’s Media Access Control (MAC) address. The ARP packet leaving Instance A is intercepted by the server Hypervisor. The Hypervisor queries the mapping service to identify whether Instance B exists in the VPC and, if so, obtains its MAC address. The Hypervisor returns a synthetic ARP response to Instance A containing Instance B’s MAC address.

Instance A is now ready to send an IP packet to Instance B. The IP packet has Instance A’s source IP and Instance B’s destination IP. The IP packet is encapsulated in an Ethernet header with Instance A’s MAC as the source address and Instance B’s MAC as the destination address. The Ethernet packet is then transmitted from Instance A’s network interface.

As Instance A emits the packet, it is intercepted by the server Hypervisor. The Hypervisor queries the mapping service to learn the IPv4 address of the physical server on which Instance B is running. Once the mapping service provides this data, the packet emitted by Instance A is encapsulated in a VPC header that identifies this specific VPC and then encapsulated again in an IP packet with a source IP address of Instance A’s physical server and a destination IPv4 address of Instance B’s physical server. The packet is then placed on to the AWS network.

When the packet arrives at Instance B’s physical server, the outer IPv4 header and VPC header are inspected. The instance Hypervisor queries the mapping service to confirm that Instance A exists on the specific source physical server and in the specific VPC identified in the received packet. When the mapping service confirms that the mapping is correct, the Hypervisor strips off the outer encapsulation and delivers the packet that Instance A emitted to the Instance B network interface.

The details of packet exchange in Amazon VPC should provide you clarity on why, for example, Amazon VPC does not support broadcast and multicast. These same reasons explain why packet sniffing does not work. As you reason about Amazon VPC operation and functionality, consider this example.

Services Outside Your VPC

Many AWS Cloud services are provided from locations outside of your own VPC. These services are delivered from the following:

Edge locations (for example, Amazon Route 53 and Amazon CloudFront)

Directly inside your VPC (for example, Amazon Relational Database Service [Amazon RDS] and Amazon Workspaces)

VPC Endpoints in your VPC (for example, Amazon DynamoDB and Amazon Simple Storage Service [Amazon S3])

Public service endpoints outside your VPC (for example, Amazon S3 and Amazon Simple Queue Service [Amazon SQS])

AWS Cloud services use the same global infrastructure described earlier in this chapter. When you use services that are delivered directly on the Internet, such as edge locations and public service endpoints, you control network behaviors using service-specific mechanisms like policies and whitelists. When you use services that are exposed directly to your VPC, typically through a network interface or a VPC endpoint in your VPC, you may also use Amazon VPC features like security groups, network Access Control Lists (ACLs), and route tables in addition to service-specific mechanisms.

For the exam, you should understand how AWS Cloud services integrate into your overall network architecture and allow you to control network behavior. You do not need to understand the specific mechanisms that AWS uses to deliver services. However, understanding these delivery models will aid you in the development of scalable, performant, and highly-available architectures.

An overview of service locations can be seen in Figure 1.2.

Diagram shows AWS region connected to Amazon CloudFront edge location, direct connect location, and other AWS regions via Amazon global backbone. AWS region includes VPC, Amazon S3, SNS, AppStream, and Dynamo DB. VPC includes VPC subnets placed in different availability zones.

FIGURE 1.2 Overview of the AWS service locations

AWS Networking Services

AWS provides many services that you can combine to meet business or organizational needs. This section introduces the AWS Cloud services specifically related to networking. Later chapters provide a deeper view of the services pertinent to the exam.

Amazon Elastic Compute Cloud

Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides resizable compute capacity in the cloud. It allows organizations to obtain and configure virtual servers in Amazon’s data centers and to harness those resources to build and host software systems. Organizations can select from a variety of operating systems and resource configurations (for example, memory, CPU, and storage) that are optimal for the application profile of each workload. Amazon EC2 presents a true virtual computing environment, allowing organizations to launch compute resources with a variety of operating systems, load them with custom applications, and manage network access permissions while maintaining complete control.

Amazon Virtual Private Cloud

Amazon Virtual Private Cloud (Amazon VPC) lets organizations provision a logically-isolated section of the AWS Cloud where they can launch AWS resources in a virtual network that they define. Organizations have complete control over the virtual environment, including selection of the IP address range, creation of subnets, and configuration of route tables and network gateways. In addition, organizations can extend their corporate data center networks to AWS by using hardware or software Virtual Private Network (VPN) connections or dedicated circuits by using AWS Direct Connect. Amazon VPC is covered in depth in Chapter 2, Amazon Virtual Private Cloud (Amazon VPC) and Networking Fundamentals, and Chapter 3, Advanced Amazon Virtual Private Cloud.

AWS Direct Connect

AWS Direct Connect allows organizations to establish a dedicated network connection from their data center to AWS. Using AWS Direct Connect, organizations can establish private connectivity between AWS and their data center, office, or colocation (AWS) environment, which in many cases can reduce network costs, increase bandwidth throughput, and provide a more consistent network experience than Internet-based VPN connections. AWS Direct Connect is covered in depth in Chapter 5, AWS Direct Connect.

Elastic Load Balancing

Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances in the cloud. It enables organizations to achieve greater levels of fault tolerance in their applications, seamlessly providing the required amount of load balancing capacity needed to distribute application traffic. Elastic Load Balancing is covered in depth in Chapter 6, Domain Name System and Load Balancing.

Amazon Route 53

Amazon Route 53 is a highly available and scalable DNS service. It is designed to give developers and businesses an extremely reliable and cost-effective way to route end users to Internet applications by translating human-readable names, such as www.example.com, into the numeric IP addresses, such as 192.0.2.1, which computers use to connect to each other. Amazon Route 53 also serves as a domain registrar, allowing customers to purchase and manage domains directly from AWS. Amazon Route 53 is covered in depth in Chapter 6.

Amazon CloudFront

Amazon CloudFront is a global Content Delivery Network (CDN) service that securely delivers data, videos, applications, and Application Programming Interfaces (APIs) to an organization’s viewers with low latency and high transfer speeds. Amazon CloudFront is integrated with AWS, both with physical locations that are directly connected to the AWS global infrastructure and software that works seamlessly with other AWS Cloud services. These include AWS Shield for Distributed Denial of Service (DDoS) mitigation, Amazon S3, Elastic Load Balancing, or Amazon EC2 as origins for applications, as well as AWS Lambda to run custom code close to the content viewers. Amazon CloudFront is covered in depth in Chapter 7, Amazon CloudFront.

GuardDuty

GuardDuty is a continuous security monitoring, threat detection solution that gives customers visibility into malicious or unauthorized activity across their AWS accounts and the applications and services running within them. GuardDuty is capable of detecting threats such as reconnaissance by attackers (for example, port probes, port scans, and attempts to obtain account credentials), Amazon EC2 instances that have been compromised (such as instances serving malware, bitcoin mining, and outbound DDoS attacks), and compromised accounts (for example, unauthorized infrastructure deployments, AWS CloudTrail tampering, and unusual API calls). When a threat is detected, the solution delivers a security finding. Each finding includes a severity level, detailed evidence for the finding, and recommended actions. GuardDuty is covered in depth in Chapter 8, Network Security.

AWS WAF

AWS WAF helps protect web applications from common attacks and exploits that could affect application availability, compromise security, or consume excessive resources. AWS WAF gives organizations control over which traffic to allow or block to their web applications by defining customizable web security rules. AWS WAF is covered in depth in Chapter 8.

AWS Shield

AWS Shield is a managed DDoS protection service that safeguards web applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency. There are two tiers of AWS Shield: Standard and Advanced. All AWS customers benefit from the automatic protections of AWS Shield Standard at no additional charge. AWS Shield Standard defends against the most common, frequently occurring network and transport layer DDoS attacks that target websites or applications. AWS Shield is covered in depth in Chapter 8.

Summary

AWS provides highly-available technology infrastructure services with multiple locations worldwide. These locations are composed of regions and Availability Zones. AWS provides networks and network features spanning edge locations, VPCs, and hybrid networks. AWS operates a global network connecting these locations.

Amazon VPC provides complete control over a virtual networking environment, enabling secure and easy access to resources and applications.

This chapter introduced the primary services related to networking on AWS. This chapter also provided the background and context so that you can understand more advanced networking introduced later in this study guide.

Resources to Review

For further review, check out the following URLs:

AWS Global Infrastructure:https://aws.amazon.com/about-aws/global-infrastructure/

Amazon EC2: https://aws.amazon.com/ec2/

Amazon VPC: https://aws.amazon.com/vpc/

AWS Direct Connect: https://aws.amazon.com/directconnect/

Elastic Load Balancing: https://aws.amazon.com/elasticloadbalancing/

Amazon Route 53: https://aws.amazon.com/route53/

Amazon CloudFront:https://aws.amazon.com/cloudfront/

AWS WAF: https://aws.amazon.com/waf/

AWS Shield: https://aws.amazon.com/shield/

Exam Essentials

Understand the global infrastructure. AWS operates a global infrastructure. This network is operated by one company, Amazon. This infrastructure enables traffic to flow between regions, Availability Zones, edge locations, and customer cross-connect facilities. Traffic between nodes on this network uses the AWS global infrastructure.

Understand regions. A region is a geographic area in the world where AWS operates cloud services such as Amazon EC2. AWS Regions are designed to be completely independent from other regions. Most AWS Cloud services operate within a region. Since these regions are separated, content you put into a region stays in that region, unless you take an explicit action to move it.

Understand Availability Zones. An Availability Zone consists of one or more data centers within a region, which are designed to be isolated from failures in other Availability Zones. Availability Zones provide inexpensive, low-latency, high-bandwidth network connectivity to other zones in the same region. By placing resources in separate Availability Zones, you can protect your website or application from a service disruption affecting a single location.

Understand Amazon VPC. Amazon VPC is an isolated, logical network in the AWS infrastructure. A VPC contains resources, such as Amazon EC2 instances. There is a VPC mapping service that enables the routing capability inside a VPC.

Understand how AWS Cloud service integration works. You should understand how AWS Cloud services integrate into your overall network architecture and how to control network behavior. You do not need to understand the specific mechanisms that AWS uses to deliver services. Understanding these delivery models, however, will aid you in the development of scalable, performant, and highly-available architectures.

Test Taking Tip

Manage your time wisely when taking this exam. Don’t waste time on questions where you are stumped. Mark it for later review and move on. Plan on leaving time at the end of the exam for review. Go through each marked question to answer any that you may have skipped or to make sure that you are still happy with previously-marked answers.

Exercise

EXERCISE 1.1

Review Network Service Documentation

Navigate to all of the URLs in the resources to review the section above and review the network service product material.

Navigate to the AWS Global Infrastructure website. Review the information provided about AWS Regions and Availability Zones. Become familiar with the AWS Global Infrastructure.

Navigate to the Amazon VPC product documentation. Review the product details and FAQs. Become familiar with the additional product documentation in the related links section.

Navigate to the AWS Direct Connect product documentation. Review the product details and FAQs. Become familiar with the additional product documentation in the related links section.

Navigate to the Elastic Load Balancing product documentation. Review the product details and FAQs. Become familiar with the additional product documentation section.

Navigate to the Amazon Route53 product documentation. Review the product details and FAQs. Become familiar with the additional product documentation section.

Navigate to the Amazon CloudFront product documentation. Review the product details and FAQs. Become familiar with the additional product documentation section.

Navigate to the AWS WAF product documentation. Review the product details and FAQs. Become familiar with the additional product documentation section.

Navigate to the AWS Shield product documentation. Review the product details and FAQs. Become familiar with the additional product documentation section.

After completing this exercise, you will be familiar with AWS network-related products, where to find related documentation, and the different types of additional documentation that AWS provides.

Review Questions

Which of the following services provides private connectivity between AWS and your data center, office, or colocation environment?

Amazon Route 53

AWS Direct Connect

AWS WAF

Amazon Virtual Private Cloud (Amazon VPC)

Which AWS Cloud service uses edge locations to deliver content to end users?

Amazon Virtual Private Cloud (Amazon VPC)

AWS Shield

Amazon CloudFront

Amazon Elastic Compute Cloud (Amazon EC2)

Which of the following statements is true?

AWS Regions consist of multiple edge locations.

Edge locations consist of multiple Availability Zones.

Availability Zones consist of multiple AWS Regions.

AWS Regions consist of multiple Availability Zones.

Which of the following describes a physical location around the world where AWS clusters data centers?

Endpoint

Collection

Fleet

Region

What feature of AWS Regions allows you to operate production systems that are more highly available, fault-tolerant, and scalable than is possible using a single data center?

Availability Zones

Replication areas

Geographic districts

Compute centers

What AWS Cloud service provides a logically-isolated section of the AWS Cloud where you can launch AWS resources in a logical network that you define?

Amazon Simple Workflow Service (Amazon SWF)

Amazon Route 53

Amazon Virtual Private Cloud (Amazon VPC)

AWS CloudFormation

Which AWS Cloud service provides Distributed Denial of Service (DDoS) mitigation?

AWS Shield

Amazon Route 53

AWS Direct Connect

Amazon Elastic Compute Cloud (Amazon EC2)

How many companies operate the AWS global infrastructure?

1

2

3

4

Amazon Virtual Private Cloud (Amazon VPC) enables which one of the following?

Connectivity from your on-premises network

Creation of a logical network defined by you

Edge caching of user content

Network threshold alarms

Which Amazon Virtual Private Cloud (Amazon VPC) component maintains a current topology map of the customer environment?

Route table

Mapping service

Border Gateway Protocol (BGP)

Interior Gateway Protocol (IGP)

You may specify which of the following when creating a Virtual Private Cloud (VPC)?

AWS data centers to use

802.1x authentication methods

Virtual Local Area Network (VLAN) tags

IPv4 address range

Amazon Route 53 allows you to perform which one of the following actions?

Create subnets

Register domains

Define route tables

Modify stateful firewalls

Which service provides a more consistent network experience when connecting to AWS from your corporate network?

AWS Direct Connect

Amazon CloudFront

Internet-based Virtual Private Network (VPN)

Amazon Route 53

Which AWS Cloud service enables you to define customizable web security rules?

Amazon Route 53

AWS Shield

AWS WAF

GuardDuty

Which service increases the fault tolerance of your Amazon Elastic Compute Cloud (Amazon EC2) applications on AWS?

AWS Direct Connect

Elastic Load Balancing

AWS Shield

AWS WAF

Chapter 2

Amazon Virtual Private Cloud (Amazon VPC) and Networking Fundamentals

THE AWS CERTIFIED ADVANCED NETWORKING – SPECIALTY EXAM OBJECTIVES COVERED IN THIS CHAPTER MAY INCLUDE, BUT ARE NOT LIMITED TO, THE FOLLOWING:

Domain 2.0: Design and implement AWS networks

2.1 Apply AWS networking concepts

Domain 4.0: Configure network integration with application services

4.3 Determine the appropriate configuration of DHCP within AWS

Amazon Virtual Private Cloud (Amazon VPC) allows customers to define a virtual network within the AWS Cloud. You can provision your own logically-isolated section of AWS, similar to designing and implementing a separate, independent network that would operate in an on-premises data center.

This chapter will review the core components of Amazon VPC that you learned by studying for the prerequisite exam. The exercises at the end of this chapter will refresh the skills required to build your own Amazon VPC in the cloud. A strong understanding of Amazon VPC technologies and troubleshooting is required to pass the AWS Certified Advanced Networking - Specialty exam, and we highly recommend that you complete the exercises in this chapter.

Introduction to Amazon Virtual Private Cloud (Amazon VPC)

Amazon VPC is the networking layer for Amazon Elastic Compute Cloud (Amazon EC2), and it allows you to build your own virtual network within an AWS Region. You control various aspects of your VPC, including selecting your own IP address range, creating your own subnets, and configuring your own route tables, network gateways, and security settings. You can create multiple VPCs within a region, and each VPC is logically isolated, even if it overlaps or shares IP address space with another VPC. You can launch AWS resources, such as Amazon EC2 instances, into your VPC.

When you create a VPC, you must assign an IPv4 address range by choosing a Classless Inter-Domain Routing (CIDR) block, such as 10.0.0.0/16. You may select any IPv4 address range, but Amazon VPC treats the CIDR block as private. Amazon will not advertise the network to the Internet. To connect with the Internet, or to enable communication between your resources and other AWS Cloud services that have Internet endpoints, you can assign a globally unique, public IPv4 address to your resource. The initially-assigned IPv4 address range of the VPC cannot be changed after the VPC is created. A VPC IPv4 address range may be as large as /16 (65,536 addresses) or as small as /28 (16 addresses), and it should not overlap any other network to which the VPC is to be connected.

You may optionally associate an IPv6 address range to your VPC. The IPv6 address range is a fixed size of /56 (4,722,366,482,869,645,213,696 addresses) and is assigned to your VPC from Amazon’s own IPv6 allocation. The IPv6 addresses that you receive from Amazon are Global Unicast Address (GUA) space. Amazon advertises GUAs to the Internet, so these IPv6 addresses are public. If an Internet gateway (discussed later in this chapter) is attached to your VPC, then the VPCs are reachable over the Internet.

An IPv4 CIDR block is required to create a VPC. IPv4 addresses are assigned to every resource in your VPC, regardless of whether you use IPv4 for communication. Therefore, the number of usable IPv6 addresses in your VPC is constrained by the pool of available IPv4 addresses.

The current list of IP address ranges used by AWS is available in JSON format at https://ip-ranges.amazonaws.com/ip-ranges.json.

Your VPC can operate in dual-stack mode. This means that resources in your VPC can communicate over IPv4, IPv6, or both. Because Amazon VPC is dual-stack, however, IPv4 and IPv6 operate independently. You will need to configure the routing and security components of your VPC for each address family. Table 2.1 provides a comparison of IPv4 and IPv6 for Amazon VPC.

TABLE 2.1 IPv4 and IPv6 Comparison

Prior to Amazon VPC, users launched Amazon EC2 instances in a single, flat network shared with other AWS users. This Amazon EC2 environment is now called EC2-Classic. AWS accounts created after December 2013 only support Amazon VPC. EC2-Classic does not appear on the exam, and we do not discuss EC2-Classic further in this study guide.

To simplify the initial user experience with Amazon VPC, AWS accounts have a default VPC created in each region with a default subnet created in each Availability Zone. The assigned CIDR block of the VPC will be 172.31.0.0/16. IPv6 is not enabled on the default VPC.

Figure 2.1 illustrates a VPC with an address space of 10.0.0.0/16, two subnets with different address ranges (10.0.0.0/24 and 10.0.1.0/24) placed in different Availability Zones, and a route table with the local route specified.

Image described by caption and surrounding text.

FIGURE 2.1 VPC, subnets, and a route table

An Amazon VPC consists of the following concepts and components:

Subnets

Route Tables

IP Addressing

Security Groups

Network Access Control Lists (ACLs)

Internet Gateways

Network Address Translation (NAT) Instances and NAT Gateways

Egress Only Internet Gateways (EIGWs)

Virtual Private Gateways (VGWs), Customer Gateways, and Virtual Private Networks (VPNs)

VPC Endpoints

VPC Peering

Placement Groups

Elastic Network Interfaces

Dynamic Host Configuration Protocol (DHCP) Option Sets

Amazon Domain Name Service (DNS) Server

VPC Flow Logs

Subnets

A subnet is a segment of a VPC that resides entirely within a single Availability Zone. While a VPC spans all Availability Zones in a region, a subnet cannot span more than one Availability Zone. You may create zero, one, or more subnets in each Availability Zone. When creating a subnet, you specify the target Availability Zone and allocate a contiguous block of IPv4 addresses from the VPC CIDR block. You launch Amazon EC2 resources, like Amazon Relational Database Service (Amazon RDS), into one or more subnets.

The maximum size of a subnet is determined by the size of the VPC IPv4 CIDR range. The smallest subnet that you can create is a /28 (16 IPv4 addresses). For example, if you created a VPC with IPv4 CIDR 10.0.0.0/16, you could create multiple subnets of /28. You could also create a single subnet in a single Availability Zone of size /16. AWS reserves the first four IPv4 addresses and the last IPv4 address of every subnet for internal networking purposes. For example, a subnet defined as a /28 has 16 available IPv4 addresses; subtract the 5 IPs needed by AWS to yield 11 IPv4 addresses for your use within the subnet.

Within Amazon VPC, broadcast and multicast traffic is not forwarded. Subnets can be as large as you like without impacting performance and traffic forwarding.

If an IPv6 address block is associated with your Amazon VPC, you may optionally associate an IPv6 CIDR block to an existing subnet. Each IPv6 subnet is a fixed prefix length of /64, and the CIDR range is allocated from the VPC’s /56 CIDR block. When you specify the IPv6 subnet address range, you control the last 8 bits of the subnet’s IPv6 prefix, called the subnet identifier. Figure 2.2 shows how the hexadecimal (Hex) and binary (Bin) representations align with their use (Use). For example, if your VPC is assigned 2001:0db8:1234:1a00::/56, you specify the value of the low order 8 bits.

Image described by caption and surrounding text.

FIGURE 2.2 Subnet identifier

In Figure 2.2, Subnet 1 uses a subnet identifier of 00, which yields the CIDR 2001:db8:1234:1a00::/64. Note that IPv6 notation does not require that leading zeros are shown, so 2001:0db8::/56 and 2001:db8::/56 are equivalent. Additionally, any single, contiguous section of the address that is consecutive zeros can be notated with double colons (::).

You can disassociate an IPv6 CIDR block from a subnet if no IPv6 addresses are in use. If no subnets have an assigned IPv6 CIDR, you can also disassociate the IPv6 CIDR from your Amazon VPC. You can request a new IPv6 CIDR from Amazon at a later time.

If you disassociate an IPv6 CIDR from your VPC, you cannot expect to receive the same CIDR if you subsequently request an IPv6 block from Amazon.

For both IPv4 and IPv6, subnets can be classified as public, private, or VPN-only. Table 2.2 shows how these distinctions compare, using Figure 2.3 as an example. Regardless of the type of subnet, the internal IPv4 address range of the subnet is always private (namely, not announced by AWS on the Internet), and the internal IPv6 address range is always a GUA (that is, announced by AWS on the Internet).

TABLE 2.2 IPv4 and IPv6 Subnets

Diagram shows AWS region which includes VPC subnet 1 with address 10.0.0.0/24, subnet 2 with address 10.0.1.0/24, and subnet 3 with address 10.0.2.0/24 connected to internet gateway and corporate network through VPN connection.

FIGURE 2.3 Public, private, and VPC-only subnets

While subnets are often referred to as public or private in AWS documentation, their underlying capabilities are the same. The defining distinction between a private subnet and a public subnet is a route to an attached Internet gateway.

Default VPCs contain one public subnet in every Availability Zone within the region, with a netmask of /20.

Users are cautioned not to delete the default VPC. It can have unintended consequences for other services that expect a default VPC to exist.

Route Tables

Each subnet within a VPC contains a logical construct called an implicit router. The implicit router is the next hop gateway on a subnet where routing decisions are made. These routing decisions are governed by a route table, which includes a set of route entries. You can create custom route tables to define specific routing policies. Custom route tables may be associated with one or more subnets. Your VPC also contains a main route table that you can modify. The main route table is used for all subnets that are not explicitly associated with a custom route table.

Each route table entry, or route, consists of a destination and a target. The destinations for your route tables are either CIDR blocks or, in the case of VPC gateway endpoints (discussed later in this chapter), prefix lists. Targets of your route table can include Internet gateways, NAT gateways, egress-only Internet gateways (EIGWs), virtual private gateways (VGW), VPC gateway endpoints, VPC peers, and elastic network interfaces.

Each route table has one or more local route entries associated with the IPv4 and IPv6 CIDR blocks configured for your VPC. Every route table has an entry for the defined CIDR ranges with a target of Local, and these entries cannot be removed. You cannot add a more specific route to your route table than the local route. The local route table entries ensure that all resources in your VPC have a route to one another.

When the implicit router receives a packet, the next hop target is determined by a specific route priority. The route table includes local, static, and dynamic routes. The route for the VPC CIDR block is local. Explicitly configured routes are static. Dynamic routes originate through route propagation from a VGW (discussed later in this chapter). Table 2.3 describes the route priority order. Recall that Amazon VPC operates IPv6 in a dual-stack mode, meaning that routing evaluations are executed independently for IPv4 and IPv6.

TABLE 2.3 Route Priority

You should remember the following points about route tables:

Your VPC has an implicit router.

Your VPC automatically comes with a main route table that you can modify.

You can create additional custom route tables for your VPC.

Each subnet is associated with a route table, which controls the routing for the subnet. If you don’t explicitly associate a subnet with a particular route table, the subnet uses the main route table.

You can set a custom route table as the main route table so that new subnets are automatically associated with it.

Each route in a table specifies a destination CIDR and a target; for example, traffic destined for 172.16.0.0/12 is targeted for the VGW.

AWS uses a predefined route priority process to determine how to route the traffic.

IP Addressing

Resources in your VPC use IP addresses to communicate with each other and with resources over the Internet. Amazon EC2 and Amazon VPC support both IPv4 and IPv6 addressing protocols.

Amazon EC2 and Amazon VPC require you to use the IPv4 addressing protocol. When you create a VPC, you must assign it an IPv4 CIDR block. Amazon EC2 features like instance metadata and the Amazon DNS Server require the use of IPv4.

The IPv4 CIDR block that you allocate to your VPC is considered a private IPv4 address range by Amazon, regardless of whether or not the address block is routable on the Internet. To connect your instance to the Internet, or to enable communication between your instances and other AWS Cloud services that have public endpoints, assign public IPv4 addresses. There are multiple ways to assign public IPv4 addresses, and these methods are covered in this section.

You can optionally associate an IPv6 CIDR block with your VPC and subnets and assign IPv6 addresses from that block to the resources in your VPC. IPv6 addresses are public and reachable over the Internet. There are multiple types of IPv6 addresses. This section of the guide covers the types of IPv6 addresses and the methods used to assign IPv6 addresses to your Amazon EC2 instances.

IPv4 Addresses

IPv4 addresses in your VPC are broadly categorized as private and public IP addresses. Private IP addresses are IPv4 addresses assigned from the CIDR block of your VPC. These addresses are assigned either automatically or manually at launch. Public IP addresses are assigned from a pool of routable IPv4 addresses administered by Amazon. The assignment of public IPv4 addresses to an instance occurs either automatically at launch or dynamically after launch using an IPv4 Elastic IP address.

The primary interface of an Amazon EC2 instance is assigned an IPv4 private address at launch. You can specify the private IP address if it is unused and is within the target subnet address range. If a manually defined IP address is not provided at launch, Amazon automatically assigns a private IP address from the available address pool of the subnet. The private IP address on the primary interface is retained until it is terminated. It is possible to launch Amazon EC2 instances with multiple elastic network interfaces (discussed later in this chapter) and secondary private IP addresses. The private IP addresses on additional elastic network interfaces are retained until the interface is deleted.

Amazon EC2 instances may also receive public IPv4 addresses, either automatically at launch or dynamically after launch. All VPC subnets have a modifiable attribute that determines whether elastic network interfaces created in the subnet will automatically receive public IPv4 addresses. Regardless of this attribute, you can override it either to assign or withhold automatic public IPv4 address assignment.

You cannot manually disassociate the automatically-assigned public IP address from your instance after launch. It is automatically released in certain cases, for example when you stop or terminate your instance, after which you cannot reuse it.

An Elastic IP address is a static, public IPv4 address that you can allocate to your account (pull from the pool) and release from your account (return to the pool). The address comes from a pool of regional IPv4 addresses that Amazon manages. Elastic IP addresses allow you to maintain a set of IPv4 addresses that remain fixed, while the underlying infrastructure may change over