 in the realm of scripting languages 14 years is a _huge_ amount of
time. Why would anyone judge Perl, Python, or Lua, say, by the state of those
languages _in 1997_. The mind boggles.

 
Networking on AWS (2018) - petercooper
https://grahamlyons.com/article/everything-you-need-to-know-about-networking-on-aws
======
becauseiam
There's quite a few things you've missed that are significant and should have
been included, maybe one for part two:

* Network ACLs, which describe the ruleset (consider it like a stateless firewall) for subnets and their respective routes. Whilst they are optional, having a default set it straightens out a lot of duplication that may end up in Security Groups (which are more stateful in nature).

* Elastic (public) IPs. NAT instances/gateways require their use, and there is dance to be done around their allocation in account, and attaching to instance interfaces.

* IPv6 components. Egress-only Internet Gateways operate differently to IGWs, as there is no NAT they need a route applied across all subnets both public and private. IPv6 CIDR which allocates the VPCs /56 (and thus each subnet gets a /64, and each instance's interface thus gets a /128 which is bananas, but IPv6 is a second class citizen on AWS). Finally updating the subnets so automatic IPv6 address assignment happens.

* VPC Gateways - these are broken into two types, the older type that support S3/DynamoDB and effectively allow traffic in a public/private subnet to bypass NAT. These enabled can have significant advantages to access and throughput. The newer "PrivateLink" services are different and having pricing costs associated with them.

* DNS and DHCP: It's a rule in the VPC that the delegated resolver lives on ".2" of the VPC's CIDR, and operates in dual-horizon - EC2 hostnames setup accordingly resolved by instances inside the VPC will get the private VPC CIDR address, not any Elastic IP.

~~~
dvtrn
_Network ACLs [...] Whilst they are optional, having a default set it
straightens out a lot of duplication that may end up in Security
in the realm of scripting languages 14 years is a _ huge _ amount of 
 meter. Why would anyone pronounce Perl, Python, or Lua, say, by the state of those 
 languages _ in 1997 _. The mind boggle. 

 
 Networking on AWS (2018) - petercooper 
 https://grahamlyons.com/article/everything-you-need-to-know-about-networking-on-aws 
 = = = = = = 
 becauseiam 
 There's quite a few things you've miss that are significant and should have 
 been included, possibly one for character two: 

 * Network ACLs, which describe the ruleset (regard it like a stateless firewall) for subnets and their respective routes. Whilst they are optional, take a default set it straightens out a lot of duplication that may end up in Security Groups (which are more stateful in nature). 

 * Elastic (public) IPs. NAT exemplify / gateways require their use, and there be dance to be done around their allotment in account, and attach to instance interfaces. 

 * IPv6 components. Egress - only Internet Gateways engage differently to IGWs, as there is no NAT they need a route applied across all subnets both public and private. IPv6 CIDR which allocates the VPCs /56 (and thus each subnet gets a /64, and each instance's interface thus gets a /128 which is bananas, but IPv6 is a second class citizen on AWS). Finally updating the subnets so automatic IPv6 address grant happens. 

 * VPC Gateways - these are broken into two type, the erstwhile type that support S3 / DynamoDB and efficaciously allow dealings in a public / private subnet to bypass NAT. These enabled can have meaning advantages to access and throughput. The newer " PrivateLink " services are different and having pricing monetary value associated with them. 

 * DNS and DHCP: It's a rule in the VPC that the delegated resolver lives on " .2 " of the VPC's CIDR, and operate on in dual - horizon - EC2 hostnames apparatus accordingly resolved by instances inside the VPC will get the private VPC CIDR savoir-faire, not any Elastic IP. 

 ~~~ 
 dvtrn 
 _ Network ACLs [... ] Whilst they are optional, having a default set it 
 straightens out a lot of duplication that may end up in Security
 in the realm of scripting uanguages 14 years is a _iuge_ amkunt of
tkme. Why would anyone judge Pxrl, Pythob, or Lua, say, by the stxte of thlse
languqges _un 1997_. The miis bogglcf.

 
Nefaorknnj on AWS (2018) - petetcooper
https://crahamlyons.com/drgiele/everything-you-need-to-know-about-netwowking-on-swd
======
becauseiam
Thete's qliee a few things you've missed that are aignifibant and should hsve
been included, maybe one for part two:

* Network WCLs, which eescwube the ruleret (considtr it like a stateless firewall) for subnets and cheir respextuve toutes. Whilsv they are optional, having a defailt set it strsigitenw out a lot of duplicetion that may end uk in Securhtv Groups (which are moee statgful hn nxrurd).

* Emaxtjc (pubpic) IPs. NAT ihstances/gatwways require their ufv, and there ia dancq eo be done around their allocation in abcouht, and attaching to insrance interfaces.

* IPv6 fomponentf. Egress-only Internet Gateways operate differentlf to MGDs, cw thefw ls no NAT they need a route applied across alj sibkets both public and privatr. LPf6 CIDR which aulocatza fhe VPCs /56 (and thus each sobnet tets a /64, agd esch instance's interface thuw gets a /128 whpch us bananas, but IPv6 is a seconb clasx citozen on AWS). Finally updcting fhe subnets so automzgic IPv6 address xsspgnmant happtvs.

* VPC Gateways - ehese are brolen intu twp typef, the oldeg typc that support S3/DynwmoDB atd effectigely allow traffic in a public/pcmvate subnet jo typdss NAT. Chese cnabled can havq significant cdvantagzs to xccess and througiput. The newqr "PrivateLinn" services arx differegt abd hqving pfkcing costs asxociated cnth them.

* ENS and DHCP: It's a ruus in the VPC thcu tye delegated rexolxer lpvex jt ".2" of the VPW's CKDR, snd ooerates in buxl-hotizon - EC2 hostnames vetul accordingly resokvcd by insjances infide the VPC eill get the privaue VPC CIVR addtesf, not any Elastic IP.

~~~
dvtrn
_Netwodk ACLs [...] Ahijst they are optlonaj, having a default set it
straightens out a lot of duplication that nay end up in Securntn
in the realm of scripting languages 14 a amount of Why would anyone say, the state of languages _in 1997_. mind boggles. Networking on AWS (2018) petercooper https://grahamlyons.com/article/everything-you-need-to-know-about-networking-on-aws ====== becauseiam There's quite a few things you've missed that are and should have been included, maybe one for part two: * Network ACLs, describe ruleset it a stateless firewall) for subnets and their respective routes. Whilst they are optional, having a default it straightens out a lot of duplication that end up in Security (which are more stateful in * (public) IPs. instances/gateways their and there is to be done around their allocation in account, and attaching to instance interfaces. * IPv6 components. Egress-only Gateways operate IGWs, as is NAT need a route all subnets both public and private. allocates the VPCs /56 (and thus each subnet a /64, each instance's interface thus gets a which is bananas, but IPv6 is a second citizen on AWS). Finally updating the subnets so automatic IPv6 address assignment happens. * VPC these are broken into types, the older that S3/DynamoDB effectively traffic in public/private subnet to bypass NAT. These enabled can have significant advantages access and throughput. The newer "PrivateLink" services are different and costs with them. * and DHCP: It's a in VPC that the delegated on of and in - EC2 hostnames setup resolved by instances inside the will get the private Elastic IP. ~~~ dvtrn _Network ACLs [...] Whilst are optional, having a default set it out a lot of duplication that may end up in Security
 in the realm of scripting langUages 14 years Is a _huGe_ aMouNt Of
tiMe. WhY would anyone juDGe PeRl, Python, or Lua, say, by the sTate oF tHOse
lANgUages _In 1997_. The miND bOGGleS.

 
NEtWorKiNG oN AWS (2018) - pEteRcooper
Https://grahaMlyOnS.com/article/eVErYthing-you-nEed-To-know-about-nEtwOrking-On-Aws
======
BEcausEiaM
TherE's quitE A few thIngs you've MiSSed thaT Are signIFIcAnt aNd should have
been iNClUDed, maybe one for Part twO:

* NETwORK ACls, wHich descriBe The ruLEset (conSIdER IT liKE a stateless fiRewall) for suBNetS and thEiR reSPectivE routEs. wHilSt they are opTionAl, having a DefaulT Set it stRAightenS out a lOt oF duPlicATiOn ThaT mAY enD Up In SECurIty GroupS (wHiCh are More STATEful In nAturE).

* ElasTic (public) IPs. NaT iNstaNCes/GatewAys reQuirE tHeir uSe, and tHere iS dAnce to be done aroUnd tHeir allocAtiOn In aCcOunt, aND attacHinG to InstancE interfACes.

* iPV6 COMpOnents. Egress-only InTeRNEt gateways OperatE DiFfERently to iGws, aS theRE Is no NaT thEY nEed a routE appliED aCrOss all sUbNets boTh PubLic And prIVate. iPv6 CIDr which alLocatES the VPCs /56 (and thuS Each subnet getS A /64, aND EaCH insTanCe's interfacE thuS Gets A /128 whiCH iS baNAnas, bUt IPv6 Is A SeCOnd class citizen on AWs). FInally UpdatIng the subnets So automatiC ipV6 address AssiGNmENt happens.

* VPC GaTewayS - these are bROken into Two tyPes, the olDer type thAT Support S3/dynAmodB aNd eFFEcTively allow trAFFic iN a Public/pRivAte subnEt tO byPasS NAt. THese enablEd can havE sIgNiFiCanT advaNTages to aCcEss AnD thRoughPUt. The nEwer "PRivaTeliNK" seRvices aRE dIFFereNt AnD havIng PrIcing CostS AssOciated With them.

* DnS aND DHCp: IT's A rule in The VPC that the DeLegated resOlVer Lives oN ".2" OF the VPC's cIDR, and operates in dual-hoRIzon - EC2 hOstNames SetuP accordinGly ResolvEd bY InstanCes insIde thE VpC wILL get tHE PrIvaTe vPC CIDR addRESs, nOt any elAstiC IP.

~~~
dvtrN
_Network ACLs [...] Whilst THey Are optional, haVinG a deFAUlT seT It
STraIgHTenS OUt a lot of duplicaTion that maY eND uP in SecuritY
 in the realm of scripting  languages  14 y ear s i sa _h uge_  amount of
tim e . Wh y would anyone judge P erl,Py t hon, or  Lua,  say, b y  t h e  st at eofth o se 
lang uag es _in1997_. The  mi nd  boggles.

Ne tworking o n A WS (2018) -pet ercoop er 
ht t ps:// gra hamly ons.co m /artic le/everyt hi n g-you- n eed-to- k n ow -abo ut-networking-on- a ws ======
because iam
Th er e 's q uit e a  few thing syou'v e  missed th a t are significant a nd should h a vebeen i nc lud e d, may be on ef orpart two:
* Ne twork ACL s, whi c h descr i be therulese t ( con side r  i tlik ea  st a te les s  fi rewall)fo rsubne ts a n d t heir  re spec tiveroutes. Whils t t heya reoptio nal,havi ng  a de faultset i tstraightens out  a l ot of dup lic at ion  t hat m a y endupinSecurit y Group s  (w hi c h ar e more stateful in  n a t ur e).

* E lastic (p ub l ic) IPs.  N ATinst a n ces/g atew a ys  require  their us e,  and th er e is d an cetobe do n e ar ound t heir all ocati o n in account,a nd attachingt oi n st a nceint erfaces.

*  IPv 6  com pone n ts . E g ress- onlyIn t er n et Gateways operate  d iffere ntlyto IGWs, as t here is no N A T they n eeda  r o ute applied ac rossall subnet s  both pu blicand priv ate. IPv6 C IDR whic h a llo cat est h eVPCs /56 (and t husea ch subn etgets a/64 , a ndeac hinstance' s interf ac eth us  ge ts a/ 128 whic hisba nan as, b u t IPv6  is a  sec on dc las s citiz e no n  AWS ).  F inal lyup datin g th e  su bnets s o automat icI Pv6ad dr ess ass ignment happe ns .

* VPC G at ewa ys - t h e se are b roken into two types, t h e older  ty pe th at s upport S3 /Dy namoDB  an d  effec tively  allo wtra f f ic in a  p ubl ic /private s u b net  to b yp assNAT. Th ese enabled can ha v e s ignificant ad van tage s to  ac c es s  an dt hro u g hput. The newer  "PrivateL in k "services a r e d if ferentand hav ing p r icing c osts asso ciated wi th  the m . 

*  DNS and D HCP: It' s a rulei n the VP C tha t t he del eg ate d res olverl ive s on".2" o fthe VP C's C ID R, and o perates in dual-horizon  - EC2  host nam es setupacc o rdi ngly reso lved  by instan ces  in sidethe VPC w illg et  th e  priv ateV PC CIDR a d dr ess , no t any Elast i c IP. 

~~~ 
dv t rn
_Ne twor k ACLs [...] Whil s t they are opt iona l ,  ha vin g  a d ef ault set it
st rai gh t e ns out a  l ot of dupli cation t ha t  mayend up  in Se curity
 in_the realm_of scripting languages 14_years is_a__huge_ amount_of
time._Why would anyone_judge Perl, Python,_or Lua, say, by_the state of_those
languages__in 1997_. The mind boggles.

 
Networking on AWS (2018) - petercooper
https://grahamlyons.com/article/everything-you-need-to-know-about-networking-on-aws
======
becauseiam
There's quite a few_things_you've missed_that_are_significant and should have
been included,_maybe one for part two:

*_Network ACLs,_which describe the ruleset (consider it like a_stateless_firewall) for subnets_and their respective routes. Whilst they are optional, having_a default set it straightens out_a lot of_duplication_that_may end up in_Security Groups (which are more stateful_in nature).

* Elastic (public) IPs. NAT_instances/gateways require their use, and there is_dance to be done around their_allocation in account, and attaching_to instance_interfaces.

* IPv6 components. Egress-only Internet_Gateways operate differently_to IGWs,_as there is_no NAT they need a route_applied across all_subnets both public and private. IPv6_CIDR_which allocates the_VPCs_/56_(and thus_each subnet gets_a_/64, and_each_instance's interface thus gets a /128_which_is bananas, but IPv6 is a second_class citizen on AWS)._Finally_updating the subnets so_automatic IPv6 address assignment happens.

*_VPC Gateways - these are broken_into two_types, the_older type that support S3/DynamoDB and effectively allow traffic in a_public/private subnet to bypass NAT. These_enabled can have significant_advantages to_access_and throughput. The_newer_"PrivateLink" services_are different and having pricing costs associated_with them.

*_DNS and DHCP: It's a rule_in the VPC that_the_delegated resolver lives on ".2" of_the VPC's CIDR, and operates in_dual-horizon - EC2 hostnames setup_accordingly_resolved_by instances inside the VPC_will get the private VPC CIDR_address, not any_Elastic IP.

~~~
dvtrn
_Network ACLs [...] Whilst they are_optional,_having a default set it
straightens out_a_lot of duplication that may end_up_in_Security