- Now let's talk about public, private
and hybrid subnets within Amazon VPC.
So, earlier we talked about routing
and how routing allows the flow of traffic
between different ranges of IP addresses.
And so, within Amazon VPC earlier we talked
about using an internet gateway and a route
to the internet gateway to allow communication
from a device in a subnet through the internet gateway
and to the internet, and so by doing that,
by creating that route, we then essentially create
a subnet here, this particular subnet would
then be considered public because the devices
in that network have both direct access
to and from the internet.
Any device within this particular subnet,
so long as it has a public IP address,
it would be reachable from the internet,
and so we could then again call this subnet public.
And so, generally when we're talking with other folks
working with AWS, if talk with Amazon solution architects
and we describe to them that we have
a public subnet, you are essentially implying
that that subnet has a route to the internet
through an internet gateway.
We also, in many cases, have application servers,
like here, for example, we have this EC2 instance
that has an application running on it,
and perhaps for some reason that instance needs
to reach the internet in order to, perhaps,
download code from GitHub or make calls
to a logging service like Loggly or call
to some third party configuration management service.
Whatever the case may be, it's very often that
we have application servers that need to reach
out to the internet and get the responses back,
but at the same time, we want them to remain private.
We don't want someone on the internet reaching in.
We kind of want one-way internet access.
And in order to do that, we can use Network Address
Translation and you'll notice here that we have
a second route table and this route table,
being associated with this particular subnet,
we have a route that says for every other IP address,
aside from 10.2.0.0/16, we want to route those
through the Network Address Translation gateway,
or the NAT gateway, and so what that would do
is so, if this instance were communicating
with the database, then the traffic would simply talk
to the database because of the local route.
But if this instance needed to call out
to the internet in order to, like I mentioned,
to download code from GitHub or what have you,
the request would first go through the NAT gateway,
and the NAT gateway would then translate.
The reason we call it Network Address Translation
is because it would translate the private IP
of this instance into a public IP that would allow
the NAT gateway to talk to the internet,
and then when those responses come back
from the internet, the NAT gateway
then forwards those responses back to the instance.
So that way the instance has the ability
to reach out to the internet, get its responses,
but it also remains protected from host
potentially malicious activity on the internet
trying to get in.
There's no way, in this particular diagram,
there's no way for someone on the internet
to actually get into the instance directly.
So these two networks would be, we would have
a, this subnet, again, would be public,
and then using these mechanisms that we just talked about,
the NAT gateway and the routing table,
this particular subnet we could call hybrid.
It has some limited access to the internet
while also remaining private, right?
So, again, if you were talking with an Amazon solutions
architect and you described having a hybrid subnet,
you would be implying that that subnet communicates
to the internet through Network Address Translation.
And then, of course, back here we have
our database in a private subnet.
It is truly private.
According to this diagram, this particular subnet
over here can only communicate
with other subnets in the VPC.
There's no way, according to this diagram,
there is no way for this particular subnet
to communicate to the internet, not through
the gateway directly, not through Network Address
Translation, it is truly private.
And so, for databases and for perhaps
sensitive information, that's exactly what we want.
We don't want any way for these particular
servers to be compromised, right?
And so, when we think about running networks
within Amazon VPC, we need to keep in mind
that there are ways for us to reach the internet directly.
There are ways to reach the internet
in a protected kind of way through Network
Address Translation and then of course,
we also have the ability to keep certain subnets
and certain parts of our network completely private.