AWS Virtual Private Cloud - Part2

Virtual Private Cloud

Virtual Private Cloud is a logically isolated section of AWS cloud where you can launch your resources. You have complete control of your virtual networking environment. You can create your own subnets and select even your preferred private IP ranges. VPC can span multiple availability zone in the same region but VPC can not span multiple regions.

Internet Gateway

An Internet Gateway provide access to internet for your instances in VPC. Internet Gateway is redundant and highly available. Only one Internet Gateway can be attached to a VPC at a time.

Since Internet Gateway is horizontally scaled you don’t need to worry about single point of failure.

Subnets

You can create your own customized subnets in a VPC and assign the preferred private IP address range. A subnet can not span multiple availability zone.

Route Table

A Route Table contains set of rules which determines the direction of traffic. Each subnet in your VPC must have a route table. A subnet can associate only one route table but multiple sublets can associate same route table.

Network Access Control List

Network Access Control List is nothing but a firewall which controls inbound and outbound traffic of one or more subnets. A Network Access Control List can be attached to multiple subnets but a subnet can associate only one Network Access Control List, If you asscociate a second one, previous association will be removed. Network Access Control List permits “allow” and “deny” traffic and it is stateless.

Security Group

Security Group contains set of rules which controls inbound and outbound traffic of an EC2 instance.Security Group permits only “allow” rules and it is stateful

AWS - Virtual Private Cloud - Part1

Figure shown below is a very high level architecture diagram of an AWS Virtual Private Cloud (VPC)

Basic characteristics of an AWS VPC
-------------------------------------------------------------  
By default an AWS account can contain only 5 VPCs
VPC can't span across AWS regions.
VPC can span across multiple availability zone in the same region.
VPC can contain multiple subnets provided the CIDR is not overlapping.

AWS Services - Compute

Below are the compute services provided by AWS.

EC2 – Elastic Cloud Compute

EC2 is a webservice for compute capacity which can be provisioned based on your needs. Its basically a re-sizable virtual machine which can be utilized for various compute operations, hosting web applications etc.

Lightsail

AWS Lighsail provides the required infrastructure to deploy and manage websites, web applications and databases quickly and easily in cloud.

ECR – Elastic Container Registry

Elastic Container Registry is a highly available, secure and fully managed container repository provided by AWS to store container images. Its similar to github.

ECS – Elastic Container Service

Elastic Container Service is AWS provided platform for deploying managing and scaling docker containers. It is integrated with familiar AWS services like ELB, EBS, Security Groups & IAM roles.

EKS - Elastic Kubernetes Service.

Elastic Kubernetes Service is fully managed Kubernetes platform which you can provision and use.

Lambda

Lambda is AWS provided serverless architecture. You can place your code and trigger the code based on an event Lambda will run the code for you and you have to pay only for the compute time which your code consumes. Basically there is no change for the idle time of the code.

Batch

Batch is an AWS provided service to run you Batch workloads efficiently using EC2.

Elastic Beanstalk

Elastic Beanstalk is an AWS provided service for deploying applications. Applications can be easily deployed, monitored and scaled using Elastic Beanstalk.

Serverless Application Repository

AWS Serverless Application Repository is a powerful repository which enables to store and share reusable serverless applications.

Ten services of three popular cloud providers

Below listed are the ten important services of three leading cloud providers in the market.

Who - Types Of Identities in Google CloudIAM

There are four types of Identities in Google CloudIAM

Above figure displays the access restrictions of each identities.

Google Account :- Has access to both cloud console and API calls.

Service Account:- Console login is restricted for service accounts as the service account is only meant for API calls

G Suit Domain:- Has access restrictions to both cloud console and API calls

Google Groups:- Has access restrictions to both cloud console and API calls