모든 인프라가 public하니, private하게 해야합니다. AWS Network 기본 개념과 VPC 구성요소에대해 알아본 후, private 인스턴스에 접근하는 다양한 방법들에 대해 소개합니다.

2. •
•
•
•
•
•

5. Region
VPC

7. Availability Zone A
Region – Seoul(ap-northeast-2)
VPC
Availability Zone D
Availability Zone B Availability Zone C
Subnet Subnet Subnet Subnet

8. Availability Zone A
Region – Seoul(ap-northeast-2)
VPC
Availability Zone D
Availability Zone B Availability Zone C
Subnet Subnet Subnet Subnet
Subnet Subnet Subnet Subnet

9. Availability Zone A
Region – Seoul(ap-northeast-2)
VPC
10.0.0.0/16
Availability Zone D
Availability Zone B Availability Zone C
Subnet Subnet Subnet Subnet
Subnet Subnet Subnet Subnet
Router
Destination Route
10.0.0.0/16 local

10. Availability Zone A
Region – Seoul(ap-northeast-2)
VPC
10.0.0.0/16
Availability Zone D
Availability Zone B Availability Zone C
Subnet Subnet Subnet Subnet
Subnet Subnet Subnet Subnet
Destination Route
10.0.0.0/16 local
0.0.0.0/0 igw
Internet Gateway

11. Region
VPC
Internet Gateway
Public subnet
Private Subnet

12. Region
VPC
NACL
Public subnet
Private Subnet
Security group
Security group Security group
NACL

13. Instance

14. Region
VPC
IGW
Public Subnet
Router Route table

15. Region
VPC
IGW Router
Route table
Private Subnet 2
Private Subnet 3
Public Subnet 1
Route table

18. AWS Cloud
VPC
Client Router
Private Subnet
Public Subnet
Route table
SG_Private

19. AWS Cloud
VPC
Client Router
Route table
Private Subnet
Public Subnet
Route table
Bastion host
SG_Bastion
SG_Private
ssh/rdp
$ ssh –i keypair.pem ec2-user@ec2-xxx...

20. AWS Cloud
VPC
IGW Router
Route table
Private Subnet
Public Subnet
Route table
Bastion host
SG_Private
SG_Bastion
NAT Instance
Client
ssh/rdp
$ ssh –i keypair.pem ec2-user@ec2-xxx...

21. AWS Cloud
VPC
IGW Router
Route table
Private Subnet
Public Subnet
Route table
Bastion host
SG_Private
SG_Bastion
NAT gateway
Client
ssh/rdp
$ ssh –i keypair.pem ec2-user@ec2-xxx...

22. AWS Cloud
VPC
Client
Private Subnet
Public Subnet
https
Session Manager
AWS Systems Manager
$ aws ssm start-session --target i-xxx...
IAM AWS Credentials
https
Cloudwatch
logs
S3
Bucket

24. AWS Cloud
VPC - 10.0.0.0/16
VPN Client
(10.1.0.0/22)
Private Subnet - 10.0.2.0/24
Public Subnet - 10.0.1.0/24
AWS Client VPN
Client VPN network interface
(10.0.1.10)
Client VPN network interface
(10.0.2.14)
SSL/TLS (443)
VPN endpoint