Explain AWS EC2.

Amazon Elastic Compute Cloud (Amazon EC2) provides scalable computing capacity. You can use EC2 to launch virtual servers that host applications, run on-demand work loads, or extend your data center for your business. These virtual servers are called EC2 instances and come prepackaged with different options for CPU, RAM, storage, network throughput, and more

I.T.

What is an elastic network interface (ENI)?

An elastic network interface (referred to as a network interface in this documentation) is a virtual network interface that you can attach to an instance in a VPC. Network interfaces are available only for instances running in a VPC.

I.T.

What are the port requirements for Amazon Workspace?

No matter which type of directory you have, the following ports must be open on the primary network interface of all WorkSpaces:

For Internet connectivity, the following ports must be open outbound to all destinations and inbound from the WorkSpaces VPC. You need to add these manually to the security group for your WorkSpaces if you want them to have Internet access.

TCP 80 (HTTP)
TCP 443 (HTTPS)

To communicate with the directory controllers, the following ports must be open between your WorkSpaces VPC and your directory controllers. For a Simple AD directory, the security group created by AWS Directory Service will have these ports configured correctly. For an AD Connector directory, you may need to adjust the default security group for the VPC to open these ports.

  • TCP/UDP 53 - DNS
  • TCP/UDP 88 - Kerberos authentication
  • UDP 123 - NTP
  • TCP 135 - RPC
  • UDP 137-138 - Netlogon
  • TCP 139 - Netlogon
  • TCP/UDP 389 - LDAP
  • TCP/UDP 445 - SMB
  • TCP 1024-65535 - Dynamic ports for RPC

If any security or firewall software is installed on a WorkSpace that blocks any of these ports, the WorkSpace may not function correctly or may be unreachable.

I.T.

What are the AWS VPN connectivity options?

AWS hardware VPN You can create an IPsec, hardware VPN connection between your VPC and your remote network. On the AWS side of the VPN connection, a virtual private gateway provides two VPN endpoints for automatic failover. You configure your customer gateway, which is the physical device or software application on the remote side of the VPN connection

AWS Direct Connect AWS Direct Connect provides a dedicated private connection from a remote network to your VPC. You can combine this connection with an AWS hardware VPN connection to create an IPsec-encrypted connection.

AWS VPN CloudHub If you have more than one remote network (for example, multiple branch offices), you can create multiple AWS hardware VPN connections via your VPC to enable communication between these networks.

Software VPN You can create a VPN connection to your remote network by using an Amazon EC2 instance in your VPC that's running a software VPN appliance. AWS does not provide or maintain software VPN appliances; however, you can choose from a range of products provided by partners and open source communities. 

I.T.

How do instances in an Amazon VPC access the Internet?

You can use public IP addresses, including Elastic IP addresses (EIPs), to give instances in the VPC the ability to both directly communicate outbound to the Internet and to receive unsolicited inbound traffic from the Internet (e.g., web servers).  

I.T.

How do I get started with Amazon VPC?

Your AWS resources are automatically provisioned in a ready-to-use default VPC. You can choose to create additional VPCs by going to the Amazon VPC page in the AWS Management Console and selecting "Start VPC Wizard".

You’ll be presented with four basic options for network architectures. After selecting an option, you can modify the size and IP address range of the VPC and its subnets. If you select an option with Hardware VPN Access, you will need to specify the IP address of the VPN hardware on your network. You can modify the VPC to add more subnets or add or remove gateways at any time after the VPC has been created.

The four options are:

  1. VPC with a Single Public Subnet Only
  2. VPC with Public and Private Subnets
  3. VPC with Public and Private Subnets and Hardware VPN Access
  4. VPC with a Private Subnet Only and Hardware VPN Access
I.T.

What are the components of Amazon VPC?

  • A Virtual Private Cloud (VPC): A logically isolated virtual network in the AWS cloud. You define a VPC’s IP address space from a range you select.
  • Subnet: A segment of a VPC’s IP address range where you can place groups of isolated resources.
  • Internet Gateway: The Amazon VPC side of a connection to the public Internet.
  • NAT Gateway: A highly available, managed Network Address Translation (NAT) service for your resources in a private subnet to access the Internet.
  • Hardware VPN Connection: A hardware-based VPN connection between your Amazon VPC and your datacenter, home network, or co-location facility.
  • Virtual Private Gateway: The Amazon VPC side of a VPN connection.
  • Customer Gateway: Your side of a VPN connection.
  • Router: Routers interconnect subnets and direct traffic between Internet gateways, virtual private gateways, NAT gateways, and subnets.
  • Peering Connection: A peering connection enables you to route traffic via private IP addresses between two peered VPCs.
  • VPC Endpoint: Enables Amazon S3 access from within your VPC without using an Internet gateway or NAT, and allows you to control the access using VPC endpoint policies.
  • Egress-only Internet Gateway: A stateful gateway to provide egress only access for IPv6 traffic from the VPC to the Internet
I.T.

What are the security best practices for Amazon EC2?

- Use AWS identity and access management (IAM) to control access to your AWS resources 

- Restrict access by allowing only trusted hosts or networks to access ports on your instance 

- Review the rules in your security groups regularly 

- Only open up permissions that your require 

- Disable password-based login remote logins for root user

I.T.

What are the components of AWS?

The key components of AWS are

Route 53: A DNS web service

Simple E-mail Service: It allows sending e-mail using RESTFUL API call or via regular SMTP

Identity and Access Management: It provides enhanced security and identity management for your AWS account

Simple Storage Device or (S3): It is a storage device and the most widely used AWS service

Elastic Compute Cloud (EC2): It provides on-demand computing resources for hosting applications. It is very useful in case of unpredictable workloads

Elastic Block Store (EBS): It provides persistent storage volumes that attach to EC2 to allow you to persist data past the lifespan of a single 

EC2CloudWatch: To monitor AWS resources, It allows administrators to view and collect key. Also, one can set a notification alarms in case of red flags.

I.T.
Wow you made it to the end. That's all we have so far. You probably have some inside knowledge of your own. Send it our way, we'll review, and post.

You can then come back and refresh your memory, with your own...memories.