AWS Networking Deep Dive

# Enable prefix delegation for VPC CNI in EKS
kubectl set env daemonset aws-node -n kube-system \
  ENABLE_PREFIX_DELEGATION=true \
  WARM_PREFIX_TARGET=1

# Verify prefix delegation is active
kubectl get ds aws-node -n kube-system -o json | \
  jq '.spec.template.spec.containers[0].env[] | select(.name | startswith("ENABLE_PREFIX"))'

# Check max pods for nodes with prefix delegation
# For m7g.large: (3 ENIs - 1) * 16 prefixes * 16 IPs per prefix + 2 = 514
# But capped at 110 by default Kubernetes kubelet setting
kubectl get nodes -o json | \
  jq '.items[].status.capacity.pods'

# Transit Gateway with network segmentation
Resources:
  TransitGateway:
    Type: AWS::EC2::TransitGateway
    Properties:
      DefaultRouteTableAssociation: disable
      DefaultRouteTablePropagation: disable
      DnsSupport: enable
      VpnEcmpSupport: enable

  # Route tables for each segment
  SharedServicesRT:
    Type: AWS::EC2::TransitGatewayRouteTable
    Properties:
      TransitGatewayId: !Ref TransitGateway
      Tags: [{Key: Name, Value: shared-services-rt}]

  ProductionRT:
    Type: AWS::EC2::TransitGatewayRouteTable
    Properties:
      TransitGatewayId: !Ref TransitGateway
      Tags: [{Key: Name, Value: production-rt}]

  DevelopmentRT:
    Type: AWS::EC2::TransitGatewayRouteTable
    Properties:
      TransitGatewayId: !Ref TransitGateway
      Tags: [{Key: Name, Value: development-rt}]

  # Shared services can reach all VPCs
  SharedToAllPropagation:
    Type: AWS::EC2::TransitGatewayRouteTablePropagation
    Properties:
      TransitGatewayRouteTableId: !Ref SharedServicesRT
      TransitGatewayAttachmentId: !Ref ProdAttachment

  # Production VPCs can reach shared services and other prod
  ProdToSharedPropagation:
    Type: AWS::EC2::TransitGatewayRouteTablePropagation
    Properties:
      TransitGatewayRouteTableId: !Ref ProductionRT
      TransitGatewayAttachmentId: !Ref SharedServicesAttachment

  # Development can ONLY reach shared services (not production)
  DevToSharedPropagation:
    Type: AWS::EC2::TransitGatewayRouteTablePropagation
    Properties:
      TransitGatewayRouteTableId: !Ref DevelopmentRT
      TransitGatewayAttachmentId: !Ref SharedServicesAttachment

# AWS Network Firewall with domain filtering and IPS
NetworkFirewall:
  Type: AWS::NetworkFirewall::Firewall
  Properties:
    FirewallName: central-inspection-fw
    VpcId: !Ref InspectionVPC
    SubnetMappings:
      - SubnetId: !Ref FirewallSubnetA
      - SubnetId: !Ref FirewallSubnetB
    FirewallPolicyArn: !Ref FirewallPolicy

FirewallPolicy:
  Type: AWS::NetworkFirewall::FirewallPolicy
  Properties:
    FirewallPolicyName: inspection-policy
    FirewallPolicy:
      StatelessDefaultActions: [aws:forward_to_sfe]
      StatelessFragmentDefaultActions: [aws:forward_to_sfe]
      StatefulRuleGroupReferences:
        - ResourceArn: !Ref DomainFilterRuleGroup
        - ResourceArn: !Ref IPSRuleGroup

DomainFilterRuleGroup:
  Type: AWS::NetworkFirewall::RuleGroup
  Properties:
    RuleGroupName: allowed-domains
    Type: STATEFUL
    Capacity: 100
    RuleGroup:
      RulesSource:
        RulesSourceList:
          TargetTypes: [HTTP_HOST, TLS_SNI]
          Targets:
            - ".amazonaws.com"
            - ".github.com"
            - ".docker.io"
            - ".npmjs.org"
          GeneratedRulesType: ALLOWLIST

IPSRuleGroup:
  Type: AWS::NetworkFirewall::RuleGroup
  Properties:
    RuleGroupName: ips-rules
    Type: STATEFUL
    Capacity: 1000
    RuleGroup:
      RulesSource:
        RulesString: |
          # Block known malicious IPs
          drop ip [203.0.113.0/24] any -> $HOME_NET any (msg:"Blocked malicious source"; sid:1000001; rev:1;)
          # Alert on DNS tunneling
          alert dns $HOME_NET any -> any any (msg:"Possible DNS tunneling"; dns.query; content:".tunnel."; sid:1000002; rev:1;)

# Create a Direct Connect Gateway
aws directconnect create-direct-connect-gateway \
  --direct-connect-gateway-name prod-dx-gw \
  --amazon-side-asn 64512

# Associate DX Gateway with Transit Gateway
aws directconnect create-transit-gateway-association \
  --direct-connect-gateway-id dxgw-12345678 \
  --gateway-id tgw-0123456789abcdef0 \
  --add-allowed-prefixes-to-direct-connect-gateway '[
    {"cidr": "10.0.0.0/8"},
    {"cidr": "172.16.0.0/12"}
  ]'

# Create VPN as backup path through TGW
aws ec2 create-vpn-connection \
  --type ipsec.1 \
  --customer-gateway-id cgw-0123456789abcdef0 \
  --transit-gateway-id tgw-0123456789abcdef0 \
  --options '{
    "EnableAcceleration": true,
    "TunnelOptions": [
      {
        "TunnelInsideCidr": "169.254.10.0/30",
        "PreSharedKey": "use-secrets-manager-in-production"
      },
      {
        "TunnelInsideCidr": "169.254.10.4/30",
        "PreSharedKey": "use-secrets-manager-in-production"
      }
    ]
  }'

# Provider: Expose an internal API via PrivateLink
ServiceNLB:
  Type: AWS::ElasticLoadBalancingV2::LoadBalancer
  Properties:
    Type: network
    Scheme: internal
    Subnets:
      - !Ref PrivateSubnetA
      - !Ref PrivateSubnetB

ServiceTargetGroup:
  Type: AWS::ElasticLoadBalancingV2::TargetGroup
  Properties:
    Port: 8080
    Protocol: TCP
    VpcId: !Ref VPC
    TargetType: ip
    HealthCheckProtocol: HTTP
    HealthCheckPath: /health

ServiceListener:
  Type: AWS::ElasticLoadBalancingV2::Listener
  Properties:
    LoadBalancerArn: !Ref ServiceNLB
    Port: 443
    Protocol: TLS
    Certificates:
      - CertificateArn: !Ref Certificate
    DefaultActions:
      - Type: forward
        TargetGroupArn: !Ref ServiceTargetGroup

EndpointService:
  Type: AWS::EC2::VPCEndpointService
  Properties:
    NetworkLoadBalancerArns:
      - !Ref ServiceNLB
    AcceptanceRequired: true

# Consumer: Connect to the service from another VPC
ServiceEndpoint:
  Type: AWS::EC2::VPCEndpoint
  Properties:
    VpcId: !Ref ConsumerVPC
    ServiceName: !Sub "com.amazonaws.vpce.${AWS::Region}.vpce-svc-0123456789abcdef0"
    VpcEndpointType: Interface
    SubnetIds:
      - !Ref ConsumerSubnetA
      - !Ref ConsumerSubnetB
    SecurityGroupIds:
      - !Ref EndpointSG
    PrivateDnsEnabled: false

# Inbound Resolver Endpoint: On-premises can resolve AWS private DNS
InboundEndpoint:
  Type: AWS::Route53Resolver::ResolverEndpoint
  Properties:
    Direction: INBOUND
    IpAddresses:
      - SubnetId: !Ref PrivateSubnetA
        Ip: 10.0.1.10
      - SubnetId: !Ref PrivateSubnetB
        Ip: 10.0.2.10
    SecurityGroupIds:
      - !Ref DNSSecurityGroup
    Name: inbound-from-onprem

# Outbound Resolver Endpoint: AWS can resolve on-premises DNS
OutboundEndpoint:
  Type: AWS::Route53Resolver::ResolverEndpoint
  Properties:
    Direction: OUTBOUND
    IpAddresses:
      - SubnetId: !Ref PrivateSubnetA
      - SubnetId: !Ref PrivateSubnetB
    SecurityGroupIds:
      - !Ref DNSSecurityGroup
    Name: outbound-to-onprem

# Forwarding Rule: Forward corp.internal queries to on-premises DNS
CorpForwardingRule:
  Type: AWS::Route53Resolver::ResolverRule
  Properties:
    DomainName: corp.internal
    RuleType: FORWARD
    ResolverEndpointId: !Ref OutboundEndpoint
    TargetIps:
      - Ip: 172.16.0.53
        Port: 53
      - Ip: 172.16.0.54
        Port: 53
    Name: forward-corp-internal

# Share the rule with other accounts via RAM
RuleShare:
  Type: AWS::RAM::ResourceShare
  Properties:
    Name: dns-forwarding-rules
    ResourceArns:
      - !GetAtt CorpForwardingRule.Arn
    Principals:
      - !Ref OrganizationArn

# Check current MTU setting
ip link show eth0

# Enable jumbo frames (9001 MTU) on Linux
sudo ip link set dev eth0 mtu 9001

# Persistent MTU configuration (Amazon Linux 2023)
echo 'MTU=9001' | sudo tee -a /etc/sysconfig/network-scripts/ifcfg-eth0

# Test path MTU to a destination
tracepath -n 10.0.10.50

# Create a cluster placement group for HPC
aws ec2 create-placement-group \
  --group-name hpc-cluster \
  --strategy cluster

# Launch instances in the placement group
aws ec2 run-instances \
  --instance-type c7gn.16xlarge \
  --placement GroupName=hpc-cluster \
  --count 8 \
  --image-id ami-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0

-- Create Athena table for VPC Flow Logs
CREATE EXTERNAL TABLE IF NOT EXISTS vpc_flow_logs (
  version int,
  account_id string,
  interface_id string,
  srcaddr string,
  dstaddr string,
  srcport int,
  dstport int,
  protocol bigint,
  packets bigint,
  bytes bigint,
  start bigint,
  end_time bigint,
  action string,
  log_status string
)
PARTITIONED BY (dt string)
ROW FORMAT DELIMITED FIELDS TERMINATED BY ' '
LOCATION 's3://my-flow-logs-bucket/AWSLogs/123456789012/vpcflowlogs/us-east-1/';

-- Find top talkers by bytes transferred
SELECT srcaddr, dstaddr, SUM(bytes) as total_bytes
FROM vpc_flow_logs
WHERE dt = '2024/01/15'
GROUP BY srcaddr, dstaddr
ORDER BY total_bytes DESC
LIMIT 20;

-- Find rejected traffic (potential security issues or misconfigurations)
SELECT srcaddr, dstaddr, dstport, protocol, COUNT(*) as reject_count
FROM vpc_flow_logs
WHERE action = 'REJECT' AND dt = '2024/01/15'
GROUP BY srcaddr, dstaddr, dstport, protocol
ORDER BY reject_count DESC
LIMIT 50;