Advanced VPC Design and New Capabilities for Amazon VPC (NET303) - AWS re:Invent 2018

© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Advanced VPC Design and New
Capabilities for Amazon VPC
Matt Lehwess
Principal Solutions Architect
Amazon Web Services
N E T 3 0 3

336402
4.9
T h ank y o u
35
H o w o l d H o w m a n y
a n i mations
403404405406

Previously, from AWS
AWS Region
Availability zone 2Availability zone 1
Private subnet Private subnet
Public subnet Public subnet
VPC CIDR 10.1.0.0/16 + Expand + IPv6

AWS Lambda
AWS Region
Private subnet
VGW
VPC
Peering
VPC
Flow Logs
VPN
AWS Direct
Connect
The
Internet
Private subnet
Public subnet
Instance A
Public subnet
AWS IoTAmazon
DynamoDB
Amazon S3 Amazon SQS Amazon SNS
VPC CIDR 10.1.0.0/16
10.1.0.11/24
Instance B
10.1.1.11/24
Instance C
10.1.2.11/24
Instance D
10.1.3.11/24
DXGW
+ Expand + IPv6
IGWVPCE
10.1.0.0/16 Local
0.0.0.0/0 IGW
S3.prefix.list VPCE-123
On-premises VGW
VPC-B PCX-123
Destination Target Intra or
Inter
region
10.1.0.0/16 Local
0.0.0.0/0 Instance B
On-premises VGW
VPC-B PCX-123
Destination Target
AWS PrivateLink
Service Provider VPC
NLB
AWS
PrivateLink
NAT
On-Premises
VPC-B
EIP - 10.1.0.11 : 54.23.12.43
EIP - 10.1.1.11 : 54.19.12.23
NAT-GW
NAT-GW

AWS Region
Public subnet
Instance A
Public subnet
VPC CIDR 10.1.0.0/16
10.1.0.11/24
Instance B
10.1.1.11/24
Instance C
10.1.2.11/24
Instance D
10.1.3.11/24
+ Expand + IPv6
10.1.0.0/16 Local
0.0.0.0/0 IGW
On-premises VGW
VPC-B PCX-123
Destination Target
10.1.0.0/16 Local
0.0.0.0/0 Instance B
On-premises VGW
VPC-B PCX-123
Destination Target
AWS PrivateLink
Service Provider VPC
NLB
AWS
PrivateLink
NAT NAT-GW
NAT-GW
• API Endpoints for Amazon EC2
and Elastic Load Balancing (ELB)
• Amazon Kinesis Data Streams
• AWS Service Catalog
• Amazon EC2 Systems Manager

AWS PrivateLink:
• PrivateLink is a way to
reach additional public
services, privately from
your Amazon Virtual
Private Cloud (Amazon
VPC)
• Each PrivateLink is
represented by a private
IP from the subnet
assigned
• API Endpoints for Amazon EC2
and Elastic Load Balancing (ELB)
• Amazon Kinesis Streams
• AWS Service Catalog
• Amazon EC2 Systems Manager• No Route Table
update required
Amazon S3
Amazon DynamoDB
After: VPC Endpoints for Amazon Simple
Storage Service (Amazon S3) and Amazon
DynamoDB
Before:

AWS Region
Public subnet
Instance A
Public subnet
VPC CIDR 10.1.0.0/16
10.1.0.11/24
Instance B
10.1.1.11/24
Instance C
10.1.2.11/24
Instance D
10.1.3.11/24
+ Expand + IPv6
NAT NAT-GW
AmazonAPIGateway
AWSCloudFormation
AmazonCloudWatch
AmazonCloudWatchEvents
AmazonCloudWatchLogs
AWSCodeBuild
AWSConfig
AmazonEC2API
ElasticLoadBalancingAPI
AWSKeyManagementService
AmazonKinesisDataStreams
AmazonSageMakerRuntime
AWSSecretsManager
AWSSecurityTokenService
AWSServiceCatalog
AmazonSNS
AWSSystemsManager
+More
After: 18 services now supported over
AWS PrivateLink

AWS PrivateLink (additional endpoints):
https://amzn.to/2TTHxXh

Bonus: AWS PrivateLink now supports access
over AWS VPN and Inter-region Peering
V P N: h t t ps :// amz n.to /2Iv0U Ao
I n t er - re gio n P e e r i ng:
h t t ps:// am z n.to /2NB TFI0

Amazon VPC Sharing
Before

L l a m a
10.3.0.0/16
P e g a s u s
10.2.0.0/16
B a r r y
10.1.0.0/16
I g u a n a
10.6.0.0/16
S t e v e
10.5.0.0/16
S u e
10.4.0.0/16
AWS Lambda Amazon EC2
Amazon RedshiftAmazon RDS
Amazon EC2
Amazon EC2
Prod 1Dev
Test
Prod2
Prod 3 Prod 4

Amazon VPC Sharing
After

L l a m aP e g a s u s
10.2.0.0/16
B a r r y
10.1.0.0/16
I g u a n aS t e v eS u e
AWS Lambda Amazon EC2
Amazon RedshiftAmazon RDS
Amazon EC2
Amazon EC2
Prod 1Dev
Test
Prod2
Prod 3 Prod 4
Owner
Participant
Owner
Participant Participant
Participant

Amazon VPC owners are responsible for creating, managing
and deleting all VPC level entities.
Amazon VPC owners cannot modify or delete participant
resources.
Amazon VPC Owner

Participants that are in a shared Amazon VPC are responsible for the creation,
management and deletion of their resources including Amazon Elastic Compute
Cloud (Amazon EC2) instances, Amazon Relational Database Service (Amazon
RDS) databases, and load balancers.
However, they cannot modify any Amazon VPC-level entities including route
tables, network ACLs or subnets (Or view / modify resources belonging to other
participants).
Amazon VPC Participant

Why use multiple accounts?

Why use Amazon VPC sharing?
P r e s erve I P s p a c e
U s e f e w e r I P v 4 C I D Rs
I n t erc onnec tiv ity
N o V P C P e e r i ng r e quired
B i l l i n g a n d S e c u r i t y
C o n t i n u e t o e n j o y s e g r e g a t i o n
w i t h m u l t i p l e a c c o u n t s
S e p a r a t i o n o f d u t i e s
A c e n t r a l t e a m c a n c r e a t e a n d
m a n a g e y o u r A m a z o n V P C
S a m e A Z c o s t f o r d a t a t r a n s f e r i s n i l !

Amazon VPC Sharing details:
https://amzn.to/2Aovw2Z

Before

AWS Region 1 AWS Region 2

After

AWS Region 1 AWS Region 2
3.10.3.1253.10.3.125

Client StateAWS’s Global
Network
Static Anycast
IP’s
Applications can keep state,
with connections routed to
the same endpoint, after
initial connection.
Traffic routed through
Accelerator traverses AWS
global network (instead of
the public internet).
Global Accelerator uses
Static IP addresses are a
fixed entry point to your
applications. These IP
addresses are anycast from
AWS edge locations

AWS Global Accelerator
https://amzn.to/2FI3y89

Amazon Route 53 Resolver for
Hybrid Clouds
https://amzn.to/2ByEw7s
Bonus!

On-Premises
IPsec Tunnel 1 - Primary
IPsec Tunnel 2- Secondary
Virtual private
gateway
VGW
IPSEC tunnel over
the internet
Customer
gateway
CGW
The Internet

Before AWS Client VPN
VPC VPN connections were site-to-site only

How does this change my
architecture?

After AWS Client VPN
AWS now supports client-to-site VPN termination
with Open VPN clients through the Client VPN
Endpoint

Attachment
to Amazon
VPC
TLS based tunnel
over the internet
User with Open
VPN Client
Client VPN
Endpoint
Client
The
InternetAmazon
DynamoDB
Amazon S3
On-Premises

AWS Secure Connect
Friday, November 30th
NET304 - AWS VPN Solutions
10:45 AM - 11:45 AM | Venetian, Level 2, Venetian F

Where do you use public IP’s in
AWS?

AWS Lambda
AWS Region
Public subnet
Instance A
Public subnet
AWS IoTAmazon
DynamoDB
Amazon S3 Amazon SQS Amazon SNS
VPC CIDR 10.1.0.0/16
10.1.0.11/24
Instance B
10.1.1.11/24
Instance C
10.1.2.11/24
Instance D
10.1.3.11/24
+ Expand + IPv6
IGW
NAT
10.1.0.11 : 54.23.12.43
10.1.1.11 : 54.19.12.23
NAT-GW
The
Internet

Why bring your own?
IP Reputation, Whitelisting, Migration,
Redundancy,

How does BYOIP it work?

Network Load
Balancer
The Internet
IGW
On-Premises
130.137.182.0/24130.137.182.0/24IP Pool
130.137.182.4 : 10.0.0.15
130.137.182.5 : 10.0.0.16
130.137.182.6 : 10.0.0.17
NAT GW
10.0.0.15 10.0.0.16 10.0.0.17
BYOIP

Authorization and
Authentication
5 s t e p s
Provisioning your IP
range
T h r o u g h t h e A m a z o n C L I

Advertising your IP
range
T h r o u g h t h e A m a z o n C L I
Creation and use of
Elastic IPs
F r o m y o u r I P p o o l

130.137.182.166

BYOIP Detailed Instructions:
https://amzn.to/2qZeyE3

What is the most specific prefix I can bring via BYOIP?
/24
Can I move a CIDR between regions?
Yes – with de-provisioning and re-provisioning
IPv6? Not yet 

Before: All public IP addresses used in AWS came
from Amazon’s IP ranges
After: You can now bring the IP ranges you know
and love to AWS.

Transit Gateway (TGW)

1
3
2 4
B Local
A
C PCX-2
D PCX-3
E PCX-4
Destination Target
A B
C
D E
PCX-1
Before: V PC Peering

Full mesh: How many Amazon VPC Peering
connections do I need (full mesh)?
n(n-1)
2
VPC x 10

10(10-1)
2
VPC x 10

VPC x 10
45

100(100-1)
2
VPC x 100

VPC x 100
4500

Static routes per
Amazon VPC route table
100
Amazon VPC Peering
connections per Amazon VPC
125

B Local
0.0.0.0/0
Destination Target
A B
D E
VGW
Before: Transit V PC with IPSec
I P S e c b e t w e e n V P C s ( l i m i t s a p p l y )

A
B
C
On-Premises
Before: V PN Connection per V PC

After: AWS Tra n sit Ga t ewa y (TGW)
AWS Transit Gateway
(TGW)

B Local
0.0.0.0/0
Destination Target
A B
TGW
C
TGW
1 2
3 4
TGW Route Table(s)
VPC A : Attachment 1
VPC B : Attachment 2
VPC C : Attachment 3
On-prem : VPN 4
RT1
RT2
On-Premises

Attachment
The connection from a
Amazon VPC and VPN to
a TGW
Association
The route table used to
route packets coming from
an attachment (from an
Amazon VPC and VPN)
Propagation
The route table where the
attachment’s routes are
installed

Llama
TGW
X
Y
TGW Route Table(s)
Associations
RT1
Z
Propagations
Pegasus from Y
Llama from X
Pegasus from Y
Llama from X
10.1.0.0/16
Pegasus
10.2.0.0/16
Barry
10.3.0.0/16
Barry from Z Barry from Z
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
10.3.0.0/16 via Z
10.1.0.0/16 Local
0.0.0.0/0 TGW
Destination Target
10.1.0.0/16 Local
0.0.0.0/0 IGW
Destination Target
10.0.0.0/8 TGW

Llama
TGW
X
Y
TGW Route Table(s)
Associations
RT1
Z
Propagations
Pegasus from Y
Llama from X
Pegasus from Y
Llama from X
10.1.0.0/16
Pegasus
10.2.0.0/16
Barry
10.3.0.0/16
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
10.3.0.0/16 via Z
10.8.0.0/16 10.9.0.0/16
10.8.0.0/16 via X
10.9.0.0/16 via X

Llama
TGW
X
Y
TGW Route Table(s)
Associations
RT1
Z
Propagations
Pegasus from Y
Llama from X
Pegasus from Y
Llama from X
10.1.0.0/16
Pegasus
10.2.0.0/16
Barry
10.3.0.0/16
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
10.3.0.0/16 via Z
10.8.0.0/16 10.9.0.0/16
10.8.0.0/16 via X
10.9.0.0/16 via X
Propagation turned off, you can still
statically configure routes

Llama
TGW
X
Y
TGW Route Table(s)
Z
10.1.0.0/16
Pegasus
10.2.0.0/16
Barry
10.3.0.0/16
O n - P r e m i s e s
Q
RT1
RT2
RT3
Associations
RT1
Propagations
Pegasus from Y
Llama from X
Pegasus from Y
Llama from X
On-prem from Q
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
172.16.0.0/16 via Q
Associations
RT2
Propagations
On-prem from Q
Barry from ZBarry from Z
Routes
172.16.0.0/16 via Q
10.3.0.0/16 via X
Associations
RT3
Propagations
On-prem from Q
Llama from X
On-prem from Q
Pegasus from Y
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
10.3.0.0/16 via ZBarry from Z
172.16.0.0/16
172.16.0.0/16 via Q

Llama
TGW
X
Y
TGW Route Table(s)
Z
10.1.0.0/16
Pegasus
10.2.0.0/16
Barry
10.3.0.0/16
Q
RT1
RT2
RT3
Associations
RT1
Propagations
Pegasus from Y
Llama from X
Pegasus from Y
Llama from X
On-prem from Q
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
172.16.0.0/16 via Q
Associations
RT2
Propagations
On-prem from Q
Routes
172.16.0.0/16 via Q
10.3.0.0/16 via X
Associations
RT3
Propagations
On-prem from Q
Llama from X
On-prem from Q
Pegasus from Y
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
172.16.0.0/16
172.16.0.0/16 via Q
Packet
SRCLlama
DSTOn-prem

Llama
TGW
X
Y
TGW Route Table(s)
Z
10.1.0.0/16
Pegasus
10.2.0.0/16
Barry
10.3.0.0/16
Q
RT1
RT2
RT3
Associations
RT1
Propagations
Pegasus from Y
Llama from X
Pegasus from Y
Llama from X
On-prem from Q
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
172.16.0.0/16 via Q
Associations
RT2
Propagations
On-prem from Q
Routes
172.16.0.0/16 via Q
10.3.0.0/16 via X
Associations
RT3
Propagations
On-prem from Q
Llama from X
On-prem from Q
Pegasus from Y
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
172.16.0.0/16
172.16.0.0/16 via Q
Packet
SRC:Barry
DSTOn-prem

Llama
TGW
X
Y
TGW Route Table(s)
Z
10.1.0.0/16
Pegasus
10.2.0.0/16
Barry
10.3.0.0/16
Q
RT1
RT2
RT3
Associations
RT1
Propagations
Pegasus from Y
Llama from X
Pegasus from Y
Llama from X
On-prem from Q
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
172.16.0.0/16 via Q
Associations
RT2
Propagations
On-prem from Q
Routes
172.16.0.0/16 via Q
10.3.0.0/16 via X
Associations
RT3
Propagations
On-prem from Q
Llama from X
On-prem from Q
Pegasus from Y
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
172.16.0.0/16
172.16.0.0/16 via Q
Packet
SRCBarry
DSTOn-prem

Aft er: AWS Transit Gateway (TGW) – The console

Unicorn TGW
This TGW is Awesome
Aft er: AWS Transit Gateway (TGW) – The console

TGWs per account / TGW
attachments per Amazon VPC
5
Maximum burstable
bandwidth per attachment
50Gbps*
*Per availability zone

Maximum bandwidth per VPN
connection
1.25Gbps
*With ECMP, you can distribute traffic over multiple tunnels,
e.g. 8 tunnels = 10Gbps
*

Routes per TGW
5,000
Number of TGW attachments
per region per account
1,000
!!!

Cross region connectivity?
TGW is a region-level construct
today

Before TGW

Amazon VPC Peering for
full mesh connectivity
VPC
VPC
VPC
A
B
C
On-Premises
Instance based
Transit Amazon VPC
VPN Connection
per Amazon VPC

After TGW
Up to 5000 Amazon VPC
attachments per TGW
1.25Gbps per VPN Connection
with ECMP
10,000 routes per TGW
Multiple TGW route tables for
finer routing control
50 Gbps of bandwidth per
attachment per availability zone
Centralized hub for routing between
Amazon VPCs and on-premises to AWS

TGW Detailed Instructions:
https://amzn.to/2SkI4zV

Network performance improvements for
Amazon EC2
https://amzn.to/2DL0qG6

AWS Direct Connect
Logical redundancy over a single
private virtual interface
https://amzn.to/2E0DgfA

AWS Direct Connect
Jumbo frame support
https://amzn.to/2q04aew

Flow Logs can now be delivered to
Amazon s3
https://amzn.to/2nt36yV

Thank you!
Matt Lehwess
mattyloo@amazon.com

Time: 15 minutes after this session
Location: Speaker Lounge (ARIA East, Level 1, Willow Lounge)
Duration: 30 min.

Advanced VPC Design and New Capabilities for Amazon VPC (NET303) - AWS re:Invent 2018

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Advanced VPC Design and New Capabilities for Amazon VPC (NET303) - AWS re:Invent 2018

Similar to Advanced VPC Design and New Capabilities for Amazon VPC (NET303) - AWS re:Invent 2018 (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Advanced VPC Design and New Capabilities for Amazon VPC (NET303) - AWS re:Invent 2018