AWS Private Cloud (VPC)

AWS Private Cloud (VPC)

Amazon Virtual Private Cloud (Amazon VPC) enables you to launch AWS resources into a virtual network that you’ve defined. This virtual network closely resembles a traditional network that you’d operate in your own data center, with the benefits of using the scalable infrastructure of AWS.

You have complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways. You can use both IPv4 and IPv6 for most resources in your VPC, helping to ensure secure and easy access to resources and applications.

As one of AWS’s foundational services, Amazon VPC makes it easy to customize your VPC’s network configuration. You can create a public-facing subnet for your web servers that have access to the internet. It also lets you place your backend systems, such as databases or application servers, in a private-facing subnet with no internet access. Amazon VPC lets you to use multiple layers of security, including security groups and network access control lists. So as to help control access to Amazon Elastic Compute Cloud (Amazon EC2) instances in each subnet.

 

AWS private cloud (VPC) Features

AWS Private Cloud (Amazon VPC) provides the below features that let you increase and monitor security.

Flow Logs

You can monitor your VPC flow logs delivered to Amazon Simple Storage Service (Amazon S3) or Amazon CloudWatch to gain operational visibility into your network dependencies and traffic patterns, detect anomalies and prevent data leakage, and troubleshoot network connectivity and configuration issues.  This helps to analyse the flow and helps you to look in depth details till the packet level. So that it helps the security analysts to do complete forensic investigation in case of any threats and security breaches. It help Infrastructure Admins to s to look into the details as they require for troubleshooting day today issues in support. The logs can be pumped into storage for compliance

IP Address Manager (IPAM)

IPAM makes it easier for you to plan, track, and monitor IP addresses for your AWS workloads. IPAM automates IP address assignments to your Amazon VPC. So that there is no manual effort in maintaining the IP details on a common location or spread sheets, the traditional way. And also it avoids IP conflicts as it does the validation automatically. It also provides more detailed Dashboard and reports of  your network in a unified operational view.

AWS private cloud (VPC) IP Addressing

IP addresses enable resources in your VPC to communicate with each other and with resources over the internet. You can use the Amazon provided public IPv4 addresses, Elastic IPv4 addresses, or an IP address from the Amazon provided IPV6 rangers. You can also bring your own IP segments into this which is more helpful as we do not need to look for a range and easy to manage as you know the range very well. Amazon VPC supports both the IPv4 and IPv6 addressing protocols. In a VPC, you can create IPv4-only, dual-stack, and IPv6-only subnets and launch Amazon EC2 instances in these subnets. Amazon also gives you multiple options to assign public IP addresses to your instances.

AWS private cloud (VPC) Routing

Routing is one of the important feature of networks and it supports ingress routing. So that you can route all incoming and outgoing traffic flowing to/from an gateway on the internet. And also your private gateway to your VPC. So that your virtual private cloud to send all traffic to a gateway or an AWS instance before it reaches your business workloads

Network Access monitor

Network Access monitor helps you verify that your network on AWS conforms to your network security and compliance requirements. It lets you specify your network security and compliance requirements, and identifies unintended network access. So that does not meet your specified requirements. You can use Network Access Analyzer to investigate and analyse the network access to your resources. It helping you identify improvements to your cloud security posture and security compliance.

Network Access Control List

A network access control list (network ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. This is an added advantage to the security of the private cloud. So that you can allow only the required ranges and devices to talk to each other. This will help you to keep yours so secure even though it is hosted on the public space.

Reachability Analyzer

This static configuration analysis tool enables you to analyse and debug network reachability between two resources in your VPC. It is like the Ping tool to check the connectivity between source and destination resources. So that provides some in-depth details other than ping  like the hops, paths and the blocks in the way to the resource.

Security Groups

Security groups is one more layer of security and it acts like one more layer of firewall for associated Amazon EC2 workloads. It controlls inbound and outbound traffic at the instance level. When you launch an instance, you can associate it with one or more security groups.  There are some specific set of default groups will be utilized if you do not provide or configure the groups as you need.  So this can be modified later but proper planning is required.

VPC Traffic Mirroring

This is a like its name mirroring. It helps to copy network traffic from an elastic network interface of Amazon EC2 instances and send it to out-of-band security and monitoring appliances for deep packet inspection. So that you can detect network and security anomalies, gain operational insights, implement compliance and security controls, and troubleshoot issues.

AWS Private Cloud (VPC) Key Features

Amazon VPC provides full control over an isolated virtual network space that delivers the same configuration flexibility as a private data center network. Its key features include:

• Bring your own network segment which helps to use your private range.
• available public, routable IP addresses with network address translation using a virtual internet gateway;
• Access control list, Security groups acts as extra firewall.
• Static and dynamic IP ranges.
• Multiple IP for workloads, many network interfaces can be used.
• Dedicated security groups which can be modified on requirement.
• Support from AWS.
• Use of on-perm active directory and polices.
• Multiple region support for VPC.
• Security analysis tools.
• Log mirror.
• Multi-tier applications build and support.
• Disaster recovery is made simple
• Pay as you go pricing because it is cheaper.

We have so many great feature while using the AWS Private cloud. So there are so many options now to look for more provides and understand the private cloud concepts. So that this will help in deciding what is right for your organisation against use of public cloud options. There are also so many private clouds like the VMware private cloud, and Azure Stack.

Happy Cloud Journey.