AWS VPC — Virtual Private Cloud

VPC design, subnety, NAT Gateway, Transit Gateway a security groups.

VPC architektura

VPC: 10.0.0.0/16
├── Public Subnet AZ-a:  10.0.1.0/24  (IGW)
├── Public Subnet AZ-b:  10.0.2.0/24  (IGW)
├── Private Subnet AZ-a: 10.0.10.0/24 (NAT GW)
├── Private Subnet AZ-b: 10.0.20.0/24 (NAT GW)
├── Data Subnet AZ-a:    10.0.100.0/24 (isolated)
└── Data Subnet AZ-b:    10.0.200.0/24 (isolated)

Security Groups vs NACLs

• SG — stateful, allow-only, instance level
• NACL — stateless, allow+deny, subnet level, sekvenční

Transit Gateway

Hub-and-spoke pro propojení více VPC místo mesh peering. Až 5000 attachments.

Shrnutí

Správný VPC design = základ bezpečné AWS infra. Principle of least connectivity.