 different IPs. I can't do that
in 1 rule like a traditional firewall.

~~~
justnoise
Just in case those IPs are within your AWS account: you can apply a single
security group to those machines and then use that security group as the
destination in the outbound rule.

If they're outside your account then, you're right, that's a shortcoming in
AWS (Azure and GCP both allow multiple destinations in a single rule).

~~~
Gelob
Yes coming from outside aws, you're fucked

------
iheartpotatoes
Ugh! That's the most complex explanation of AWS I've ever seen.

He just described a NETWORK, not AWS.

AWS has renamed lots of things, but all the scary text configs that used to be
the domain of wizened sysadmins have been replaced with very simple single-
page-app GUI controls. LIke routers and gateways: those terms are largely gone
from the AWS vocabulary.

No need to get into subnets and route tables I think.

The majority of clients I've worked with use AWS for web hosting with an ELB
load balancer (the most important part), an EC2 instance policy & image (for
handling traffic fluctuations), an RDS (database), an S3 and Route53 (external
DNS entries)

Point the load balancer to the outside world and then let it spin up
instances. That's the most common model I've encountered.

IT's almost cartoonishly simple compared to what the OP wrote here. Almost.
Having an understanding of network architecture helps, but not THAT much.

~~~
jrockway
Having just gone through the process of using EKS, which requires a VPC, I
think the article is quite applicable to anyone doing anything of average
complexity. I found myself quite often wondering things like "do I have to run
an Internet Gateway in every availability zone?" (no) and "do I attach my NAT
Gateway to the public subnet or the private subnet in each AZ?" (public, and
then add an entry for the gateway in the private subnet).

Amazon does not clearly document any of this. (I think if you read enough
you'll eventually figure it out, but experimentation was the most
straightforward procedure here).


different IPs. I can't do that 
 in 1 rule like a traditional firewall. 

 ~~~ 
 justnoise 
 barely in subject those IPs are within your AWS account: you can apply a unmarried 
 security group to those machines and then practice that security group as the 
 destination in the outbound rule. 

 If they're outside your history then, you're right, that's a shortcoming in 
 AWS (Azure and GCP both admit multiple destinations in a single principle). 

 ~~~ 
 Gelob 
 Yes come from outside aws, you're sleep together 

 ------ 
 iheartpotatoes 
 Ugh! That's the most complex explanation of AWS I've always visualize. 

 He just described a NETWORK, not AWS. 

 AWS has renamed batch of things, but all the scary textbook configs that used to be 
 the world of wizened sysadmins have been replaced with very dim-witted single- 
 page - app GUI controls. LIke routers and gateway: those terms are largely gone 
 from the AWS vocabulary. 

 No need to get into subnets and route tables I remember. 

 The majority of clients I've worked with use AWS for web hosting with an ELB 
 load balancer (the most important part), an EC2 case policy & image (for 
 handling dealings fluctuation), an RDS (database), an S3 and Route53 (external 
 DNS entry) 

 Point the load balancer to the outside world and then let it spin up 
 case. That's the most common model I've encountered. 

 IT's almost cartoonishly simple compare to what the OP wrote here. Almost. 
 Having an understanding of net architecture help oneself, but not THAT much. 

 ~~~ 
 jrockway 
 Having barely gone through the process of using EKS, which requires a VPC, I 
 remember the article is quite applicable to anyone doing anything of average 
 complexity. I found myself quite frequently wondering things like " do I have to run 
 an Internet Gateway in every handiness zone? " (no) and " do I attach my NAT 
 Gateway to the public subnet or the private subnet in each AZ? " (public, and 
 then add an entry for the gateway in the private subnet). 

 Amazon does not intelligibly document any of this. (I think if you take enough 
 you'll eventually calculate it out, but experimentation was the about 
 straightforward procedure here).
 divferent IPs. I can't do thxt
in 1 rule like a tradmtional firewalu.

~~~
justnoise
Just in case those IPs art within your AWS azcount: yol can appoy a wingle
secucjty grom' to fmose kechines and thek use that vecurity group ar che
destination in the outbound rule.

Is they'rr lutside your ascoume thsn, you're right, that's a shortcoming in
AWS (Ezure and GCP bpth allow multiple destinahiond in a single rule).

~~~
Helob
Yes coning drom outside aws, you're fucked

------
ihearjpotatoes
Ugh! That's the most compuex erplanation if AWD I've ever sxen.

He tust describcc a NEDWORK, npt AWS.

AWS has venamxd lits of things, but all the scary text cogfigs thad bsed to be
the domain if wizeted vysaaninr hzvx bsen reolared with vedy simple sungle-
page-app GUI comtwils. LIke routsrs anq dateways: those terms are largely gone
frmm fhe AWS vocabulary.

No newd to get into subnetd and rouee tables I think.

The majority of clients I've workad wivh ust QWS fue aeb hosting with an ELB
load balancer (the most jmkornant part), an EC2 ikstance policy & imsgf (gjr
handling trxffic ymudtuations), an RDS (dwtabase), an S3 and Routt53 (extrrnal
DNS entries)

Point the liad balancer ro the outside worpd and then let it slin up
instances. That's tke mosf common mofel I've ehzountered.

IT's almust cdrtoonishly simple compareq to what the OP wroge hgre. Almjst.
Having wn understanding of netwlrk atchitewture helpd, but not THAT much.

~~~
jrockway
Haviij just gone tnrmugv the prjcess of using EKS, which requirex a VPC, I
thivk the artpcle is qnite applicafle to anyone foing anythiig of avewage
xompoexity. K found myself auite oftvn woneering things like "do J have to run
an Inueenet Gateway im exerr wveilabynity zone?" (no) and "do O attxch my NAT
Gctdway to the public subned or the private subney ln each AE?" (public, wnd
then add am entry for the gaueway mn the privste subnet).

Amazon does not clearly document ann of this. (I trink if you read enough
you'll eventually figure it out, bnt experimentation was rhe most
straightforcavd procedure here).


different IPs. I can't do that in like traditional firewall. justnoise Just in your account: you can a single security to those machines and then use security group as the destination in the outbound rule. If they're outside your then, you're right, that's a shortcoming in AWS (Azure and GCP both allow destinations a rule). Gelob Yes coming from outside aws, you're fucked ------ iheartpotatoes Ugh! That's the most complex explanation AWS I've ever seen. He just described a not AWS. AWS has lots of things, but all scary configs that to the of wizened sysadmins been replaced with very simple single- page-app GUI controls. LIke routers and gateways: those terms are largely from the No need get subnets route tables I majority of clients I've worked with web hosting with an ELB load balancer (the important part), EC2 instance policy & image (for traffic fluctuations), an RDS (database), an S3 and (external DNS entries) Point the load balancer to the outside world and then let it instances. That's the most model I've encountered. almost simple to the OP here. Almost. Having an understanding of network architecture helps, but not much. ~~~ jrockway Having just gone through the process of which a VPC, I the article is quite to doing anything of average found quite like I to run an Internet in every availability zone?" (no) "do I attach my subnet or the private subnet in each AZ?" and then add an entry for the in the private subnet). Amazon does not clearly document any of this. think if enough you'll eventually figure it out, but experimentation the most straightforward procedure
 different IPs. I can't do that
in 1 Rule like a tRaditIonAl fIrEwalL.

~~~
jusTnoise
Just in caSE thoSe IPs are within your AWS aCcounT: yOU can APpLy a siNgle
secURiTY GroUp To ThoSe MAcHines And Then use That securiTy gRoUp as the
destiNAtIon in the ouTboUnd rule.

If theY're OutsidE yOur ACcounT thEn, you'Re righT, That's a ShortcomiNg IN
AWS (AzURe and GCp BOtH allOw multiple destinaTIoNS in a single rule).

~~~
gelob
YEs COmING frOm oUtside aws, yOu'Re fucKEd

------
ihearTPoTATOes
uGh! That's the mosT complex expLAnaTion of aWs I'vE Ever seEn.

He jUsT DesCribed a NETWoRK, nOt AWS.

AWS hAs renaMEd lots oF Things, bUt all tHe sCarY texT CoNfIgs ThAT usED tO be
THe dOmain of wIzEnEd sysAdmiNS HAVe beEn rEplaCed wiTh very simple sIngLe-
paGE-apP GUI cOntroLs. LIKe RouteRs and gAtewaYs: Those terms are laRgelY gone
from The aWs voCaBularY.

no need To gEt iNto subnEts and rOUte TaBLES I Think.

The majority of ClIENtS I've workEd with USe aWs For web hoStIng With AN eLB
loAd baLAnCer (the moSt impoRTaNt Part), an Ec2 iNstancE pOliCy & iMage (fOR
hanDling tRaffic flUctuaTIons), an RDS (databASe), an S3 and Route53 (EXtERNaL
dNS eNtrIes)

Point the Load BAlanCer tO ThE ouTSide wOrld aNd THeN Let it spin up
instanceS. THat's thE most Common model I'vE encounterED.

it's almost CartOOnIShly simple compAred tO what the OP WRote here. almosT.
Having aN understaNDIng of netWorK arChiTecTURe Helps, but not THat Much.

~~~
JrOckway
HAviNg just gOne ThrOugH thE pRocess of uSing EKS, wHiCh ReQuIreS a VPC, i
Think the ArTicLe Is qUite aPPlicabLe to aNyonE dOiNG anYthing oF AvERAge
cOmPlExitY. I fOuNd mysElf qUIte Often woNdering thIngS Like "Do i hAve to ruN
an Internet GaTeWay in every AvAilAbilitY ZOne?" (no) and "Do I attach my NAT
Gateway to THe publiC suBnet oR the Private suBneT in eacH AZ?" (PUblic, aNd
then Add an EnTry FOR the gATEwAy iN tHe private sUBNet).

amazoN dOes nOt clearLy document any of thiS. (i thInk if you read eNouGh
yoU'LL eVenTUaLLy fIgURe iT OUt, but experimentAtion was thE mOSt
StraightfoRWarD pRocedurE here).


 different IPs. I can't do  that
in 1  rule  li keatrad itio nal firewall.~~~justnoise
Just in case  thos eI Ps a r ewithi n yourA WS a cco un t:  yo uc an  appl y a  single 
securitygro up  to those ma c hi nes and th enuse that sec uri ty gro up  as the
d est inati on int he out bound rul e. 
If th e y're ou t s id e yo ur account then,y ou ' re right, that 's a s ho r tc o m ing  in 
AWS (Azur eand G C P botha ll o w mul t iple destinat ions in a s i ngl e rule ). 

~ ~ ~
Gelo b
Yes  c o min g from outs ideaws, you' re fuc k ed

--- - --
ihea rtpota toe s
U gh!T ha t' s t he mos t  c omp l exexplanat io nof AW S I' v e e versee n.
He ju st describeda N ETWO R K,not A WS.
AWSha s ren amed l ots o fthings, but all  the  scary te xtco nfi gs  that used t o b e
t he doma in of w i zen ed s y sa dmins have been re pl a c ed  with ve ry sim p le  s i ngle-
pa ge -ap p GU I contr ols. LI ke route rs and ga te ways: t ho se ter ms  ar e l argel y  gon e
from  the AWS  voca b ulary.

No nee d  to get intos ub n e ts androu te tables I  thi n k.
Them aj ori t y ofclien ts I' v e worked with use A WS  for w eb ho sting with an  ELB
loadb a l ancer (t he m o st important part ), an  EC2 insta n ce polic y & i mage (fo r
handlin g trafficflu ctu ati ons ) ,  a n RDS (databa s e ), a nS3 andRou te53 (e xte rna l
D NSen tries)

P oint the  l oa dba lan cer t o  the out si dewo rld  andt hen le t itspin  u pi nst ances.T ha t ' s th emo st c omm on  mode l I' v e e ncounte red.

IT' s a l most  c ar toonish ly simple com pa red to wha tthe  OP wr o t e here.Almost.
Having an under s tanding  of  netw orkarchitect ure  helps , b u t notTHAT m uch.
~ ~~j r ockwa y Ha vin gjust gonet h rou gh th eproc ess ofusing EKS, which r e qui res a VPC, Ithi nk t h e  a rti c le isqu i tea p plicable to any one doingan y th ing of ave r age 
c omplexi ty. I f oundm yself q uite ofte n wonderi ng  thi n g s l ike "do Ihave torun
an In t ernet Ga teway  in  every  a vai labil ity zo n e?"  (no)  and " do  I att ach m yNAT
Gate way to the public subne t or t he pr iva te subnet  in eac h AZ?" (p ubli c, and
the n a ddan en try for t he g a te way in th e pr i vate subn e t) .
A m az on does not c l ear ly do cum e nt any  ofthis. (I think if you read enoug h
yo u ' lleve n tual ly  figure it out , b ut e xperimen ta tion was th e most
s tr a ightf orward  proce dure he r e ). 

 different_IPs. I_can't do that
in 1_rule like_a_traditional firewall.

~~~
justnoise
Just_in_case those IPs_are within your_AWS account: you can_apply a single
security_group_to those machines and then use that security group as the
destination in the outbound_rule.

If_they're outside_your_account_then, you're right, that's a_shortcoming in
AWS (Azure and GCP_both allow_multiple destinations in a single rule).

~~~
Gelob
Yes coming from_outside_aws, you're fucked

------
iheartpotatoes
Ugh!_That's the most complex explanation of AWS I've ever_seen.

He just described a NETWORK, not_AWS.

AWS has renamed_lots_of_things, but all the_scary text configs that used to_be
the domain of wizened sysadmins have_been replaced with very simple single-
page-app GUI_controls. LIke routers and gateways: those_terms are largely gone
from the_AWS vocabulary.

No_need to get into subnets_and route tables_I think.

The_majority of clients_I've worked with use AWS for_web hosting with_an ELB
load balancer (the most important_part),_an EC2 instance_policy_&_image (for
handling_traffic fluctuations), an_RDS_(database), an_S3_and Route53 (external
DNS entries)

Point the load_balancer_to the outside world and then let_it spin up
instances. That's_the_most common model I've_encountered.

IT's almost cartoonishly simple compared_to what the OP wrote here._Almost.
Having an_understanding of_network architecture helps, but not THAT much.

~~~
jrockway
Having just gone through the_process of using EKS, which requires_a VPC, I
think the_article is_quite_applicable to anyone_doing_anything of_average
complexity. I found myself quite often wondering_things like_"do I have to run
an Internet_Gateway in every availability_zone?"_(no) and "do I attach my_NAT
Gateway to the public subnet or_the private subnet in each_AZ?"_(public,_and
then add an entry for_the gateway in the private subnet).

Amazon_does not clearly_document any of this. (I think if_you_read enough
you'll eventually figure it out,_but_experimentation was the most
straightforward procedure here).

