Within AWS infrastructure, ports act as communication endpoints for networking. Amazon EC2 instances use port-related security settings to allow or restrict traffic. For example, HTTP web traffic typically travels on port 80, while secure web traffic (HTTPS) typically uses port 443.
When you create a security group rule in AWS, you specify the inbound and outbound traffic, where you can customize the port range. Whether you choose to open a single port, a range, or all ports (0-65535), your settings should always reflect the principle of least privilege.
Control Protocols
Protocols such as TCP, UDP, ICMP, and others define rules for data transmission across a network. Each protocol has a specific use case and comes into play in different AWS services. For instance, Transmission Control Protocol (TCP) is a reliable, ordered, and error-checked delivery service, commonly used for web browsing and email.
To control these protocols in AWS, Network Access Control Lists (NACLs) and Security Groups are used. Security groups work at the instance level and provide stateful filtering (traffic is automatically allowed back out again) while NACLs operate at the subnet level and are stateless (return traffic must be explicitly allowed).
Managing Network Traffic
AWS provides various solutions to efficiently manage and control network traffic, such as Virtual Private Cloud (VPC), Elastic Load Balancing, AWS Direct Connect, and Amazon Route 53.
Amazon Route 53 is a scalable and highly available Domain Name System (DNS) web service. On the other hand, VPC lets you provision a logically isolated section of AWS where you can launch AWS resources in a virtual network.
For instance, you can use NACLs to restrict inbound and outbound traffic at the subnet level in a VPC. Each Network ACL includes a set of numbered rules and evaluates these rules in ascending order to define which Ports or IP ranges are allowed or denied.
acl = ec2.NetworkAcl('acl-id')
response = acl.create_entry(
CidrBlock='10.0.0.0/16',
Egress=False,
Protocol='tcp',
RuleAction='allow',
RuleNumber=100,
PortRange={
'From':80,
'To':80
}
)
Here, we’ve created a rule that allows inbound traffic (Egress=False) for the TCP protocol through port 80 on the network identified by the CIDR block ‘10.0.0.0/16’.
In summary, controlling ports, protocols, and network traffic on AWS offers fine-tuned access and security control. It’s essential to understand these concepts to design a robust and secure architecture on AWS. Ensure you are comfortable with the application of these techniques before sitting for the AWS Certified Solutions Architect – Associate (SAA-C03) exam.
Practice Test
True or False: AWS Direct Connect is a network service that allows you to establish dedicated network connections from your on-premises environment to the AWS cloud.
- True
- False
Answer: True
Explanation: AWS Direct Connect provides dedicated, private network connections between your on-premises datacenter and the AWS cloud for improved speed and security.
True or False: Elastic Load Balancer (ELB) on AWS does not support both IPv4 and IPv6 addresses.
- True
- False
Answer: False
Explanation: Amazon’s ELB does support both IPv4 and IPv6 addresses, allowing access from clients that use either addressing scheme.
Which of the following protocols are supported by AWS Direct Connect? (Select all that apply)
- A) HTTP
- B) HTTPS
- C) SSH
- D) BGP
Answer: B, C, D
Explanation: AWS Direct Connect supports all standard internet protocols including HTTPS, SSH, and BGP but not HTTP.
True or False: AWS Security groups acts as a virtual firewall at the instance level.
- True
- False
Answer: True
Explanation: AWS security groups act as a virtual firewall for your instance to control inbound and outbound traffic.
Which service would you use to distribute incoming application traffic across multiple EC2 instances in multiple Availability Zones?
- A) Amazon Route 53
- B) Amazon SQS
- C) Amazon ELB
- D) Amazon SNS
Answer: C. Amazon ELB
Explanation: Elastic Load Balancer (ELB) automatically distributes incoming application traffic across multiple targets, such as EC2 instances, containers, IP addresses.
The Amazon VPC allows you to setup what type of networking components?
- A) Private IP Addresses
- B) Subnets
- C) Route Tables
- D) All of the Above
Answer: D. All of the Above
Explanation: Amazon Virtual Private Cloud (VPC) lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. This includes private IP addresses, subnets, and route tables.
Which AWS service allows you to establish a dedicated network connection from your premises to AWS?
- A) Amazon EC2
- B) AWS Direct Connect
- C) Amazon VPC
- D) Amazon Route 53
Answer: B. AWS Direct Connect
Explanation: AWS Direct Connect makes it easy to establish a dedicated network connection from your premises to AWS.
True or False: You can use both security groups and network access control lists (ACLs) to control traffic in and out of your VPC.
- True
- False
Answer: True
Explanation: Both security groups and network access control lists (ACLs) serve as a virtual firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the instance level.
What are the primary benefits of using AWS Direct Connect? (Select 2)
- A) Reduced network costs
- B) Increased bandwidth throughput
- C) Automatic scaling
- D) Enhanced privacy
Answer: A, B
Explanation: By using AWS Direct Connect, you can reduce network costs, increase bandwidth throughput, and provide a more consistent network experience than internet-based connections.
True or False: Amazon Route 53 is a scalable and highly available Domain Name System (DNS).
- True
- False
Answer: True
Explanation: Amazon Route 53 is designed to give developers and businesses an extremely reliable and cost-effective way to route end users to Internet applications by translating names like www.example.com into the numeric IP addresses.
Interview Questions
What function does the Security Groups on AWS serve?
Security Groups function as a virtual firewall for your instance to control inbound and outbound traffic.
Can you change the rules of a Security Group after it is created in AWS?
Yes, you can change the rules of a Security Group after it has been created and those changes are automatically applied to all instances that are associated with the Security Group.
What is Network Access Control Lists (NACLs) on AWS?
NACLs are an optional layer of security that acts as a firewall for controlling traffic in and out of one or many subnets.
Can the Amazon Virtual Private Cloud (VPC) traffic be encrypted?
Yes, there are multiple ways to encrypt VPC traffic including AWS Site-to-Site VPN, AWS Direct Connect, and AWS Transit Gateway.
What is the Transmission Control Protocol (TCP) on AWS?
TCP is a transport layer protocol used by apps to deliver data across a network or the Internet.
What is the User Datagram Protocol (UDP) on AWS?
UDP is a transport layer protocol suitable for sending short messages without verification for delivery.
What network protocols are supported by AWS Direct Connect?
AWS Direct Connect supports the Ethernet protocol.
What is AWS Shield used for?
AWS Shield is a service that provides managed Distributed Denial of Service (DDoS) protection to safeguard applications running on AWS.
Can you apply multiple NACLs to a single subnet in AWS?
No, you cannot. Each subnet in your VPC must be associated with a network ACL. If you do not explicitly associate a network ACL with a subnet, the subnet is automatically associated with the default network ACL.
What is the maximum Transmission Unit (MTU) of a packet over a VPN connection in AWS?
The maximum Transmission Unit (MTU) over a VPN connection is 1436 bytes.
Why would you use the Internet Control Message Protocol (ICMP) on AWS?
ICMP is used for destination reachability, size of the required data packets and general error reporting in IP communication.
Can you modify the default NACL in AWS?
Yes, You can modify the rules for the default network ACL, or you can create your own network ACL and associate it with a subnet.
What is Route 53 used for on AWS?
Route 53 is a scalable DNS and domain name registration service offered by AWS.
Do AWS NACLs support denying rules?
No, NACLs do not support deny rules. Instead, traffic is implicitly denied if it does not match any of the allow rules.
What is AWS Flow Logs?
AWS Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC.
extutorials.com