VPC - Virtual Private Cloud

- Amazon's Virtual Datacenter in the cloud
- When creating VPC:
-- adds Route Table, Network ACL (allows all traffic), security group, by default
-- Need to create subnets, and internet gateway
- can have only 1 internet gateway per vpc
- amazon reserver 5 IPs for internal use
- Security Groups are local to VPCs

NAT - Network Address Translation

- NAT Instance
-- EC2 instance used as gateway
-- Need to disable source/destination checks as it is neither the source or destination of the traffic, but just acting as a bridge between private and public subnets and essentially to the public
-- Must be route out of private subnet to the  NAT instance
-- Amount of traffic that NAT instances can support depends on the instance size, if you are bottleneck, increase instance size
-- Can create HA using autoscaling Groups, multiple subnets in different AZs and a script to automate failover.
-- NAT instances are behind Security group

- NAT Gateway- highly available gateway that allow your private subnets to communicate our to the public
-- Redundant inside the AZ
-- Can only assign one to one VPC
-- Preferred by the enterprise
-- Starts at 5Gbps and autoscales (up to 45 Gbps)
-- No need to patch
-- Not associated with Security Groups
-- Automatically assigned a public IP; need to update route tables
-- No need to disable source/destination checks

** If you have resources in multiple AZs and they share one NAT gateway, the gateway being down will make both zones go down (lose public access).To create an AZ independent architecture, create a NAT gateway in each AZ and configure your routing to ensure that resources use the relevant NAT gateway.

** When provisioning a Load Balancer, need at least 2 public subnets.

ACLs
- Access Control List
- Custom ACLs deny all by default till you add rules
- Each subnet needs to be associated with an ACL. 
- Start from 100 and go in increments of 100 (100 - http (90), 200 - https (443), 300 - ephemeral (1024 - 65535))
- Rules are read based on Rule # (deny at end of list will not work)
- Block IP addresses using ACLs not Security Groups
- Network ACLs are stateless

- Ephemeral ports - WTF?

Flowlog
- Feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC
- VPC level, Subnet level, Network UInterface level
- Data is stores using amazon cloudwatch logs (mneeds LogGFroup in CloudWatch)
- After creating, you can view and retrieve data in cloudwatch logs
- Cannot enable flowlogs for VPCs that are peered with your VPS un less the peer VPC is in your account
- Cannot change configuration once flowlog has been created
- Not all traffic is monitored
-- Traffic generated by instances when they contact the Amazon DNS server is not logged, if you use your own DNS server, traffic to DNS server is logged
-- Traffic generated by Windows Instance for Amazon Windows License activation is not logged
-- To and from 169.254.169.254 is not logged
-- DHCP is not logged
-- Traffic to reserved IP address for default VPC router is not logged

Bastion host
- Basically a Jumpbox
- Used as single public point to access and manage cs2 instances via ssh or RDP

Direct Connect
- Used to establish a dedicated network connection from your datacenter, office or colocation environment to AWS.
- Can help reduce network costs, increase bandwidth throughput and provide more consistent network experience than internet based connections
- Useful for high volume throughput workloads (lots of network traffic), or if you need stable and reliable secure connection
- Need to know how to create Direct Connect Connection: https://www.youtube.com/watch?v=dhpTTT6V1So

Global Accelerator
- Service used to create accelerators to improve availability and performance of applications for local and global users
- Directs traffic to optimal endpoints over the AWS global network for global audience.
- Gives you 2 static IP addresses (or can bring your own)
- Can control traffic using traffic dials. This is done within the endpoint group.
- Network Zone
-- Services the static IP addresses for your accelerator from a unique IP subnet
-- When configuring an accelerator, by default, Global Accelerator allocates 2 IPv4 addresses. If one address from Network Zone becomes unavailable due to IP address blocking by certain client networks or network disru[ptions, client applications can retry topn the healthy static IP address from the other isolated network zone.
- Listener
-- A listener processes inbound connections from clients to Global Accelerator, based on the port or range and protocol that you configure. Supports both 
-- Each listener has one or more endpoints groups associated with it and traffic is forwarded to endpoints in one of the groups
-- You associate endpoint groups with listeners by specifying regions that you want to distribute traffic to. Traffic is distributed to optimal endpoints within the endpoint groups associated with a listener.
- Endpoint Group
-- Each endpoint group is associated with a specific AWS region
-- Includes one or more endpoints in the region
-- Can increase or reduce the percentage of traffic that would be otherwise directed to an endpoint group by adjusting a setting called a traffic dial
-- The traffic dial; lets you easily do performance testing or blue/green deployment testing for new releases across different aws regions.
- Endpoints
-- Two Types
--- Interface Endpoints
--- Gateway Endpoints
---- Current gateway Endpoints support:
----- AmazonS3
----- DynamoDB