From e906dd66fb3394529dfe490fb2364152aedea10b Mon Sep 17 00:00:00 2001 From: Marco Hoyer Date: Tue, 19 Jun 2018 14:55:40 +0200 Subject: [PATCH 1/2] Remove wrong statement about security groups Security groups are bound to a specific VPC and thus to an AWS region but not to a single AZ or DC. --- README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/README.md b/README.md index 3437d532..4482700a 100644 --- a/README.md +++ b/README.md @@ -1643,7 +1643,6 @@ VPCs, Network Security, and Security Groups ### VPC and Network Security Gotchas and Limitations -- 🔸Security groups are not shared across data centers, so if you have infrastructure in multiple data centers, you should make sure your configuration/deployment tools take that into account. - 🔸[VPC Endpoints](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-endpoints.html) are currently only available for S3 and DynamoDB. If you have a security requirement to lockdown outbound traffic from your VPC you may want to use [DNS filtering](https://aws.amazon.com/blogs/security/how-to-add-dns-filtering-to-your-nat-instance-with-squid/) to control outbound traffic to other services. - ❗Be careful when choosing your VPC IP CIDR block: If you are going to need to make use of [ClassicLink](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vpc-classiclink.html), make sure that your private IP range [doesn’t overlap](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vpc-classiclink.html#classiclink-limitations) with that of EC2 Classic. - ❗If you are going to peer VPCs, carefully consider the cost of [data transfer between VPCs](https://aws.amazon.com/vpc/faqs/#Peering_Connections), since for some workloads and integrations, this can be prohibitively expensive. From e895d643d93d6a2ce50c6b5aca841f4ad1d20ba1 Mon Sep 17 00:00:00 2001 From: Marco Hoyer Date: Tue, 19 Jun 2018 17:18:19 +0200 Subject: [PATCH 2/2] update security group classification to other network entities --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 4482700a..e5acee52 100644 --- a/README.md +++ b/README.md @@ -1642,7 +1642,8 @@ VPCs, Network Security, and Security Groups - New and existing VPCs can both use IPv6. Existing VPCs will need to be configured to have an IPv6 CIDR block associated with them, just as new VPCs do. ### VPC and Network Security Gotchas and Limitations - +- 🔸VPCs are tied to one Region in one Account. Subnets are tied to one VPC and limited to one Availability Zone. +- 🔸Security groups are tied to one VPC. If you are utilizing infrastructure in multiple VPCs you should make sure your configuration/deployment tools take that into account. - 🔸[VPC Endpoints](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-endpoints.html) are currently only available for S3 and DynamoDB. If you have a security requirement to lockdown outbound traffic from your VPC you may want to use [DNS filtering](https://aws.amazon.com/blogs/security/how-to-add-dns-filtering-to-your-nat-instance-with-squid/) to control outbound traffic to other services. - ❗Be careful when choosing your VPC IP CIDR block: If you are going to need to make use of [ClassicLink](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vpc-classiclink.html), make sure that your private IP range [doesn’t overlap](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vpc-classiclink.html#classiclink-limitations) with that of EC2 Classic. - ❗If you are going to peer VPCs, carefully consider the cost of [data transfer between VPCs](https://aws.amazon.com/vpc/faqs/#Peering_Connections), since for some workloads and integrations, this can be prohibitively expensive.