VPC、子网与路由表

Welcome to AWS Networking! Just like your home or office network, applications in the cloud need a way to communicate securely.

AWS provides a service called Virtual Private Cloud (VPC). It's your own isolated network space in the AWS cloud where you can launch resources like EC2 instances.

A VPC is a logically isolated section of the AWS Cloud. Think of it as your own private data center, but virtual!

• You define its IP address range (a CIDR block).
• It's completely isolated from other AWS customers' VPCs.
• You have full control over your virtual networking environment.

When you create a VPC, you assign it an IPv4 CIDR block. This is a range of private IP addresses that your resources within the VPC will use.

A common choice is a /16 CIDR block, like 10.0.0.0/16. This gives you over 65,000 private IP addresses to work with!

CIDR (Classless Inter-Domain Routing) is a standard for allocating IP addresses.

When you first create an AWS account, a Default VPC is automatically provisioned in each region. It's pre-configured to get you started quickly.

However, for most real-world applications, you'll want to create a Custom VPC. This gives you more control over your network topology, IP ranges, and security settings.

A subnet is a range of IP addresses within your VPC. Think of them as smaller sections or segments of your private network.

You create subnets to organize your resources and enhance security. For example, you might have one subnet for web servers and another for databases.

Subnets can be either public or private:

• Public Subnet: Resources in a public subnet can access the internet directly via an Internet Gateway.
• Private Subnet: Resources in a private subnet cannot directly access the internet. They are typically used for databases or internal application servers that need more isolation.

An important concept: each subnet you create must reside entirely within a single Availability Zone (AZ).

This means if you want your application to be highly available across multiple AZs, you'll need to create a separate subnet in each AZ you plan to use.

A route table contains a set of rules, called routes, that determine where network traffic from your subnet or gateway is directed.

Each subnet in your VPC must be associated with a route table. This association dictates how traffic flows in and out of that subnet.

Every route table has a 'local' route by default, allowing communication within the VPC.

To enable internet access for a public subnet, you add a route to an Internet Gateway (IGW). The IGW connects your VPC to the internet.

Private subnets often use a NAT Gateway or NAT instance to send outbound internet traffic while remaining unreachable from the internet.

In this lesson, you learned about the core components of AWS networking:

• VPC: Your isolated virtual network.
• Subnets: Divisions within your VPC, residing in a single AZ, categorized as public or private.
• Route Tables: Rules that direct traffic from your subnets.
• Internet Gateway: Connects your public subnets to the internet.

Mastering these concepts is crucial for building robust and secure cloud architectures!