amazon-ec2 - 我应该使用 Amazon 的 AWS 虚拟私有(private)云 (VPC)

Question

关闭。这个问题是 opinion-based 。目前不接受答案。

---

想要改进这个问题吗？更新问题，以便 editing this post 可以用事实和引文来回答它。 .

已关闭 4 年前。

Improve this question

目前正在从另一家 VPS 提供商迁移到 Amazon EC2。我们有您典型的网络服务器/数据库服务器需求。 Web 服务器位于我们的数据库服务器之前。数据库服务器无法直接从 Internet 访问。

我想知道是否有任何理由将这些服务器放入 AWS 虚拟私有(private)云 (VPC)，而不是仅仅创建实例并使用安全组将它们屏蔽掉。

我们没有做任何花哨的事情，只是一个典型的网络应用程序。

有什么理由使用或不使用 VPC？

谢谢。

Answer 1

注意:AWS 中的新帐户启动时会立即启用“默认 VPC”，并使“EC2-Classic”不可用。因此，这个问题和答案现在的意义不如 2012 年 8 月时的意义。我将答案保留原样，因为它有助于构建“EC2-Classic”和 VPC 产品线之间的差异。请参阅Amazon's FAQ了解更多详情。

是的。如果您具有安全意识，是 CloudFormation 的重度用户，或者想要完全控制自动扩展(与 Beanstalk 不同，Beanstalk 抽象了自动扩展的某些方面，但仍然允许您完全访问扩展参数)，请使用 VPC。这个blog post很好地总结了优点和缺点。博客文章中的一些要点(由 kiip.me 撰写):

EC2 有什么问题吗？

All nodes are internet addressable. This doesn’t make much sense for nodes which have no reason to exist on the global internet. For example: a database node should not have any public internet hostname/IP.

All nodes are on a shared network, and are addressable to each other. That means an EC2 node launched by a user “Bob” can access any of EC2 nodes launched by a user “Fred.” Note that by default, the security groups disallow this, but its quite easy to undo this protection, especially when using custom security groups.

No public vs private interface. Even if you wanted to disable all traffic on the public hostname, you can’t. At the network interface level each EC2 instance only has one network interface. Public hostnames and Elastic IPs are routed onto the “private” network.

VPC 的优点

First and foremost, VPC provides an incredible amount of security compared to EC2. Nodes launched within a VPC aren’t addressable via the global internet, by EC2, or by any other VPC. This doesn’t mean you can forget about security, but it provides a much saner starting point versus EC2. Additionally, it makes firewall rules much easier, since private nodes can simply say “allow any traffic from our private network.” Our time from launching a node to having a fully running web server has gone from 20 minutes down to around 5 minutes, solely due to the time saved in avoiding propagating firewall changes around.

DHCP option sets let you specify the domain name, DNS servers, NTP servers, etc. that new nodes will use when they’re launched within the VPC. This makes implementing custom DNS much easier. In EC2 you have to spin up a new node, modify DNS configuration, then restart networking services in order to gain the same effect. We run our own DNS server at Kiip for internal node resolution, and DHCP option sets make that painless (it just makes much more sense to type east-web-001 into your browser instead of 10.101.84.22).

And finally, VPC simply provides a much more realistic server environment. While VPC is a unique product to AWS and appears to “lock you in” to AWS, the model that VPC takes is more akin to if you decided to start running your own dedicated hardware. Having this knowledge beforehand and building up the real world experience surrounding it will be invaluable in case you need to move to your own hardware.

这篇文章还列出了 VPC 的一些困难，所有这些困难都或多或少与路由相关:从 VPC 中获取互联网网关或 NAT 实例、VPC 之间的通信、设置到数据中心的 VPN。有时这些可能会非常令人沮丧，而且学习曲线并不简单。尽管如此，仅安全优势就可能值得采取这一行动，而且在 VPC 配置方面，亚马逊支持(如果您愿意付费)非常有帮助。