Amazon Virtual Private Cloud

1 Amazon Virtual Private CloudUser GuideAmazon Virtual Private Cloud User GuideAmazon Virtual Private Cloud : User GuideCopyright Amazon Web Services, Inc. and/or its affiliates. All rights 's trademarks and trade dress may not be used in connection with any product or service that is notAmazon's, in any manner that is likely to cause confusion among customers, or in any manner that disparages ordiscredits Amazon . All other trademarks not owned by Amazon are the property of their respective owners, who mayor may not be affiliated with, connected to, or sponsored by Virtual Private Cloud User GuideTable of ContentsWhat is Amazon VPC? .. 1 Access Amazon VPC .. 1 Pricing for Amazon VPC .. 1 How Amazon VPC works .. 2 VPCs and 2 Default and nondefault 2IP addressing .. 3 Compare IPv4 and IPv6 .. 3 Private IPv4 addresses .. 4 Public IPv4 addresses .. 4 IPv6 addresses .. 5 Use your own IP addresses .. 5 Route tables .. 6 Access the internet .. 6 Access a corporate or home network.

2 7 Connect VPCs and networks .. 7 AWS Private global network considerations .. 7 Get started .. 8 Prerequisites .. 8 Step 1: View information about your default VPC .. 8 Step 2: Launch an instance into your VPC .. 9 Step 3: Connect to an E2 instance in your public subnet .. 9 Step 4: Clean 10 Next steps .. 10 Virtual Private clouds .. 11 VPC 11 VPC 12 VPC sizing for 12 Manage IPv4 CIDR blocks for a 13 VPC sizing for 16 Work with VPCs .. 16 Create a VPC .. 16 View your VPCs .. 19 Associate a secondary IP address CIDR block with your VPC .. 20 Associate an IPv6 CIDR block with your VPC .. 20 Disassociate an IPv4 CIDR block from your VPC .. 21 Disassociate an IPv6 CIDR block from your VPC .. 21 Delete your VPC .. 22 Default 23 Default VPC components .. 23 Default 25 View your default VPC and default subnets .. 25 Create a default VPC .. 26 Create a default subnet .. 27 Delete your default subnets and default VPC .. 27 DHCP option 28 What is DHCP?.. 28 DHCP option set concepts.

3 29 Work with DHCP option sets .. 31 DNS attributes .. 35 Amazon DNS server .. 36 DNS 36 DNS attributes in your VPC .. 37 DNS 38iiiAmazon Virtual Private Cloud User GuideView DNS hostnames for your EC2 instance .. 38 View and update DNS attributes for your VPC .. 39 Private hosted zones .. 40 Share your VPC .. 40 Shared VPCs prerequisites .. 41 Share a subnet .. 41 Unshare a shared subnet .. 42 Identify the owner of a shared subnet .. 42 Shared subnets permissions .. 43 Billing and metering for the owner and participants .. 44 Example of sharing 44 Extend a VPC to another Zone .. 45 Extend your VPC resources to Local Zones .. 46 Extend your VPC resources to Wavelength Zones .. 49 Subnets in AWS Outposts .. 52 Subnet 52 Subnet types .. 52 Subnet settings .. 53 Subnet 53 Subnet 54 Subnet sizing for 55 Subnet routing .. 55 Subnet security .. 55 Work with subnets .. 55 Create a subnet in your VPC .. 56 View your subnets .. 57 Associate an IPv6 CIDR block with your subnet.

4 57 Disassociate an IPv6 CIDR block from your subnet .. 57 Modify the public IPv4 addressing attribute for your subnet .. 58 Modify the IPv6 addressing attribute for your subnet .. 58 Delete a 58 API and command overview .. 59 Subnet CIDR reservations .. 59 Work with subnet CIDR reservations using the console .. 60 Work with subnet CIDR reservations using the AWS CLI .. 60 Managed prefix lists .. 61 Prefix lists concepts and rules .. 61 Identity and access management for prefix lists .. 62 Work with customer-managed prefix lists .. 63 Work with AWS-managed prefix lists .. 67 Work with shared prefix lists .. 68 Route tables .. 71 Route table concepts .. 71 Subnet route tables .. 72 Gateway route tables .. 76 Route priority .. 78 Route table quotas .. 80 Example routing options .. 80 Work with route tables .. 88 Middlebox routing .. 95 Network ACLs .. 108 Network ACL basics .. 108 Network ACL rules .. 109 Default network ACL .. 109 Custom network ACL .. 110ivAmazon Virtual Private Cloud User GuideCustom network ACLs and other AWS services.

5 118 Ephemeral ports .. 119 Path MTU Discovery .. 119 Work with network ACLs .. 120 Example: Control access to instances in a subnet .. 123 Recommended rules for VPC scenarios .. 125 Connect your VPC .. 127 Internet gateways .. 127 Enable internet access .. 128 Access the internet from a subnet in your VPC .. 130 API and command overview .. 133 Elastic IP addresses .. 134 Egress-only internet gateways .. 138 Egress-only internet gateway basics .. 138 Work with egress-only internet gateways .. 139 API and CLI overview .. 141 NAT devices .. 141 NAT gateways .. 142 NAT instances .. 168 Compare NAT devices .. 175 AWS Transit Gateway .. 176 AWS Virtual Private Network .. 177 VPC peering connections .. 178 Examples using VPC peering and AWS PrivateLink .. 180 VPC Flow Logs .. 180 Flow logs basics .. 181 Flow log records .. 182 Flow log record examples .. 187 Flow log limitations .. 192 Flow logs pricing .. 192 Publish to CloudWatch Logs .. 193 Publish to Amazon S3 .. 197 Work with flow logs.

6 203 Query using Athena .. 207 Troubleshoot .. 210 Security .. 212 Data protection .. 212 Internetwork traffic privacy .. 213 Encryption in transit .. 215 Infrastructure security .. 215 Network isolation .. 215 Control network traffic .. 215 Identity and access management .. 216 Audience .. 216 Authenticate with 217 Manage access using policies .. 218 How Amazon VPC works with IAM .. 220 Policy examples .. 223 Troubleshoot .. 230 AWS managed policies .. 232 Security groups .. 233 Security group basics .. 233 Default security groups for your VPCs .. 234 Security group rules .. 235 Work with security groups .. 237 Work with security group rules .. 239vAmazon Virtual Private Cloud User GuideCentrally manage VPC security groups using AWS Firewall Manager .. 241 Resilience .. 242 Compliance validation .. 242 Configuration and vulnerability analysis .. 243 Best practices .. 243 Additional resources .. 244 Use with other services .. 245 AWS PrivateLink .. 245 AWS Network Firewall .. 246 Route 53 Resolver DNS Firewall.

7 246 Scenarios .. 248 VPC with a single public 248 Overview .. 248 Routing .. 251 Security .. 251 VPC with public and Private subnets (NAT) .. 258 Overview .. 259 Routing .. 262 Security .. 263 Implement scenario 2 .. 267 Recommended network ACL rules for a VPC with public and Private subnets (NAT) .. 267 VPC with public and Private subnets and AWS Site-to-Site VPN access .. 278 Overview .. 279 Routing .. 282 Security .. 284 Implement scenario 3 .. 287 Recommended network ACL rules for a VPC with public and Private subnets and AWS Site-to-Site VPN access .. 288 VPC with a Private subnet only and AWS Site-to-Site VPN access .. 298 Overview .. 299 Routing .. 300 Security .. 300 Tutorials .. 305 Tutorials using the AWS CLI .. 305 IPv4-enabled VPC and 305 Dual-stack VPC and 310 IPv6-enabled VPC and IPv6-only 318 Tutorials using the AWS Management Console .. 327 VPC that supports IPv6 addressing .. 327 Migrate existing VPCs from IPv4 to IPv6 .. 345 VPC and 345 Elastic IP addresses (IPv4).

8 345 Gateways .. 346 Customer-managed prefix lists .. 346 Network ACLs .. 347 Network interfaces .. 347 Route tables .. 347 Security groups .. 348 VPC peering connections .. 348 VPC 349 VPC 349 Amazon EC2 API throttling .. 350 Additional quota resources .. 350 Document history .. 351viAmazon Virtual Private Cloud User GuideAccess Amazon VPCWhat is Amazon VPC? Amazon Virtual Private Cloud ( Amazon VPC) enables you to launch AWS resources into a Virtual networkthat you've defined. This Virtual network closely resembles a traditional network that you'd operate inyour own data center, with the benefits of using the scalable infrastructure of Amazon VPCYou can create, access, and manage your VPCs using any of the following interfaces: AWS Management Console Provides a web interface that you can use to access your VPCs. AWS Command Line Interface (AWS CLI) Provides commands for a broad set of AWS services,including Amazon VPC, and is supported on Windows, Mac, and linux . For more information, see AWSC ommand Line Interface.

9 AWS SDKs Provides language-specific APIs and takes care of many of the connection details, suchas calculating signatures, handling request retries, and error handling. For more information, see AWSSDKs. Query API Provides low-level API actions that you call using HTTPS requests. Using the Query APIis the most direct way to access Amazon VPC, but it requires that your application handle low-leveldetails such as generating the hash to sign the request, and error handling. For more information, seeAmazon VPC actions in the Amazon EC2 API for Amazon VPCT here's no additional charge for using a VPC. There are charges for some VPC components, such as NATgateways, Reachability Analyzer, and traffic mirroring. For more information, see Amazon VPC Virtual Private Cloud User GuideVPCs and subnetsHow Amazon VPC worksAmazon Virtual Private Cloud ( Amazon VPC) enables you to launch AWS resources into a Virtual networkthat you've defined. This Virtual network closely resembles a traditional network that you'd operate inyour own data center, with the benefits of using the scalable infrastructure of VPCs and subnets (p.)

10 2) Default and nondefault VPCs (p. 2) IP addressing (p. 3) Route tables (p. 6) Access the internet (p. 6) Access a corporate or home network (p. 7) Connect VPCs and networks (p. 7) AWS Private global network considerations (p. 7)VPCs and subnetsA Virtual Private Cloud (VPC) is a Virtual network dedicated to your AWS account. It is logically isolatedfrom other Virtual networks in the AWS Cloud . You can launch your AWS resources, such as Amazon EC2instances, into your VPC. You can specify an IP address range for the VPC, add subnets, associate securitygroups, and configure route subnet is a range of IP addresses in your VPC. You can launch AWS resources into a specified a public subnet for resources that must be connected to the internet, and a Private subnet forresources that won't be connected to the more VPC basics (p. 11) Subnet basics (p. 52) Internetwork traffic privacy in Amazon VPC (p. 213) IP addressing (p. 3)Default and nondefault VPCsIf your account was created after 2013-12-04, it comes with a default VPC that has a default subnet ineach Availability Zone.