- Alright, so let's take a look
at Amazon Virtual Private Cloud.
Amazon Virtual Private Cloud
is a way to give us essentially
our own private networks within Amazon Web Services.
Typically our applications
need some kind of predictable IP address range.
We need to know where they're gonna fall.
When these machines come up,
we need to know the kinds of ranges
that they're going to get so that we can determine
routing and firewalling rules.
We want to segment our networks,
in terms of: some networks need access to the internet,
meaning they need to be public.
Some networks need to remain private.
We only want them to be available
either internally or via some kind of VPN,
or between different, private networks.
We need the ability to control what ports are open
and what ports are closed.
So in the case of a web server,
let's say that we have some kind of a web application
running on an EC2 instance, then we might want to
allow common http and https ports to be open.
Our database should probably allow port 3306 open,
but we want to block all other ports
from this untrusted network.
So, we need the ability to allow our web application
to receive public traffic.
But we might also want to keep this database private,
and not allow access directly from the internet.
And, we can do that, and more
with Amazon Virtual Private Cloud.
So with Amazon Virtual Private Cloud,
what we would do is we would create
a VPC in a particular region.
We're going to choose--
in this case we're using us-west-2 in Oregon.
And we're going to, at the time we create that VPC,
we're going to choose a particular address range.
Now, in this particular example we're using 10.2.0.0/16.
So that's a pretty large range,
that's the largest range
that we can choose within Amazon Web Services.
We can go as small as a slash 28 as well.
So, it's important to note that,
when we divide this network up into subnets,
you can see here we have three subnets,
one per availability zone,
that subnets are specific to availability zones.
The VPC itself will span the entire region,
but a subnet will be specific to an availability zone.
So when we go to launch virtual machines,
we don't choose the availability zone directly,
we choose the subnet we want that machine to be in.
And through this subnet and the availability zone
association is how we determine
where that machine will actually be launched.
So you can see here, that when we create subnets,
we have to be sure that our subnets don't have
any kind of IP address overlap.
So our first one would be 10.2.0.0/24
that would give us somewhere around 250 usable IP addresses.
The next one is 10.2.1.0/24,
so again we want to make sure here,
that we're not getting an IP address overlap.
And of course the last one,
you can see we chose a slightly different range,
with a slash 28.
Perhaps we want web and application servers up here,
in these subnets.
And we might reserve the last one for databases,
and we don't really need that many IP addresses,
so we chose a smaller range.
So again, Amazon Virtual Private Cloud
is a networking construct.
It allows us to create private networks.
It allows us to divide those networks into subnets,
whereas, each subnet is specific to an availability zone,
and the VPC itself spans the entire region.