1. What is Amazon VPC, and why is it important?
Amazon Virtual Private Cloud (VPC) allows you to create an isolated network within the AWS cloud. It is important because it provides the control to define your own network architecture, including IP address ranges, subnets, route tables, and security settings. This helps in building secure, scalable, and cost-effective cloud architectures.
Key features:
- Subnets: Public and private.
- Routing: Define custom route tables.
- Security: Security Groups and NACLs (Network Access Control Lists).
- Peering: VPC Peering allows communication between different VPCs.
2. Explain the difference between a public subnet and a private subnet in VPC.
- Public Subnet: A subnet that has a route to the internet via an Internet Gateway (IGW). Instances in public subnets can access the internet directly.
- Private Subnet: A subnet that does not have a route to the internet. Instances in private subnets typically communicate with the internet via a NAT Gateway or NAT Instance.
3. What is an Internet Gateway (IGW), and how does it work in a VPC?
An Internet Gateway (IGW) is a horizontally scalable, redundant, and highly available gateway that allows communication between resources in your VPC and the internet. It is used for allowing instances in public subnets to communicate with the internet. The IGW is attached to your VPC, and you must update the route tables to direct traffic to the IGW for internet access.
4. What is a NAT Gateway, and when would you use it?
A NAT Gateway (Network Address Translation) allows instances in a private subnet to access the internet for updates, patches, or to pull resources from external sources. However, it prevents external traffic from reaching those instances in the private subnet directly.
- Use case: When you want your instances in a private subnet to access the internet but not be accessible from the internet.
5. Explain the concept of VPC Peering and its use cases.
VPC Peering allows you to connect two VPCs (within the same region or across different regions) and route traffic between them as if they are part of the same network. It enables communication between resources in different VPCs.
Use cases:
- Connecting VPCs of different departments or teams.
- Accessing shared services from multiple VPCs.
- Expanding network architecture across regions.
6. What is AWS Direct Connect, and how is it different from a VPN connection?
AWS Direct Connect is a dedicated network connection between your on-premises data center and AWS, offering high throughput and low-latency connections. It is often used for transferring large amounts of data or for enterprise workloads that require more stable and consistent connections.
Difference from VPN:
- Direct Connect provides a dedicated physical connection, while VPN uses the internet for tunneling.
- Direct Connect provides more consistent performance, while VPN can be less predictable due to public internet traffic.
7. What are Security Groups and Network Access Control Lists (NACLs), and how do they differ?
- Security Groups are stateful, meaning that if you allow inbound traffic, the corresponding outbound traffic is automatically allowed. Security Groups are attached to EC2 instances and control traffic to and from these instances based on rules.
- NACLs are stateless, meaning you must define rules for both inbound and outbound traffic. They are used at the subnet level and control traffic in and out of subnets.
Key differences:
- Security Groups: Stateful, instance-level firewall.
- NACLs: Stateless, subnet-level firewall.
8. How would you design a highly available and fault-tolerant architecture using VPC?
- Multiple Availability Zones (AZs): Distribute instances across at least two or more AZs for high availability.
- Elastic Load Balancer (ELB): Use an Application Load Balancer (ALB) or Network Load Balancer (NLB) to distribute traffic across multiple instances in different AZs.
- Auto Scaling: Set up Auto Scaling Groups to automatically scale in or out based on traffic demand.
- NAT Gateway/Instance: Place in a public subnet to provide internet access for private subnet instances.
- Backup and Disaster Recovery: Use features like AWS Backup, S3 replication, and cross-region replication for disaster recovery and business continuity.
9. Explain how AWS Route 53 works and its features.
AWS Route 53 is a scalable and highly available Domain Name System (DNS) web service. It is used to route end-user requests to various resources in your AWS environment.
Key features:
- Domain Registration: Allows you to register domain names.
- DNS Routing: Resolves domain names to IP addresses.
- Health Checks and Monitoring: Allows health checks for your resources and routes traffic based on resource availability.
- Latency-based Routing: Routes traffic to the region with the lowest latency.
- Geo DNS: Routes traffic based on the geographic location of the user.
10. What is VPC Flow Logs, and how can it be used for troubleshooting?
VPC Flow Logs capture detailed information about the IP traffic going to and from network interfaces in a VPC. This data can be helpful for:
- Monitoring: Checking the flow of traffic to ensure security and compliance.
- Troubleshooting: Diagnosing network connectivity issues, such as blocked traffic or misconfigured security groups.
You can send VPC Flow Logs to CloudWatch Logs or S3 for further analysis.
11. How do you secure communication between EC2 instances in a VPC?
You can secure communication between EC2 instances in a VPC by:
- Using Security Groups to restrict access to specific instances or ports.
- Configuring NACLs to control traffic between subnets.
- Using Private IP addresses for internal communication between instances.
- VPC Peering for communication between instances in different VPCs.
- Using VPN or AWS Direct Connect for secure connections to on-premises systems.
12. What is the difference between an Elastic IP (EIP) and a Public IP in AWS?
- Elastic IP (EIP): A static, public IPv4 address that is associated with your AWS account. It can be re-associated with different EC2 instances as needed.
- Public IP: A dynamic IP assigned to an EC2 instance at launch. It can change if the instance is stopped and restarted.
13. What is a Load Balancer, and what types of Load Balancers are available in AWS?
A Load Balancer distributes incoming network traffic across multiple targets, such as EC2 instances, in order to ensure high availability and fault tolerance.
Types of Load Balancers:
- Classic Load Balancer (ELB): Older type, used for basic routing.
- Application Load Balancer (ALB): Operates at the HTTP/HTTPS layer (Layer 7), providing advanced routing features like URL-based routing and WebSocket support.
- Network Load Balancer (NLB): Operates at the transport layer (Layer 4), offering high performance for TCP and UDP traffic.
- Gateway Load Balancer: Used for integrating third-party network appliances such as firewalls.
14. What are PrivateLink and VPC Endpoints?
- VPC Endpoint: Enables private connections between VPCs and supported AWS services without using public IP addresses. There are two types: Interface Endpoints (for services like EC2, Lambda) and Gateway Endpoints (for S3 and DynamoDB).
- AWS PrivateLink: A technology that provides private connectivity between VPCs and AWS services over the AWS private network.
15. Explain the concept of Transit Gateway and its use cases.
AWS Transit Gateway is a network hub that connects multiple VPCs, on-premises networks, and remote offices. It simplifies network management by acting as a central point for inter-VPC communication. It supports VPC Peering, VPN connections, and Direct Connect.
Use cases:
- Centralized network management for large organizations.
- Efficient routing between multiple VPCs in different regions.
- Secure connection between on-premises networks and AWS VPCs.
16. How does VPC Security work in AWS?
VPC security is managed through:
- Security Groups: Instance-level firewall, allowing you to control traffic based on IP, port, and protocol.
- NACLs: Subnet-level firewall, stateless, providing an additional layer of security for controlling traffic.
- Flow Logs: Capture information about the IP traffic in and out of network interfaces for monitoring and troubleshooting.
- VPN and Direct Connect: Securely connect on-premises networks with AWS.
17. What is the role of AWS VPN and how would you set it up?
AWS VPN (Virtual Private Network) creates a secure connection between your on-premises network and your AWS VPC over the internet. It uses an encrypted tunnel to ensure that data sent between your premises and AWS is secure.
To set it up:
- Create a VPN Gateway on AWS.
- Configure the Customer Gateway on your on-premises router/firewall.
- Establish a tunnel between the two gateways.
