AWS re:Invent 2017: Another Day, Another Billion Flows (NET405)
Why Stack Overflow recommends it
Stack Overflow users link it when they want to understand how AWS VPC, PrivateLink and endpoints work under the hood, beyond what the docs and console show.
Recommended by 2 people across 2 different months, 2018 to 2023.
What it is
A 2017 AWS re:Invent session that explains how the Amazon VPC network is built and how it scales. It covers customer isolation, getting packets into and out of the network, and features such as NAT and VPC endpoints, and it is presented by AWS network engineers.
What people said
Recommends John Rotenstein · 2020-09 · Stack Overflow · on “AWS VPC: How does route table redirect local traffic to the right subnet and instance?”
Amazon VPC is a virtualized network , also known as a software-defined network . Behind-the-scenes, VPC traffic is encapsulated and transferred across 'normal' network equipment, but the VPC defines a simplified set of rules that allow a network to be provisioned through clicks and API calls rather than connecting and configuring equipment. The simple answer to your questions is... It doesn't matter. As long as the network behaves correctly for how it has been configured, the implementation details are irrelevant. If you are interested in learning how networks in general operate, then I would recommend learning about Ethernet, TCP/IP and network routers. A VPC is higher-layer implementation
Recommends user6572625 · 2023-10 · Stack Overflow · on “How does privatelink work under the hood with hyperplane and blackfoot edge devices?”
I know the basics of privatelink and how it creates an ENI inside the VPC which can be resolved from a service outside the VPC. I want to understand how it truly works under the hood by steps, but can't wrap my head around it all. After digging, I found this talk [this video] , but I can't organize all the steps that actually happen easily. So how I see it is, The VPC creates the ENI To talk to another service, it goes through "the AWS network(I don't know how exactly)" which decides that's a hyperplane node job (somehow) Hyperplane then routes that to the blackedge devices, who gets the physical info of the src/destination and makes the connection There are a lot of incomprehension and blackboxe
Cites Michael - sqlbot · 2018-10 · Stack Overflow · on “aws traceroute btw two ec2 returns ***as first hop”
When two EC2 machines in the same region communicate using their public IP addresses, the traffic goes through the Internet Gateway, which doesn't respond to your traceroute. The number of hops is always 2 but this isn't meaningful information. The network isn't an Ethernet network built of switches and routers like you'd find in your local data center. There are switches and routers, of course, but not in the sense you would assume... the entire network you see is a "software-defined" network, emulated on top of another, invisible network. In overly simplified terms, everything is a series of tunnels, and nature of tunnels prevents visibility of the networks actually transporting the tunnel
Cites Martin Löper · 2020-08 · Stack Overflow · on “Why is it that an NLB in AWS does not require a Security Group?”
I guess a security group is not required for a Network Load Balancer (NLB) because it behaves transparently by preserving the source IP for the associated target instances. That is, you can still specify security groups - but at the target level directly instead of the load balancer. So conceptually , it does not make much of a difference (when using EC2 instances behind an NLB) where the SGs are specified. Although, some people point out it might be tricky to restrict the IP range for the NLB health check. [1] Moreover, I think it might be more convenient to specify security group rules once (centrally) at the load balancer instead of attaching a specific security group to each EC2 instance
Cites VenVig · 2023-01 · Stack Overflow · on “Why are s3 gateway endpoints free”
I have an Ec2 instance in a public subnet and would be uploading data to an s3 bucket. I understand that while this traffic traverses the internet gateway, it does not leave the AWS network Reference: [LINK] Now I am creating a s3 gateway end point (modify the route table to send traffic thru this). I also try creating a s3 interface end point. I measure that the time it takes to upload a 250MB file is the same in both cases (gateway endpoint and interface endpoint) I am unable to understand two points: If traffic does NOT leave the AWS network even though Internet gateway is used, in this case, is there any security benefit ? When using privatelink, I understand that the traffic goes thru H