51 votes
Accepted

Elastic file system (EFS) mount outside of AWS

Important updates: In October, 2018, AWS expanded the capabilities of the network technology underpinning EFS so that it now natively works across managed VPN connections and cross-region VPC peering, ...
Michael - sqlbot's user avatar
41 votes
Accepted

In AWS, how to check which resources are using VPC IP addresses

In the EC2 console, in the navigation pane on the left, click Network Interfaces. Everything with an IP address -- EC2 instances, ELBs, NAT Gateways, RDS instances (to name some of the more common ...
Michael - sqlbot's user avatar
27 votes
Accepted

AWS NAT vs AWS IGW vs AWS Router

No they are not the same. Internet Gateway Routes traffic from instances with Public IPs to the Internet. It simply forwards traffic between Public IPs in your VPC and Public IPs in the internet ...
MLu's user avatar
  • 25.3k
24 votes

What is the difference between a public and private subnet in a Amazon VPC?

The Topic of this question is different from the actual problem which is described above. This topic is also important and highly searched over the Internet, and just because of this, other websites ...
Hassan Hashmi's user avatar
22 votes

How to verify a AWS VPC (S3) endpoint works?

I guess the straightfwd way is to actually probe those routes. You can traceroute to s3 and see if the NAT Gateway's internal IP is anywhere in the output (eg. the first hop). First, check the NAT ...
Valer's user avatar
  • 320
19 votes
Accepted

AWS: NAT Gateway in public subnet. Why?

A NAT Gateway (as well as a NAT Instance, for what it's worth) must be in a public subnet because only devices on public subnets can actually use a public IP address. That's what makes a public ...
Michael - sqlbot's user avatar
16 votes

Static IP address for outgoing traffic from AWS autoscaling group

I understand this is an old thread - for someone who has a similar use-case now, AWS nat-gateway would be a better solution.
packetlord's user avatar
16 votes
Accepted

IPv6 support or alternative for aws vpc instances

Unfortunately AWS has been severely neglecting meaningful IPv6 support. Their "solution", if you can call it that, is to throw a non-VPC ELB in front of your application. For many reasons that is a ...
EEAA's user avatar
  • 110k
16 votes
Accepted

AWS: reduce nat gateway costs for a small system

You seem to be laboring under some misunderstandings about network fundamentals in VPC. set up a nat gateway for each private subnet in each availability zone. For all practical purposes, this is ...
Michael - sqlbot's user avatar
14 votes
Accepted

Can't establish VPC peering connection from Amazon Lightsail

Apparently, you don't actually get to choose which VPC Lightsail will try to peer with -- it wants to peer with your Default VPC. Once VPC peering is enabled, you can address other AWS resources in ...
Michael - sqlbot's user avatar
14 votes
Accepted

How to verify a AWS VPC (S3) endpoint works?

I have found a method to verify the VPC endpoint usage. Log in to an AWS EC2 instance in the VPC Configure the aws cli client run aws ec2 describe-prefix-lists; for Windows PowerShell, Get-...
M. Glatki's user avatar
  • 2,044
13 votes

What is the difference between a public and private subnet in a Amazon VPC?

As documented here PUBLIC SUBNET If a subnet's traffic is routed to an internet gateway, the subnet is known as a public subnet. PRIVATE SUBNETIf a subnet doesn't have a route to the internet ...
Miguel Carvajal's user avatar
13 votes

Multiple VPC's with same CIDR?

As long as machines in your VPCs will never need to communicate with machines in the other VPC, this is fine. However, when you have all of the RFC1918 space available to you, why would you choose to ...
EEAA's user avatar
  • 110k
13 votes
Accepted

Setting up Open VPN client on Amazon EC2

In my case, executing the following successfully started the openvpn connection without losing ssh functionality: Example sudo route add -host 96.113.49.112 gw 10.0.0.1 openvpn --config ...
William Gordon's user avatar
13 votes

Export my whole AWS architecture into file?

You can use CloudFormer to export your existing AWS infrastructure into CloudFormation template. Alternatively you can use terraforming ruby gem to export your infrastructure as Terraform files.
AlexD's user avatar
  • 9,938
13 votes
Accepted

Does RDS in private subnet inside AWS VPC need a NAT instance/gateway?

General Rule NAT provides outgoing internet access, and does not allow incoming connections. Note that NAT gateway is a managed service, and is generally preferred over a NAT instance. RDS does not ...
Tim's user avatar
  • 32.6k
13 votes

How to pick AWS CIDR within the CIDR ranges of VPC?

The best start is to refer to VPC and Subnet Basics which explains the VPC addressing and sizing reqirements. Not sure if you are familiar with CIDR addressing? Essentially the bigger the number after ...
MLu's user avatar
  • 25.3k
12 votes
Accepted

How to secure Redis cluster on AWS elasticache

Currently, Elasticache does not provide authentication mechanisms like, for example, RDS does. The only security available is SecurityGroups, limiting network traffic from specific sources. Should ...
ma.tome's user avatar
  • 1,179
12 votes
Accepted

Is there any way of viewing, in AWS, what ips in a subnet have been allocated?

Your count may be off because AWS reserves five IP addresses per subnet CIDR block. The first four IP addresses in a subnet CIDR block and the last IP address in that CIDR block for its internal ...
kenlukas's user avatar
  • 3,196
11 votes

How to verify a AWS VPC (S3) endpoint works?

You can turn on S3 logging and check if the files are being accessed from your private IP rather than public. If your logging shows private IPs are accessing the buckets you've configured it correctly....
Michael's user avatar
  • 111
10 votes
Accepted

AWS CIDR is not within the CIDR ranges of VPC

AWS is correct. 10.0.0.0/24 is 10.0.0.0 to 10.0.0.255. You're trying to add something outside this range, 10.0.1.x You probably meant to create your VPC as 10.0.0.0/16.
Tim's user avatar
  • 32.6k
10 votes
Accepted

Connecting to SMTP server from AWS Lambda

This is expected. Lambda functions in a VPC can't communicate with the Internet (including the standard service APIs) using an Internet Gateway, because an Internet Gateway requires the internal ...
Michael - sqlbot's user avatar
9 votes

How to list all VPC dependencies in AWS CLI?

here's what finally worked for me, using the AWS CLI. I'm aware there are other dependencies besides subnets, but this is a start: jcomeau@aspire:~$ aws ec2 describe-subnets { "Subnets": [ ...
jcomeau_ictx's user avatar
9 votes
Accepted

IP Address exhaustion for lambdas in VPC

This answer is now out of date. See this blog post or other AWS documentation for up to date information. This page says how many ENIs are required when using Lambda inside a VPC - this is per subnet ...
Tim's user avatar
  • 32.6k
9 votes

Is there any way of viewing, in AWS, what ips in a subnet have been allocated?

In EC2 console go to Network interfaces view down in the left hand side column. It will show all the network interfaces allocated not only to EC2s but also to Fargate, RDS, VPC Lambdas, NAT Gateways, ...
MLu's user avatar
  • 25.3k
8 votes

Static IP address for outgoing traffic from AWS autoscaling group

I don't have enough reputation to comment on the above answers, but I wanted to add some information you will need to know if using a NAT gateway to achieve this. When you create a NAT gateway, you ...
mmiddleton's user avatar
8 votes

What is the difference between a public and private subnet in a Amazon VPC?

The distinction between "public" and "private" subnets in AWS VPC is determined only by whether the subnet has an Internet Gateway (IGW) attached to it. From the AWS docs: If a ...
geepster's user avatar
8 votes
Accepted

Is it possible to split an active subnet in aws?

It is not possible to change the CIDR block for a VPC. So if you have created the VPC with 192.168.0.1/24, then that's as big as the VPC can get. You'll have to re-create the VPC to get more space. ...
Matt Houser's user avatar
  • 10.2k
8 votes
Accepted

How can I get the VPC CIDR range from within an AWS Instance?

You can get the VPC CIDR block by doing e.g. $ metadata="http://169.254.169.254/latest/meta-data" $ mac=$(curl -s $metadata/network/interfaces/macs/ | head -n1 | tr -d '/') $ cidr=$(curl -s $metadata/...
Jukka's user avatar
  • 736
8 votes

Specifying a VPC in a CloudFormation template for an EC2 instance

For EC2 Instances, you get to skip specifying the VPC ID and instead, just specify the subnet you want the instance in. From there, the VPC is assumed. Inside of your "Properties" array, add the ...
EEAA's user avatar
  • 110k

Only top scored, non community-wiki answers of a minimum length are eligible