48 votes
Accepted

Elastic file system (EFS) mount outside of AWS

Important updates: In October, 2018, AWS expanded the capabilities of the network technology underpinning EFS so that it now natively works across managed VPN connections and cross-region VPC peering, ...
44 votes
Accepted

What is the recommended CIDR when creating VPC on AWS?

I would recommend the following considerations: If you creating an IPSEC connection between your corporate LAN and your VPC, use a CIDR that is different than that on your corporate LAN. This will ...
36 votes
Accepted

How to SSH to ec2 instance in VPC private subnet via NAT server

You can set up a bastion host to connect to any instance within your VPC: http://blogs.aws.amazon.com/security/post/Tx3N8GFK85UN1G6/Securely-connect-to-Linux-instances-running-in-a-private-Amazon-VPC ...
  • 476
36 votes
Accepted

In AWS, how to check which resources are using VPC IP addresses

In the EC2 console, in the navigation pane on the left, click Network Interfaces. Everything with an IP address -- EC2 instances, ELBs, NAT Gateways, RDS instances (to name some of the more common ...
26 votes
Accepted

AWS NAT vs AWS IGW vs AWS Router

No they are not the same. Internet Gateway Routes traffic from instances with Public IPs to the Internet. It simply forwards traffic between Public IPs in your VPC and Public IPs in the internet ...
  • 24k
23 votes
Accepted

Unable to connect to RDS instance from outside VPC (ERROR 2003 (HY000) Can't connect to MySQL Server)

For an RDS instance in VPC to "publicly" (Internet) accessible, all of the subnets it is attached to must be "public" -- as opposed to "private" -- subnets of the VPC. A public subnet is essentially ...
18 votes

How to verify a AWS VPC (S3) endpoint works?

I guess the straightfwd way is to actually probe those routes. You can traceroute to s3 and see if the NAT Gateway's internal IP is anywhere in the output (eg. the first hop). First, check the NAT ...
  • 280
16 votes

Static IP address for outgoing traffic from AWS autoscaling group

I understand this is an old thread - for someone who has a similar use-case now, AWS nat-gateway would be a better solution.
16 votes

What is the difference between a public and private subnet in a Amazon VPC?

The Topic of this question is different from the actual problem which is described above. This topic is also important and highly searched over the Internet, and just because of this, other websites ...
16 votes
Accepted

IPv6 support or alternative for aws vpc instances

Unfortunately AWS has been severely neglecting meaningful IPv6 support. Their "solution", if you can call it that, is to throw a non-VPC ELB in front of your application. For many reasons that is a ...
  • 109k
15 votes
Accepted

AWS: NAT Gateway in public subnet. Why?

A NAT Gateway (as well as a NAT Instance, for what it's worth) must be in a public subnet because only devices on public subnets can actually use a public IP address. That's what makes a public ...
15 votes
Accepted

AWS: reduce nat gateway costs for a small system

You seem to be laboring under some misunderstandings about network fundamentals in VPC. set up a nat gateway for each private subnet in each availability zone. For all practical purposes, this is ...
13 votes
Accepted

Setting up Open VPN client on Amazon EC2

In my case, executing the following successfully started the openvpn connection without losing ssh functionality: Example sudo route add -host 96.113.49.112 gw 10.0.0.1 openvpn --config ...
13 votes
Accepted

Can't establish VPC peering connection from Amazon Lightsail

Apparently, you don't actually get to choose which VPC Lightsail will try to peer with -- it wants to peer with your Default VPC. Once VPC peering is enabled, you can address other AWS resources in ...
13 votes

Export my whole AWS architecture into file?

You can use CloudFormer to export your existing AWS infrastructure into CloudFormation template. Alternatively you can use terraforming ruby gem to export your infrastructure as Terraform files.
  • 8,249
13 votes

How to pick AWS CIDR within the CIDR ranges of VPC?

The best start is to refer to VPC and Subnet Basics which explains the VPC addressing and sizing reqirements. Not sure if you are familiar with CIDR addressing? Essentially the bigger the number after ...
  • 24k
12 votes

What is the difference between a public and private subnet in a Amazon VPC?

As documented here PUBLIC SUBNET If a subnet's traffic is routed to an internet gateway, the subnet is known as a public subnet. PRIVATE SUBNETIf a subnet doesn't have a route to the internet ...
12 votes
Accepted

How to secure Redis cluster on AWS elasticache

Currently, Elasticache does not provide authentication mechanisms like, for example, RDS does. The only security available is SecurityGroups, limiting network traffic from specific sources. Should ...
  • 1,169
12 votes
Accepted

Connecting to SMTP server from AWS Lambda

This is expected. Lambda functions in a VPC can't communicate with the Internet (including the standard service APIs) using an Internet Gateway, because an Internet Gateway requires the internal ...
11 votes

What is the recommended CIDR when creating VPC on AWS?

Some things I considered the last time I created a new VPC: Make sure the IP ranges from different regions don't overlap. You shouldn't have a 172.31.0.0/16 in us-west eu-ireland, for example. It ...
  • 546
11 votes

EC2 instances in VPC and access to the Internet

Not quite sure the answer flagged as correct is actually correct. Every Amazon account now has a default VPC (this wasn't always the case) which has an Internet Gateway, an RFC 1918 subnet and a ...
11 votes

Connecting an EC2 VPC with OpenVPN all routed traffic being lost

Turns out EC2 was blocking the forwarded packets from the OpenVPN server. There is a setting on the EC2 Dashboard under Network & Security -> Network Interfaces -> Actions -> Change Source/...
  • 361
11 votes
Accepted

Does the ELB also route outbound reply traffic in AWS

The arrows in the diagram only indicate the direction of connection establishment -- not traffic flow. Yes, return traffic goes back through the ELB. But, it isn't a stateful NAT -- it's a TCP ...
11 votes
Accepted

How to verify a AWS VPC (S3) endpoint works?

I have found a method to verify the VPC endpoint usage. Log in to an AWS EC2 instance in the VPC Configure the aws cli client run aws ec2 describe-prefix-lists; for Windows PowerShell, Get-...
  • 1,886
11 votes

How to verify a AWS VPC (S3) endpoint works?

You can turn on S3 logging and check if the files are being accessed from your private IP rather than public. If your logging shows private IPs are accessing the buckets you've configured it correctly....
  • 111
11 votes
Accepted

Does RDS in private subnet inside AWS VPC need a NAT instance/gateway?

General Rule NAT provides outgoing internet access, and does not allow incoming connections. Note that NAT gateway is a managed service, and is generally preferred over a NAT instance. RDS does not ...
  • 30.7k
10 votes

Multiple VPC's with same CIDR?

As long as machines in your VPCs will never need to communicate with machines in the other VPC, this is fine. However, when you have all of the RFC1918 space available to you, why would you choose to ...
  • 109k
10 votes
Accepted

AWS CIDR is not within the CIDR ranges of VPC

AWS is correct. 10.0.0.0/24 is 10.0.0.0 to 10.0.0.255. You're trying to add something outside this range, 10.0.1.x You probably meant to create your VPC as 10.0.0.0/16.
  • 30.7k
9 votes
Accepted

EC2 instances in VPC and access to the Internet

Instances in a VPC only have access to the public internet if they have an Elastic IP or if their subnet is routed through a NAT instance. Assign an Elastic IP (if you like, you can have this done ...
  • 32.6k
9 votes

How to list all VPC dependencies in AWS CLI?

here's what finally worked for me, using the AWS CLI. I'm aware there are other dependencies besides subnets, but this is a start: jcomeau@aspire:~$ aws ec2 describe-subnets { "Subnets": [ ...

Only top scored, non community-wiki answers of a minimum length are eligible