A New Approach to Amazon EC2 Networking

You've been able to use the Amazon Virtual Private Cloud to construct a secure bridge between your existing IT infrastructure and the AWS cloud using an encrypted VPN connection. All communication between Amazon EC2 instances running within a particular VPC and the outside world (the Internet) was routed across the VPN connection.

Today we are releasing a set of features that expand the power and value of the Virtual Private Cloud. You can think of this new collection of features as virtual networking for Amazon EC2. While I would hate to be innocently accused of hyperbole, I do think that today's release legitimately qualifies as massive, one that may very well change the way that you think about EC2 and how it can be put to use in your environment.

The features include:

• A new VPC Wizard to streamline the setup process for a new VPC.
• Full control of network topology including subnets and routing.
• Access controls at the subnet and instance level, including rules for outbound traffic.
• Internet access via an Internet Gateway.
• Elastic IP Addresses for EC2 instances within a VPC.
• Support for Network Address Translation (NAT).
• Option to create a VPC that does not have a VPN connection.

You can now create a network topology in the AWS cloud that closely resembles the one in your physical data center including public, private, and DMZ subnets. Instead of dealing with cables, routers, and switches you can design and instantiate your network programmatically. You can use the AWS Management Console (including a slick new wizard), the command line tools, or the APIs. This means that you could store your entire network layout in abstract form, and then realize it on demand.

VPC Wizard
The new VPC Wizard lets you get started with any one of four predefined network architectures in under a minute:

 

The following architectures are available in the wizard:

• VPC with a single public subnet - Your instances run in a private, isolated section of the AWS cloud with direct access to the Internet. Network access control lists and security groups can be used to provide strict control over inbound and outbound network traffic to your instances.
• VPC with public and private subnets - In addition to containing a public subnet, this configuration adds a private subnet whose instances are not addressable from the Internet.  Instances in the private subnet can establish outbound connections to the Internet via the public subnet using Network Address Translation.
• VPC with Internet and VPN access - This configuration adds an IPsec Virtual Private Network (VPN) connection between your VPC and your data center – effectively extending your data center to the cloud while also providing direct access to the Internet for public subnet instances in your VPC.
• VPC with VPN only access - Your instances run in a private, isolated section of the AWS cloud with a private subnet whose instances are not addressable from the Internet. You can connect this private subnet to your corporate data center via an IPsec Virtual Private Network (VPN) tunnel.

You can start with one of these architectures and then modify it to suit your particular needs, or you can bypass the wizard and build your VPC piece-by-piece. The choice is yours, as is always the case with AWS.

After you choose an architecture, the VPC Wizard will prompt you for the IP addresses and other information that it needs to have in order to create the VPC:

Your VPC will be ready to go within seconds; you need only launch some EC2 instances within it (always on a specific subnet) to be up and running.

Route Tables
Your VPC will use one or more Route Tables to direct traffic to and from the Internet and VPN Gateways (and your NAT instance, which I haven't told you about yet) as desired., based on the CIDR block of the destination. Each VPC has a default, or main routing table. You can create additional routing tables and attach them to individual subnets if you'd like:

Internet Gateways
You can now create an Internet Gateway within your VPC in order to give you the ability to route traffic to and from the Internet using a Routing Table (see below). It can also be used to streamline access to other parts of AWS, including Amazon S3 (in the absence of an Internet Gateway you'd have to send traffic out through the VPN connection and then back across the public Internet to reach S3).

Network ACLs
You can now create and attach a Network ACL (Access Control List) to your subnets if you'd like. You have full control (using a combination of Allow and Deny rules) of the traffic that flows in to and out of each subnet and gateway. You can filter inbound and outbound traffic, and you can filter on any protocol that you'd like:

You can also use AWS Identity and Access Management to restrict access to the APIs and resources related to setting up and managing Network ACLs.

Security Groups
You can now use Security Groups on the EC2 instances that your launch within your VPC. When used in a VPC, Security Groups gain a number of powerful new features including outbound traffic filtering and the ability to create rules that can match any IP protocol including TCP, UDP, and ICMP.

You can also change (add and remove) these security groups on running EC2 instances. The AWS Management Console sports a much-improved user interface for security groups; you can now make multiple changes to a group and then apply all of them in one fell swoop.

Elastic IP Addresses
You can now assign Elastic IP Addresses to the EC2 instances that are running in your VPC, with one small caveat: these addresses are currently allocated from a separate pool and you can't assign an existing (non-VPC) Elastic IP Address to an instance running in a VPC.

NAT Addressing
You can now launch a special "NAT Instance" and route traffic from your private subnet to it in. Doing this allows the private instances to initiate outbound connections to the Internet without revealing their IP addresses. A NAT Instance is really just an EC2 instance running a NAT AMI that we supply; you'll pay the usual EC2 hourly rate for it.

ISV Support
Several companies have been working with these new features and have released (or are just about to release) some very powerful new tools. Here's what I know about:

 

The OpenVPN Access Server is now available as an EC2 AMI and can be launched within a VPC. This is a complete, software-based VPN solution that you can run within a public subnet of your VPC. You can use the web-based administrative GUI to check status, control networking configuration, permissions, and other settings.

 

CohesiveFT's VPN-Cubed product now supports a number of new scenarios.

By running the VPN-Cubed manager in the public section of a VPC, you can connect multiple IPsec gateways to your VPC.You can even do this using security appliances from vendors like Cisco, ASA, Juniper, Netscreen, and SonicWall, and you don't need BGP.

VPN-Cubed also lets you run grid and clustering products that depend on support for multicast protocols.

 

CloudSwitch further enhances VPC's security and networking capabilities. They support full encryption of data and rest and in transit, key management, and network encryption between EC2 instances and between a data center and EC2 instances. The net-net is complete isolation of virtual machines, data, and communications with no modifications to the virtual machines or the networking configuration.

 

The The Riverbed^® Cloud Steelhead^® extends Riverbed’s WAN optimization solutions to the VPC, making it easier and faster to migrate and access applications and data in the cloud. Available on an elastic, subscription-based pricing model with a portal-based management system.

 

Pricing

I think this is the best part of the Virtual Private Cloud: you can deploy a feature-packed private network at no additional charge! We don't charge you for creating a VPC, subnet, ACLs, security groups, routing tables, or VPN Gateway, and there is no charge for traffic between S3 and your Amazon EC2 instances in VPC. Running Instances (including NAT instances), Elastic Block Storage, VPN Connections, Internet bandwidth, and unmapped Elastic IPs will incur our usual charges.

Internet Gateways in VPC has been a high priority for our customers, and I’m excited about all the new ways VPC can be used. For example, VPC is a great place for applications that require the security provided by outbound filtering, network ACLs, and NAT functionality. Or you could use VPC to host public-facing web servers that have VPN-based network connectivity to your intranet, enabling you to use your internal authentication systems. I'm sure your ideas are better than mine; leave me a comment and let me know what you think!

-- Jeff;

Comments

[Simon]

Hi Jeff,

Whats the ETA on IPV6 support?

[Simon]

Dear Jeff,
We are a small startup and I'm looking to host all the IT in the cloud.
Is it possible to install Active Directory on Windows 2008 Server running on EC2 instance, to place it under the Virtual Private Cloud, all the workstations will added as a members of this domain and will work transparently via VPN from internet.
Thanks,
Simon

[Pve]

Great stuff. Congrats to Werner and his team!

Now, what about your roadmap for IPv6 integration?
I'd like to see two features in particular.
1. Public IPv6 internetfacing addresses on EC2 hosts, S3 and Cloudfront.
2. 'private' IPv6 connections to above that are restricted to a certain IPv6 subnet (i.e. my datacenter or client lan). 'private' between quotes, because you can use public IPv6 address space.
Remember that with IPv6 there is no real need for NAT or VPN. Everything can be handled on the address or routing level.
This really simplifies network design and troubleshooting.

[Roland]

What about IPv6?

[Michael Klatsky]

Are the limitations on instance types still in place, specifically regarding Cluster computes?

[Andy]

My first question was going to be "What about ipV6", but I see several others beat me to it.

[Cloudcontroller]

This is quite a block-bluster pack of features to unveil in one release. Especially excited about VPC with Internet and VPN access- at Cloud Controllers we have a client replicating their Windows file server to a failover Windows server on AWS. Replication takes place over a flaky Cisco VPN client for Windows. We had to do it this way simply because this server's function is high availability over the PUBLIC internet- should their office suffer catastrophic equipment failure or nature disaster occurs, they would access their files on this server through a webdav application. Now we can securely replicate their server by using the "VPC with Internet and VPN access" deployment model - we'll get a more reliable VPN connection between their on-premise router and VPC while still providing public internet access. Good times.

[neal]

can you provision a VPC on dedicated hardware or this is still multi-tenant?

[GJG]

Does Amazon EC2 support private line connections to/from a datacenter hosted by Terramark?