What is Amazon VPC?
AWS resources can be launched in a logically isolated virtual network that you specify using the Amazon Virtual Private Cloud (VPC) service. You are in total control of your virtual networking environment, including choosing your own range of IP addresses, setting up subnets, and configuring network gateways and route tables. The majority of the resources in your VPC are compatible with both IPv4 and IPv6, which helps to provide safe and convenient access to resources and apps.
Customizing the network setup of your VPC is simple using Amazon VPC, one of AWS’s core services. For your web servers with internet connection, you can set up a subnet that is visible to the public. Additionally, it enables you to locate your backend systems—like databases or application servers in a subnet that faces the private sector and is not connected to the internet. Several security layers, such as network access control lists and security groups, can be used with Amazon VPC to assist manage access to Amazon Elastic Compute Cloud (Amazon EC2) instances within each subnet.
Benefits of Amazon VPC
Increase security
Within your virtual network, secure and keep an eye on connections, filter traffic, and limit instance access.
Save time
Reduce the amount of time you spend configuring, maintaining, and verifying your virtual network.
Manage and control your environment
Create subnets, configure route tables, and select your own IP address range to personalize your virtual network.
How it works
You have complete control over your virtual networking environment with Amazon Virtual Private Cloud (Amazon VPC), including connectivity, security, and resource placement. Set up your VPC in the AWS service panel to get started. Add resources like Amazon Relational Database Service (RDS) instances and Amazon Elastic Compute Cloud (EC2) after that. Lastly, specify how your VPCs interact with one another across AWS Regions, Availability Zones, and accounts.
Use cases
Launch a simple website or blog
Enforce restrictions on inbound and outbound connections to strengthen the security posture of your web application.
Host multi-tier web applications
Establish network connectivity and limitations among your databases, application servers, and web servers.
Create hybrid connections
Create and oversee a VPC network that works with both your on-premises and AWS services.
Amazon virtual private cloud pricing
Why Amazon Virtual Private Cloud?
Although setting up and utilizing an Amazon Virtual Private Cloud (VPC) is free, you can pay for its extra features using usage-based fees. You may modify your Amazon VPC’s control, connectivity, monitoring, and security with the help of AWS’s tools and services. Please refer to the following for precise pricing rates for these components.
There are still usage fees associated with other Amazon Web Services products, like Amazon Elastic Compute Cloud (Amazon EC2), which include data transfer fees. Pricing is per VPN connection-hour if you use the optional hardware virtual private network (VPN) connection to link your VPC to your corporate data center. Data transported across VPN connections will be invoiced at standard AWS Data Transfer rates, and partial hours are billed as full hours.
Amazon VPC features
Logs of Flow
To get operational insight into your network dependencies and traffic patterns, identify irregularities and stop data leaks, and troubleshoot network connectivity and configuration issues, you can keep an eye on your Amazon Virtual Private Cloud (VPC) flow logs that are sent to Amazon Simple Storage Service (Amazon S3) or Amazon CloudWatch. You can discover more about who started your TCP connections and the packet-level source and destination of traffic passing through intermediary layers by examining the expanded information in flow logs. To help you ful fill some compliance obligations, you can additionally archive your flow logs.
IP Address Manager (IPAM)
Planning, tracking, and monitoring IP addresses for your AWS workloads is made simpler with IPAM. IPAM eliminates the need for spreadsheet-based or in-house planning software by automating IP address assignments to your Amazon Virtual Private Cloud VPC. Additionally, it improves network observability by displaying IP utilization across several VPCs and accounts in a single operational view.
IP Addressing
Resources in your VPC can communicate with resources over the internet and with each other thanks to IP addresses. Both IPv4 and IPv6 addressing protocols are supported by Amazon Virtual Private Cloud (VPC). IPv4-only, dual-stack, and IPv6-only subnets can be created in a VPC, and Amazon EC2 instances can be started in these subnets. Additionally, Amazon offers you a variety of choices for giving your instances public IP addresses. You can use an IP address from the Amazon-provided IPv6 CIDRs, Elastic IPv4 addresses, or public IPv4 addresses. In addition, you have the choice to assign these instances your own IPv4 or IPv6 addresses within the Amazon VPC.
Ingress Routing
This functionality allows you to redirect all incoming and outgoing traffic to and from a virtual private gateway or internet gateway to the elastic network interface of a particular Amazon EC2 instance. Before any traffic reaches your business workloads, route it to a gateway or an Amazon EC2 instance in your Amazon Virtual Private Cloud (VPC).
Network Access Analyzer
You can confirm that your network on AWS complies with your network security and compliance requirements by using Network Access Analyzer. With the help of Network Access Analyzer, you may define your standards for network security and compliance and find unauthorized network access that doesn’t fit your needs. With the help of Network Access Analyzer, you can comprehend network access to your resources, find ways to strengthen your cloud security posture, and quickly show compliance.
Network Access Control List
An optional security feature for your VPC is a network access control list (network ACL), which functions as a firewall to regulate traffic entering and leaving one or more subnets. Network ACLs can be configured using rules that are comparable to those in your security groups.
Manager of Networks
To assist you in managing and keeping an eye on your network on AWS, Network Manager offers capabilities and tools. IP administration, network security and governance, connectivity management, and network monitoring and troubleshooting are all made simpler with Network Manager.
Analyzer of Reachability
You can examine and troubleshoot network reachability between two resources in your VPC using this static configuration analysis tool. When the source and destination resources are reachable, Reachability Analyzer generates hop-by-hop information about the virtual path between them; when they are not, it identifies the blocking factor.
Security Groups
Establish security groups to regulate incoming and outgoing traffic at the instance level, serving as a firewall for related Amazon EC2 instances. An instance can be linked to one or more security groups at the time of launch. The instance is automatically linked to the VPC’s default group if you don’t specify a group. In your VPC, each instance may be a member of a distinct group.
Mirroring of Traffic
With this capability, you can transfer network traffic to out-of-band security and monitoring appliances for deep packet inspection after copying it from an elastic network interface of Amazon EC2 instances. You may create security and compliance controls, troubleshoot problems, obtain operational insights, and identify network and security anomalies. You can directly view the network packets passing through your VPC with traffic mirroring.
Lattice
You can reliably connect, keep an eye on, and protect conversations between your apps with the aid of this service. Network traffic control, access, and monitoring policies can simplify and standardize compute service connections across instances, containers, and serverless apps.
Public Access Is Blocked by VPC
This feature ensures that resources in your Amazon Virtual Private Cloud (VPC) are not accidentally exposed to the public by offering a single declarative control that makes it simple to prevent direct Internet access VPCs via the Internet Gateway or Egress-only Gateway. You can choose to ban only ingress Internet connections or both egress and ingress Internet connections in the VPC.
