Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Networking on AWS (2018)

grahamlyons.com

Post reply on HN
Print view View original

91–100 of 104 posts

Re: Networking on AWS (2018)

#91

Post by sudhirj »

manishsharan wrote: post #84
sudhirj wrote: post #67

Earlier quoted context omitted.

There's another gotcha, though is that Lambdas seem to default to inside the VPC by default, which triggers the NAT Gateway cost if you want to do anything useful with them. You'll need to explicitly remember to host the Lambdas outside the VPC.

You may consider using NAT instance of EC2. A micro instance which can also serve as your bastion host. Or if you are a true extreme penny pincher -- have your lamba function invoke aws api to set up a NAT Gateway and update the subnet route, then execute your business function and then clean up the NAT.

Huh? I can’t make out if this is sarcasm... you suggesting opening the firewall from the inside for each request, finishing the request and then closing the firewall? For starters, what would happen if request 1 closed the firewall while request 2 was still working?

Re: Networking on AWS (2018)

#92

Post by scubbo »

athrun wrote: post #44
scubbo wrote: post #38

Something that's missing from this (otherwise great!) guide, that has puzzled me for a while - what's the point? What does this configuration actually gain you/AWS? My best guess is that private subnets are for DDOS protection, but that seems like something that would be better handled by throttling. Given the amount of complaints I've heard about how difficult VPC/Subnet setup is, why bother with it at all? Staving…

Typically, compliance requirements will drive you to implement private subnets. Auditors will want to know which isolation mechanisms you have put in place, and private subnets should be part of your isolation strategies. Other use-cases: - Legacy (or third-party) apps whose security model assumes they are behind some sort of private firewall. - Hybrid deployment where you need to bridge on-premises (or other clouds)…

Thanks! That's certainly helpful!

Re: Networking on AWS (2018)

#93

Post by scubbo »

llama052 wrote: post #43
scubbo wrote: post #38

Something that's missing from this (otherwise great!) guide, that has puzzled me for a while - what's the point? What does this configuration actually gain you/AWS? My best guess is that private subnets are for DDOS protection, but that seems like something that would be better handled by throttling. Given the amount of complaints I've heard about how difficult VPC/Subnet setup is, why bother with it at all? Staving…

Not sure I'm qualified to answer all of your questions on this but, from a networking perspective.. Private subnets will allow you to reduce your exposure to the Internet, also can reduce costs with something like a NAT gateway. It's useful for things that don't need to be public facing. Generally things on the private subnet can go outbound directly but not have anything come direct into that subnet, you'd need a so…

Thanks! I had to look up "broadcast domain" to understand the last paragraph, but that helped illuminate some things. Thank you!

Re: Networking on AWS (2018)

#94

Post by llama052 »

motive wrote: post #58
llama052 wrote: post #43

Earlier quoted context omitted.

Not sure I'm qualified to answer all of your questions on this but, from a networking perspective.. Private subnets will allow you to reduce your exposure to the Internet, also can reduce costs with something like a NAT gateway. It's useful for things that don't need to be public facing. Generally things on the private subnet can go outbound directly but not have anything come direct into that subnet, you'd need a so…

Just as an fyi, inside Amazon's virtual network topology, there is no such thing as layer 2, and thus, no broadcast topology. Normally you'd be 100% correct in seeking to limit that bandwidth, but in Amazon everything works just a little differently.

Ah yes are right. I was thinking specifically networking, not AWS.

Re: Networking on AWS (2018)

#95

Post by grahamlyons »

abalone wrote: post #21

Tangential question: This guy's blog has fantastic content but I don't see an RSS feed or any other way of subscribing (apart from a much broader Twitter feed). What's the best way to keep up?

Flattery will get you everywhere. It's a Jekyll blog so I'm sure RSS is just a plugin away. And then I'd better write some more content...

Re: Networking on AWS (2018)

#96

Post by grahamlyons »

becauseiam wrote: post #6

There's quite a few things you've missed that are significant and should have been included, maybe one for part two: * Network ACLs, which describe the ruleset (consider it like a stateless firewall) for subnets and their respective routes. Whilst they are optional, having a default set it straightens out a lot of duplication that may end up in Security Groups (which are more stateful in nature). * Elastic (public) I…

Network ACLs have been pointed out as missing from this before but quite a few people said that they were right not be included. I didn't put them in because I've never used them so didn't fall under 'need to know' from my perspective.

IPv6 is another point of contention but again it's not something I've ever used and so, apart from any other controversies with it ("...IPv6 which is only marginally better than IPv4 and which offers no tangible benefit...", https://varnish-cache.org/docs/trunk/phk/http20.html), I'm not qualified to write about it.

EIPs and ENI should probably have been in there but I don't tend to use those that often either so they didn't occur to me.

I'm not sure that VPC Gateways, DNS or DHCP are necessarily need to know things either. VPC Gateways are for a specific routing optimisation which not everyone is going to need. I didn't know the details of the DNS set up for a VPC so thank you for that.

Thank you for the feedback - I really appreciate you taking the time.

Re: Networking on AWS (2018)

#97

Post by grahamlyons »

scubbo wrote: post #38

Something that's missing from this (otherwise great!) guide, that has puzzled me for a while - what's the point? What does this configuration actually gain you/AWS? My best guess is that private subnets are for DDOS protection, but that seems like something that would be better handled by throttling. Given the amount of complaints I've heard about how difficult VPC/Subnet setup is, why bother with it at all? Staving…

That's good feedback - thank you.

Re: Networking on AWS (2018)

#98

Post by grahamlyons »

simonebrunozzi wrote: post #50

The title says "everything you need to know about networking on AWS". I wish it were this simple. The article is well written, but it simply represents maybe 1% of what you need to know here. I would have called it "A simple introduction to networking on AWS".

I'd contest that this is everything that you need to know. Or perhaps more accurately, everything I need to know.

It's certainly not intended to be exhaustive and I am definitely not a network engineer but I think you could operate at a reasonable scale within a single well laid out VPC. Of course there'll be a point for peering etc. but you might not need that.

Re: Networking on AWS (2018)

#99

Post by grahamlyons »

mvanbaak wrote: post #5

For the public subnets where the NAT gateways are, you can use 1 route table for all public subnets together. Besides that: nice article

Would the default route table do that job? Subnets would be associated with that if they weren't explicitly assigned to another route table, right?

Re: Networking on AWS (2018)

#100

Post by abalone »

grahamlyons wrote: post #95
abalone wrote: post #21

Tangential question: This guy's blog has fantastic content but I don't see an RSS feed or any other way of subscribing (apart from a much broader Twitter feed). What's the best way to keep up?

Flattery will get you everywhere. It's a Jekyll blog so I'm sure RSS is just a plugin away. And then I'd better write some more content...

Thank you! But seriously, do you rely exclusively on Twitter to get the word out that you've posted something?

I'm just so curious how people do this in the Modern Age. I am totally dependent on RSS readers to subscribe to things but I feel I am living in the past. I get that Medium tried to address the distribution problem, but not everyone posts on Medium. And I get that everyone posts things on Twitter, but I want to scream when people say just follow someone on Twitter because obviously there is a very, very high chance that I will miss if someone posted something new because Twitter is not meant to be read comprehensively.

Post reply on HN