AWS re:Invent 2022 - Layered VPC security and inspection (NET311)

[@mandarsawant3032]

Very well explained and covered most demanding topic from these days from ENT customer i.e. Centralized inspection of an on-premises traffic via DX/VPN using TGW.

[@anti2117]

This was a good one. Would it be possible to get an explanation on how to do these approaches running a dual stack environment? Without running IPv6 through NAT.

[@charleszuo2946]

At 3:40 the speaker mentions you can have a prefix list of hundreds or thousands of IP addresses that are assigned to a security group (SG). But I'm under the impression that a SG has a limited number of entries and each IP address in a prefix list adds to that limit, meaning if you have a prefix list of 50 IPs thats referenced by a SG, the SG has 50 entries. Ive worked my AWS account rep testing this and the conclusion we reached was that we can't reference hundreds or even thousands of IPs in a prefix list without exhausting the SG.

[@awssupport]

Hi there! 👋 Thanks for the feedback. We've forwarded your insight to our service team for review. 🔍 ^RW

[@artsiomrachytski1312]

Actually, ALB is now supported in target groups as well

[@srirajan1933]

Really well presented, Pratik and Rashpal! Very nice overview of tradeoffs in deployment architectures supported by clear diagrams of packet flows. So many networking concepts and models were beautifully clarified in your session. Great work, guys. Thank you! Very minor typo: slides from t=24:26 to 29:41, and t=33:00 to 33:47, the "Inspection VPC" indicates "TGW Subnet 1" below "GWLBE Subnet 2"; it should be "TGW Subnet 2" in "Availability Zone 2".

[@SV-tc8cu]

basically is a great video basically

[@khavasx]

Hello, at minute 34:56, there was talk of increased costs, are these costs associated with AWS services or management in case of problems?.

[@awssupport]

Hi! The increased costs mentioned are associated with AWS services. ^NR

[@khavasx]

Hello, at 19:56 in VPC 1, are there two AWS Network Firewalls (one per Availability Zone) or would there be only one AWS Network Firewall (one per Region)?.

[@awssupport]

Hey Khalil! 👋 From what I've found, it looks like in this example there is only one AWS Network Firewall creating policies for the FWE managed at the Region level. However, the Network Firewall may have different policies created & applied to each availability zone separately. Check out more about AWS Network Firewall & how it works from our developer guide, here: go.aws/3mUJ1U4 & go.aws/3mRrE6q. 🔥 ☁️ ^RN

[@nlghtmal2e]

Can we have the slide?

[@kathleenjungck2781]

I'd love a copy of the slides as well. Absolutely nails the use cases I'm currently working on.

[@awssupport]

Thanks for sharing this, Kathleen! I've reached out to the relevant team for review. ✨ ^LG

[@TheMightyWalk]

"he/him" duh