AWS 네트워크 기본AWS Networking Basics

At the end of the day, the cloud is rooted in data centers. Let’s look at how AWS networking is organized, starting from the data center.

AZ (Availability Zone)

One or more data centers grouped together form an ‘Availability Zone’. Each Availability Zone is designed to be fault tolerant and sits geographically apart from the others to guard against disasters. Each Availability Zone is connected to the others through private links.

Users can’t know where a given Availability Zone is. To keep everyone from piling into one zone, the same name AZ a can map to a different physical location for different users.

> Source: Availability Zone IDs for your AWS resources

Region

A Region is made up of at least two Availability Zones. As of 2024 there are 33 Regions. Korea currently has one Region, Seoul (ap-northeast-2), with four Availability Zones.

VPC (Virtual Private Cloud)

A VPC is a virtual network you set up in AWS. It lets you configure an isolated private IP range dedicated to your AWS account. By default you can create up to 5 VPCs per Region.

Private IP ranges are the IP ranges below. A VPC owns one private IP range, which you can split further into subnets.

10.0.0.0 ~ 10.255.255.255
172.16.0.0 ~ 172.31.255.255
192.168.0.0 ~ 192.168.255.255

Subnet

A subnet is a logical slice of the private IP range owned by a VPC. A subnet always lives in exactly one AZ. When you create a subnet, you must set these three things:

• The VPC to create the subnet in
• The Availability Zone (AZ) to create the subnet in
• A subnet CIDR block within the target VPC’s IP range

CIDR (Classless Inter-Domain Routing)

CIDR is a way to express a specific IP address or a range of IPs. Unlike a plain IP, it has something extra tacked on at the end: an IP address plus a prefix length. Once you understand how IP addresses are structured, reading CIDR is simple.

[IP address]/[Prefix length]

10.0.0.0/16
192.168.1.0/24

How IP addresses are structured

In early computers, a byte didn’t always mean 8 bits, so the term octet was used to mean exactly 8 bits.

An IP address consists of four numbers separated by three dots .. Each of those numbers is called an octet, meaning each number is 8 bits. What does that mean?

$$Octet = 8bit = 2^8 = 256$$

An IP address consists of four numbers, each ranging from 0 to 255. Four 8-bit numbers make 32 bits, so this is a scheme that expresses a computer’s internet address in 32 bits. It can express about 4.2 billion IPs, and its proper name is IPv4.

$$\text{IPv4} = 8bit * 4 = 32bit = 2^{32} = 4,294,967,296$$

CIDR in bits

Now let’s break the CIDR 10.0.0.0/16 down into bits. Written in bits, the IP address looks like this:

10.0.0.0 / 16

00001010.00000000.00000000.00000000 / 16

Here the CIDR prefix length of 16 means ‘fix the first 16 bits of the IP address’. It says the first 16 of the bits below are a fixed address, and the remaining bits after them can change.

00001010.00000000.00000000.00000000 / 16
-------- --------

Subnet: Setting the CIDR

Now let’s apply CIDR to an actual VPC and its subnets.

VPC - 10.0.0.0/16

The VPC’s CIDR prefix length is 16, meaning it uses the IP range 10.0.0.0 with the first 16 bits fixed. Out of the 32 bits of an IP address, this VPC fixes 16 and uses the other 16, so it can have 65,536 IPs.

$$2^{16} = 65536 = \text{first two chunks fixed; the other two chunks (16 bits) are usable}$$

Subnets

Subnets in this VPC keep the first two chunks of the IP fixed and can use the rest of the address for their own CIDR. Here I’ve given each subnet a prefix length of 24. That leaves only 8 bits to use, so each subnet can use 256 IPs.

• Subnet A : 10.0.0.0/24
• Subnet B : 10.0.1.0/24
• Subnet Something : 10.0.255.0/24

$$2^{8} = 256 = \text{the subnet covers a range of 256 usable IPs}$$

CIDR prefix length

In AWS, the CIDR prefix length of a VPC or subnet can only be between 16 ~ 28. So you can create a subnet that uses every IP in the VPC, and you can also use a prefix length larger than /24.

• Subnet Total : 10.0.0.0/16 = 65,536 IPs
• Subnet Small : 10.0.0.0/28 = 16 IPs

CIDR calculator

For tricky CIDRs that aren’t multiples of 8, use a CIDR calculator such as CIDR to IPv4 Conversion.

Reserved addresses

In practice, though, when counting the IPs you can actually use in AWS, you have to leave out 5 addresses.

• Address 0: the network address
• Address 1: reserved by AWS for the VPC router
• Addresses 2 ~ 3: reserved by AWS
• Address 255: the network broadcast address.

Route Table

A route table is a set of rules that decides where network traffic in a VPC is sent. Route tables are actually associated with subnets. Every subnet must be associated with one route table. Conversely, several subnets can share a single route table.

> Figure 1. Subnets and route tables

local

When you create a route table for a VPC with CIDR 10.0.0.0/16, it gets the VPC’s IP range as its default route, shown as local. This local route can’t be modified or deleted.

A local route that’s created by default and can’t be modified or deleted means:

• All resources in the VPC can communicate with each other
• Subnets can communicate with each other

In Figure 1. above, EC2 instances A and B, sitting in different subnets, can talk to each other without any problem. Each subnet is associated with a different route table, but the default local route is always there.

Does this work?

Here’s a question, then. The route tables contain only the local route, as above.

• Can the EC2 instances in Figure 1. reach the internet?
• Can we connect to the EC2 instances in Figure 1.?

The answer is “neither”. Let’s go through why, one at a time.

Private Subnet & Public Subnet

Let’s look at the definition of a VPC again.

A VPC is a virtual network you set up in AWS. It lets you configure an isolated private IP range dedicated to your AWS account.

The key point is that a VPC is an ‘isolated network’. VPCs and subnets in AWS are, by default, isolated environments with no connection to the internet.

Why they’re isolated is simple: no route table has a route that leads to the internet. That’s also why the subnets in Figure 1. are called Private Subnet: they can only be reached from inside AWS.

So how do we connect an isolated VPC to the internet?

Internet Gateway

An internet gateway acts as the intermediary that connects an isolated VPC to the internet. You connect a subnet to the internet in this order:

1. Create an internet gateway
2. Attach the internet gateway to the route table
3. Resources in the VPC need a public IP

> Figure 2. Subnets and an internet gateway

Route Table A

In Figure 2., Route Table A sets the Destination 0.0.0.0/0, which means the default route, with the internet gateway as its Target, as below. Any destination not found in the route table then follows this route.

So by default, any traffic whose destination isn’t in the VPC range goes to the internet gateway. That’s how an isolated subnet gets internet access. A subnet set up like this is called a Public Subnet.

In fact, every subnet starts out isolated; they’re simply split into public and private subnets depending on ‘whether they can route to an internet gateway’.

NAT Gateway

There’s one more thing to think about here: ‘Is a private subnet completely cut off from the internet?’ Not quite: a NAT gateway makes it possible.

1. Create a NAT gateway in a public subnet
2. Attach the NAT gateway to the route table

The NAT gateway sits in a public subnet, which means a subnet connected to the internet gateway. There, it translates private IPs into public IPs and back again. Instances in a private subnet can then talk to the internet through the NAT gateway without having a public IP.

> Figure 3. A private subnet and a NAT gateway

Route Table B

In Figure 3., Route Table B sets the Destination 0.0.0.0/0 with the NAT gateway as its Target, as below.

This lets instances in the private subnet send outbound traffic to the internet, while also protecting them by keeping inbound internet traffic from reaching them directly.

Wrapping Up

We’ve covered the most basic AWS network setup. The key points are:

• AZ & Region
• VPC & Subnet
• CIDR
• Public Subnet & Internet Gateway
• Private Subnet & NAT Gateway

Next time, we’ll check these concepts hands-on by building a Bastion Host.

After that, it’s worth studying the topics that connect to the concepts above:

• NACL & SecurityGroup
• VPC Peering & VPC Endpoint
• Route53
• CloudFront