AWS VPC Best Practices | AWS Whiteboard
Downloads
Transcript
I thought I’d start a new series of videos sort of like a virtual whiteboard session, and I figured that a good starting point would be to discuss some of our best practice checklists. Recently, we created a new checklist around building out virtual private clouds or VPCs on AWS. So here we go.
These are our six best practices, and we’re just gonna go through these really briefly. You can grab a full res download from the website if you wanna use these later for reference.
Point number one is to make sure that you’re properly planning out your network blocks, your CIDR blocks, and there’s two things that I want you to keep in mind. First off, make sure that the cinder blocks you’re using for your VPCs are large enough so that you don’t run out of VPC or sorry IP space at some point in the future. The second thing to keep in mind around your CIDR blocks is to make sure that they don’t overlap You don’t want any network overlap if you are dealing with other AWS VPCs or maybe networks that exist outside of AWS, maybe an on prem environment, a colocation.
The next thing to remember about building VPCs is first a VPC is a regional service. You wanna make sure to build highly available fault tolerance solutions in AWS that your VPCs span multiple availability zones or AZs in the region where you’d employ that VPC.
The way that you span multiple AZs with your VPC is to spread your subnets across those AZs. When you’re creating the VPC. So make sure that you are selecting multiple AZs to build out highly available solutions.
Point number three, create multiple layers of defense. Now, we’re gonna keep this really high level for the discussion today, but the first two things I think about with multiple layers of defense in your networks are network access control lists. These are stateless firewalls that operate at the subnet level, they are optional, and then we have security groups, and these are stateful firewalls that operate at the elastic network interface level, inside your VPC. Security groups are required. Those are two simple ways to create multiple layers of defense within your environment.
Another really important feature within a VPC that often gets overlooked are flow logs. Flow logs are gonna give you a high level picture of all the traffic flowing either into or out of your VPC, you have to set this up k. It’s not there by default. And when you create your VPC flow log, you can push those logs off to one of two destinations, either cloud watch logs, or S3. I prefer cloud watch logs because then we can use things like log insights to quickly, look through those logs for either troubleshooting information or trying to identify maybe issues within that VPC.
Next, you wanna limit as best you can any public facing resources. And I know NAT Gateway’s people are probably gonna say, well, NAT Gateways are expensive. They are, but they allow us to reduce the amount of resources that we have to put on the public internet. NAT gateways are highly available. They’re fully managed. You wanna make sure that you have NAT gateways for every AZ within your VPC. So in my example, we’re gonna generate or we’re gonna deploy a two AZ VPC, I’m gonna have two NAT gateways, one in each of my AZs.
And then finally, our last best practice is to use VPC endpoints. I like to think about it this way. You have VPC aware services these are things that are deployed within a VPC, like an EC2 instance. And then you have services that are non VPC aware. Things that are don’t that aren’t able to be deployed within a VPC, like an S3 bucket. Without VPC endpoints, that EC2 instance that’s sitting within your VPC has to leave the Amazon network to get to S3. VPC endpoints allow us to keep that traffic at least on the Amazon network. Two types of endpoints, there’s a gateway endpoint and an interface endpoint, gateway endpoints are free of charge, interface endpoints, incurring additional fee.
But from my perspective, these are must haves, and we work them into the pricing when we’re building out VPC solutions for our customers from day one.
There you go. That is a quick review of our VPC best practices, you can download a copy of this below where this video.
You can also find a free CloudFormation template in our GitHub repo, which I’ll also include a link for in the show notes.
Thanks very much. Until next time, get out there and build great things.