---
# System prepended metadata

title: Chapter 3 - VPC
tags: [大話AWS雲端架構]

---

---
tags: 大話AWS雲端架構
---

# Chapter 3 - VPC

### <font color="#5662F6">講者：Andrew
### 日期：2021/08/11</font>

![](https://lh3.googleusercontent.com/pw/AM-JKLVXILtivlgIogJ0PjlMPKWRHKgJsXi0evjgpBwp2vs6d7GdCfKi9wHqN3GXSqNUn2Lz2oMKx1cd4TE8Mt8B4E5Ct4h9CfpxLeE7RczOdg0kjkMdpP9YLFE5xATnTEfKCKD2lvOJXSxzIrbqtuWKIAyk8g=w1097-h797-no?authuser=0)

## 3.1 、 3.2
![](https://lh3.googleusercontent.com/pw/AM-JKLXj_dN7zGTkE_gZLrXDegeM9d7Bqd79NufizTm_oksZxZSYA6ND75KrVM0up3drrJYTjEI4d0KKCNxzLrL8hRkCi_9cZ0p7NfWnd0LiDqwM3fiNWo8UqJDXLERTDMlz9IYNDC2gIqMkWvAKFkUMFxTiRg=w1920-h874-no?authuser=0)

### 3.2.1 公司網路環境、Gateway、路由、防火牆、網段、伺服器

- 人類世界跟資訊世界很相似
- 封包從外面進來→透過Gateway存取到公司的網路環境→透過裡面的防火牆&路由設計進入公有網段→再轉進私有網段→進入伺服器
> **<font color="#f00">本地怎麼做，雲端怎麼做</font>**
- 本地的機房，為了保持產品之間的資訊獨立，會為產品個別做一個獨立的網路環境。
- AWS也是這樣，提供了VPC(Virtual Private Cloud)服務，確保網路獨立，每個產品都會使用一個VPC來做準備。

## 3.3 Virtual Private Cloud - AWS的網路環境組成
### 3.3.1 VPC、IGW、Route Table、NACL、Public Subnet、Instance(Server)

![](https://lh3.googleusercontent.com/pw/AM-JKLV1hoQAY08-Ltm6frHOoxcVdg1AP5NYhH7Gm80dpfMdhZeN2HK3nCF3Lr_IXxmt85jnUwjLsm_nmQzEvL5kkeTZgVLfIYAczmILqFi9xJXJwzzxvM5CVlDZeP2kOBlLTz1zp93nhuAC7rSWfrgNjqqoZA=w996-h882-no?authuser=0)

1. 網路封包透過Internet Gateway進入了VPC
2. 透過Route Table<font color="#f00">找到</font>Public Subnet
3. 通過NACL防火牆過<font color="#286090">進入</font>Public Subnet
4. 最後轉發至外網不能直接連入的Private Subnet，再進入Instance(Server)

## 3.4 VPC的四大類服務對接方式
### 3.4.1 私有網段連外網  - NAT Gateway
 ![](https://lh3.googleusercontent.com/0pxN6J8ah0b-wSQcBtu2q_9UlfjCBuTY_-aogQNgGGaIN2x4fG_KdU5_D-2qk2iDnP775PVKJpud7p9wzRy2fKoCStbTokYm1E_9uTNbPfofjZ1941xWldWXc6Pq3IGYNRzyh_oatStbipOKJCFeMZzQoxP2RKP4kJFAWN0a8te8x1PK0brN8cLQgGo4PMoYXm_GT2cEGPNjNcfH-Ir1x2ZlYefegYqXp5Yu2REjxob_yCBr-JUsaM3eswBUA-R64rBWsNCJN2iq0-IOwLPbSv28U0wFc9wmfISrrpDsEsB0NJ8paKfxXca_brbi-QY9J_UPQBJnk_reR78LmiN3tbmMW8d4yNI3LzemOFt4frq_-jxQoH8PxgzKtApO0HGAdd7otjCI2krKPN0Tu9rcfY-WFy2hA-9aNtoCxsZmr3B2MM5PqyP3P9Q5chhjL5kiLeQClsmvgo1pp-6k8yJtpdHwmmNn_sY2mMTpG0BvYO7lFO-eyjOd8Rtu1wFWWm0MnX-Vi3Ji_qfZjq_4F802LsGSZfDBWAPVU23sY0HK8I6_3cbLNND768rFmyvWwgNNcqPmuZ7CKFuCX0ThkBjHOPB6Iz3ew4Aew-pnasHSI9MlG9_Fhh-p8Kbc9IFDZE5MGR6SV3r7p6DC0dGrBIaz9pjsZbtGlZSkPohWZX5DA_z2TD-ENlYI9YeO2Af1di-boydt4DZTfxFDx2WJgTNL8Y9mMw=w684-h882-no?authuser=0)
- VPC內部有多個公與私網段，私網段預設狀況是不能對外連線的
- 若私網段內的server想要連外網，就需要由AWS設計的NAT Gateway，將私網段的流量導流至公網段、再轉發到外網。

### 3.4.2 VPC以內網方式操作其他AWS服務 - VPC Endpoint
![](https://lh3.googleusercontent.com/u3X9gv0CGIzv20akcc22uRFFLY-O1eJeQhOGfW1bthXLTiKQSu58gOab6UImRhnQMw1DL_buIfUHw9ZD1XGIFmSvrsXcP1sUroz1uGELGYiuKZicUFBlyOwIcP6Lecqu61e5P5nR8oBXnLYgs1w3ZJ3ka7lQQed1K1LFPkUaDCDTmCXfOGPpv4QSzASB8_gIab7ZmQs4xw1vV0k51guywDJ3STTw5m4Cuc9RnA7eptut9s3IuBOM_t55f7agf_UG5oKFUteuMheSSX9-v0V1yF07IU-P4NnELKO7I8Fy9Xq6QX7wRMkczgyd-RWuIKV_GjP03DmKHFtHP896yov0BCK3Mooe4rn2UeeiFezYx7HScr_9AIlXbyInz5ZQ_DlEwIIX-3UctjZixq3HYpB0OuGzUebg8ZV0Q6DLzL7eNoGbsWYKxq82N1Oo2xPC4vzMGNRHS9tIkQHHI7nz48xUWAGdUc1MVKIG6TLlFqLVGT-TpUTFMx6H_s0MMY0nF9pMNuoBAvzQOkvpUVWqLQZh3TmQDP5gI5O0fxsXJEqN2xWvDvCH2kz1pVj3RkjcOzTYwYnGSSWU3gjQVdTAo2wcioTMEkCvv74C1Dser7waDiqQVAWScdtWa9M7V8IX-9iTl0TCcjNv1GCKoellSrgjCR0PAmgMGakuiqeYIiqKQh4GnOvNXroxjsRFAE4FtnZD1grllIPmQMPrJzkTZOzTMqCTJg=w684-h882-no?authuser=0)

### 3.4.3 VPC串接VPC - Peering Connection
![](https://lh3.googleusercontent.com/piBPuBQcJAkXEt7eGloHhQzYTZA9sJNeXqAY45Fh8q6rLc2r2Z5S3DxkgJsqe6QFFXq5vpdwiIk-nMAHRatL-cAEd-DjfRt4bogZRN81Q8Chedw8LGxulGAxVFG1eNlZoAaBfNzNaZaIJnR1RCwkGUtTxsPLc1INqrxQG7rDvBrix0FXu7XFnc22ng-sLGyuMXffyUt4-1S8WjiHf4Fa8EhRW9Ar8eyiwOc_XLm6AXBZaI7DM9ABm81oR5n-sCNwJmcRefdyQouXcUkm2zKlU1oECEjYp9Oj0bhJEdHMhRwtzD4Xt7HQYgJM009qxD0kfLPjM32Ao4_tHoAzTuxmDQZgIuUSwSJ9-harasMI0f425_7uINHstTIB7cxubz6uXlG6JX-UULBMs-OWcz38ICNTxstqG0BAX7JhVW9gQBbugbQR_tPYTlP8DHIWC3Z81KB-XhTG_DEPL8nlWd2UldpOz0MaSHd4pFEZsW9pn0axdSvJeGK5SwOVlH0oGxAFX3hBH_jMFt-mf1spk0S5a4CbrCmafhhfXV2bNoAFW-bWv8awdHkMGyNgs0Gq0nctQg4z7mzQXtracZzLXXRjoQmDzoI9s0u17ssK2EFo3NGVee3b6AFaJinZrbKoaVqif8nuVkzCyiWZZAhBVvkwCHCdE5Yw_4vMuPggYkmFSvH5ZQ14sWFr6GcGzJxEnGV85o7ZkFDBb62rDcJGBIZ4veB-VA=w684-h882-no?authuser=0)
- 公司會有多個產品分別用獨立的VPC，有時需要進行資料共享，預設下兩個VPC會透過外網進行溝通。
- 若要讓不同VPC能用內網的方式溝通，可透過AWS設計的Peering Connection進行串接，串接後彼此就能使用對方的私有IP進行溝通。

### 3.4.4 VPC串接本地網路環境 - VPN Connection

> 就是VPN的概念
- 由本地網路與VPC溝通預設下會走外網，若要透過私有IP且加密的情況下溝通，可透過AWS設計的VPN Connection

### 3.4.5 監控VPC的網路流量 - VPC Flow Logs
> 監控進出VPC的網路流量

- 網路世界經常面臨網路攻擊，所以需要對於通過VPC的網路流量進行監控。
- VPC提供了Flow Logs，協助我們監控。

## 3.5 考題解析與思路延伸
### 3.5.1 
![](https://lh3.googleusercontent.com/uKO3sARnRm-Fjl-anKdP-b26wmiQkERtLmKVXBei5Tq0cJ23-UAZWV2drEuAeNYSu4ZqAR9aeyQgTpfb3jAoeccpo18DQHLzbcoyiOV217Zilk9nM8ift4tLJoo6zN2noZuKwa-V0YxJbJA6u_ylOCMfq5zyPQiqXEUQAkathhisiJ-hAeL0zaOqyfvgjy1-WCkLPb7f2IR7dB68LIkn9ulOHe1sDPQfgUyzCM2pHng7Jmqo19B5BaORAOPaikAHVuPck_LDHkROEe-Hasui1REi4iUJDmHcNzbO0JAY_QJA21sncrhAeMG72Xbx06KNxwTWu8yaOCBhVHtdB2DSnpmEFjGbz4uMeUQUqOpOBNbneLRWixhZkFRqnbuC5lT-_RGYVWpAW4xYuGfKZ-6HIaftRjQNyjvD986c8X7OatAgxtqgqXEhEZUxtbt2KOpelNpffzOhufgq0Ht2LgucAlkC9-fKFnkr87NN_tjpVekgOgnYzYhZZ4LeXHWUtLoZssJ2xdtohKtFpU-hvc5Y98tmBJ64QRgwf2uqzLnGbevxJ3lGNKSdRoUCnabrKYtjJu0qC3B89HqRBgMz9ePorbFz8w2eD2r7sJnt4-lZKUusiES2m0gH-diSNImURCSbhNDBIx8hms6pvjPp_MvC9cxHNjt2R2uZ2sAu4DTQD4yOAxyoxwPmfA-kmtzYHnu3W6uviG8KH_SJagCDhA_xvhAw=w720-h947-no?authuser=0)
### 3.5.2
![](https://lh3.googleusercontent.com/9go-FvA_BQ4q3svlaUyDAXhWOmjbwwkCc_wxnFF1fT3vkn68pHLWW67ctkBTDREXTIF1g0RcE6oDoajWUUVVaWMectqpWO4lY4MJSp9AKEjuYVjQYGJHOAGE1UCF943Ypa04TSiatG7tGbyJ-wEGODWSPsMiDm3NenNFuKjCQ_tp3Sd4CpnsNYz0AOKuijOiTOMKy1yp-ISp5Q0jLe2_7qU203NdzLaFnhuMT9sB9sSOcir4YhZ5eWm5Jg_gos92z_Y21ckh0xznfqG93hiV-5mYz4slM8KmU0FMqwp7ozEvactw9tBau2KL9F98LNYCV_7eNLr-BaNchf53nbaAwoJ0LEp3wWnoTjcV63r5tHVBfnLPeJF50kPeBmbCWQFZhinjXd7gjmCAphOa4lCLlUtxEdzgZtf24sBbvWW7FKOxaMvCXWVRg1XLCs4VKSB3FeY1AOsQYikoFuiZnpZG3LKPlKViAvvPV2iNf9nEBOR8vGA-inv0wITKU-N47_adg9Jz4gNyU2FmIFl5GDtOX-8OpHIjgUfEnwmR99hR-aD0RFHdjqF8B8BUVq35Uhojcm2sMZRbnGLByPCD85svMcR4nhSk1B2jJSUVthU0brmd3A8WGlrxAtcrO7zKaJwYALGHxXuyl-f8_WZ3wY_z5rPwW-nVK5UjFTJvhlNUOBVam-Ae4FObnO0sNfP52JP6ThJJ6tdyh42C28Qi2psUkBRZ=w733-h947-no?authuser=0)
### 3.5.3 
![](https://lh3.googleusercontent.com/NtafLJ-nLeaNFADvsT5Nzsit5VQ1yve7G1OBIjQobkpjTGiUqkxGcEi4SR6bpTvkLU3pcZTmBeNKTkq_-XqrEcB4hxtAJaK71oAVCtgVSAQVdlh6_xMZljalIfGrVpZDzJmrDYmOPEijgAbiVkvIkLsvHsnSKYQXQ9dSZQ1nMTQAku2ThtNacm4kwTBGsZiYPXw0XYJtoGTuGF-QdfZSaS_Ul9ErZaavAAQu0cZAw7pXnE0rSZtX4mCYT_Wow9T29vII9-JHJT0T7pCp6X0QtYcl5UxnEVlFy6OL2iTk9_MQ_A5YPuR-lCEe9t2K-DqT69df69T_mzxBPSc6Ksm8wxmoE5EmcT15-COWRdYJNHvyAMIgwH8a4rRt7kTtWpC4PlvXNzNkl34bUo6dHorz_ZkmfuFMdznIgMX33DebT4fuw0Ct2iAEdKIP_edVFJe24zG2r7FcJgify15cw-5a4X3wU8fcF873qhmIzSKKkQTuk-CZuKxURA-Eb-tDjqFIT_7zwHU-V1WYaE2bQFqur908jnt7U3cMKKoS6qE8erMNQdiaxnf5QNh4IAUNrNbFRNGMSr3yTwgjoY9A7xF91z6FIOz5e70uKkcwfSm8dRrVFbP4geZeTfxKN91lfZiZXmVI7SUJtg3xTTuJ30FacQBOEd7lDcSB4JztTTlYQnEYUdWSXhmXKTaPwZTK5jfDiml_cYWWEkIOtsEhlHMp5QUe=w926-h947-no?authuser=0)
## 3.6 VPC整體架構圖
![](https://lh3.googleusercontent.com/V8UjnxAYNVS5X75ZdOSCTax_Ony_GdtRjTGr96netMEv4-X17uHu9nUQCBW-UDGubEJI_Jo6bNNE6Lfywrur57GG3PSWkeGydIYR1yDGT8RIhr6vsFpJ2PNBvpK_sYMTJUQGib4SbIUz37_995RXkQ4TmYioghFMNG-OTS4rRJAcEicrNTk68AGaSvRLjdH0LaO0wEEkfQzOA8YEhye9H_0YyaYooe0jqkyUHxJPCQWAUPT9bSvvVcXGnwR9ZAz9zGkyhQQ9Tal1Za2fXJyJldMyoIMVYHHgGjY7f96_dNtqvXOqsKvUqnuJkW2nkk8H4VsDHsGey68yJ5fYLJfql86sIs7GlFeapIPILSOvq3mZs6D8ApgwhSI0n9NB10LKqyEarzey1H9_XSL4Iv1xyINKYXV0rODXIgYXd6MiAjHJHHUMVOtQ8IS_gEJSlUHEfGfLlzUTkzaJCr4onnhMia_vi4VVIB_QfCrMsfKP1ddfw1xjo3_EqXCZxngqwANbODiW2RgdTUcASU1MYiPgoI5pu3sE1dqG7xgYwGF0RRceMi6tqTYs4Kb21H-soY-EXH5hIEX6KyD2oCp6uErahEwTibekRUVFIhMg37HXEw0YjYplues9OpQQaCNFwPhCUSowWl-2d3_DG29jsCpM27SCWmuwjK4zsn8YHS0PP4i9c9enpIVkA9EkO0FIugwStidt38tLaXP4R-ysxflBNMOm=w654-h948-no?authuser=0)
## 3.7 相關名詞
...
...
...
## 3.8 小結
> ### **建置軟體應用時**
> - **本地端**會透過網段作為存取權限的管理。
> - **雲端經營**則會為了確保產品的資料安全，使用VPC為產品做網路規劃。


---

> ### **核心要件**
> 1. 準備一個Internet Gateway讓Instance(Server)能夠將網路拋到外部網路
> 2. 用Route Table對裡面的Subnet作公開或私有化
> 3. 封包存取往段時，還會透過**NACL**這個靜態防火牆，作流量的篩選

- VPC內部的Instance，想透過**私有網路**存取AWS的服務 👉 使用**VPC Endpoint**來完成串接
- 產品與產品之間透過**私有網路**進行溝通 👉 使用**Peering Connection**進行串接
- 本地機房使用**私有IP**與VPC進行溝通 👉 **VPN Connection**