Do VPCs ki baat-cheet: peering + private DNS

Pehle region aur instance type set hote hain, kaam ka folder banta hai aur Amazon Linux ki latest AMI ID nikaali jaati hai.

Phir payments-userdata.sh banti hai. Yeh Payments server pe port 8080 pe ek chhoti Python API chalati hai. Har request pe API JSON mein "APPROVED" lautati hai, aur saath mein caller field mein request bhejne wale ka IP bhi batati hai. Isi field se baad mein saabit hoga ki traffic private raaste se aaya. API ko systemd service banaya gaya hai, taaki woh hamesha chalti rahe. Orders server ko kuch nahi chalana, isliye uske liye ek khaali user-data file banti hai.

Uske baad mkvpc function ek VPC, public subnet, internet gateway, route table, khaali security group aur ek instance banata hai, aur IDs ko payments_VPC, orders_SG jaise variables mein rakh deta hai. Function do baar chalta hai, ek baar Payments ke liye aur ek baar Orders ke liye.

Aakhir mein Payments server ka private IP aur public DNS name nikaal ke print kiya jaata hai.

export AWS_DEFAULT_REGION=us-east-1 TYPE=t3.micro
mkdir -p ~/deepdive/scn2 && cd ~/deepdive/scn2
AMI_ID=$(aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text)

cat > payments-userdata.sh <<'EOF'
#!/bin/bash
cat > /opt/payments.py <<'PY'
import json, socket
from http.server import BaseHTTPRequestHandler, HTTPServer

class H(BaseHTTPRequestHandler):
    def do_GET(self):
        body = json.dumps({"service": "payments", "status": "APPROVED", "path": self.path,
                           "host": socket.gethostname(), "caller": self.client_address[0]}).encode()
        self.send_response(200); self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body))); self.end_headers(); self.wfile.write(body)

HTTPServer(("0.0.0.0", 8080), H).serve_forever()
PY
cat > /etc/systemd/system/payments.service <<'UNIT'
[Unit]
Description=payments api
[Service]
ExecStart=/usr/bin/python3 /opt/payments.py
Restart=always
[Install]
WantedBy=multi-user.target
UNIT
systemctl daemon-reload && systemctl enable --now payments
EOF
echo '#!/bin/bash' > empty-userdata.sh

mkvpc() {   # name cidr subnet userdata-file
  local VPC SUB IGW RT SG IID
  VPC=$(aws ec2 create-vpc --cidr-block $2 --tag-specifications "ResourceType=vpc,Tags=[{Key=Name,Value=$1},{Key=Project,Value=deepdive-scn2}]" --query Vpc.VpcId --output text)
  aws ec2 modify-vpc-attribute --vpc-id $VPC --enable-dns-hostnames
  SUB=$(aws ec2 create-subnet --vpc-id $VPC --cidr-block $3 --availability-zone us-east-1a --query Subnet.SubnetId --output text)
  aws ec2 modify-subnet-attribute --subnet-id $SUB --map-public-ip-on-launch
  IGW=$(aws ec2 create-internet-gateway --query InternetGateway.InternetGatewayId --output text)
  aws ec2 attach-internet-gateway --internet-gateway-id $IGW --vpc-id $VPC
  RT=$(aws ec2 create-route-table --vpc-id $VPC --query RouteTable.RouteTableId --output text)
  aws ec2 create-route --route-table-id $RT --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW >/dev/null
  aws ec2 associate-route-table --route-table-id $RT --subnet-id $SUB >/dev/null
  SG=$(aws ec2 create-security-group --group-name $1-sg --description "$1" --vpc-id $VPC --query GroupId --output text)
  IID=$(aws ec2 run-instances --image-id $AMI_ID --instance-type $TYPE --subnet-id $SUB --security-group-ids $SG \
    --iam-instance-profile Name=deepdive-ec2-role --user-data file://$4 \
    --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=$1-host},{Key=Project,Value=deepdive-scn2}]" \
    --query 'Instances[0].InstanceId' --output text)
  eval "${1}_VPC=$VPC ${1}_RT=$RT ${1}_SG=$SG ${1}_IID=$IID"
  echo "$1: vpc=$VPC sg=$SG instance=$IID"
}
mkvpc payments 10.10.0.0/16 10.10.1.0/24 payments-userdata.sh
mkvpc orders   10.20.0.0/16 10.20.1.0/24 empty-userdata.sh
aws ec2 wait instance-running --instance-ids $payments_IID $orders_IID
PAY_IP=$(aws ec2 describe-instances --instance-ids $payments_IID --query 'Reservations[0].Instances[0].PrivateIpAddress' --output text)
PAY_DNS=$(aws ec2 describe-instances --instance-ids $payments_IID --query 'Reservations[0].Instances[0].PublicDnsName' --output text)
echo "payments private IP: $PAY_IP   public DNS: $PAY_DNS"

Yeh block Orders VPC se Payments VPC tak ek peering connection ki request bhejta hai aur use turant accept kar leta hai; ek hi account hone ki wajah se tum khud accept kar sakte ho. Phir dono route tables mein routes jode jaate hain. Orders ki table mein "10.10.0.0/16 peering se jao" aur Payments ki table mein "10.20.0.0/16 peering se jao" daala jaata hai, taaki request aur reply dono ka raasta ho.

PCX=$(aws ec2 create-vpc-peering-connection --vpc-id $orders_VPC --peer-vpc-id $payments_VPC \
  --tag-specifications 'ResourceType=vpc-peering-connection,Tags=[{Key=Name,Value=orders-to-payments}]' \
  --query VpcPeeringConnection.VpcPeeringConnectionId --output text)
aws ec2 accept-vpc-peering-connection --vpc-peering-connection-id $PCX >/dev/null
aws ec2 create-route --route-table-id $orders_RT   --destination-cidr-block 10.10.0.0/16 --vpc-peering-connection-id $PCX >/dev/null
aws ec2 create-route --route-table-id $payments_RT --destination-cidr-block 10.20.0.0/16 --vpc-peering-connection-id $PCX >/dev/null

PL-065 course se — asli console reference

Peering request, accept, aur route table mein peer CIDR add karna.

Yeh command Payments SG pe port 8080 ka ek rule jodti hai, jiska source koi IP range nahi balki doosri VPC ka orders-sg hai. Doosri command SG ke rules print karke dikhati hai ki rule sahi se laga.

aws ec2 authorize-security-group-ingress --group-id $payments_SG \
  --ip-permissions "IpProtocol=tcp,FromPort=8080,ToPort=8080,UserIdGroupPairs=[{GroupId=$orders_SG,Description=orders-servers}]"
aws ec2 describe-security-groups --group-ids $payments_SG --query 'SecurityGroups[0].IpPermissions'

Ab yeh rule har us instance ko allow karta hai jo orders-sg mein hai. Agar Orders team 10 naye servers lagaye, toh bhi Payments team ko kuch badalna nahi padega.

Pehli command corp.internal naam ka private hosted zone banati hai, jo shuru mein sirf Payments VPC se juda hota hai, aur uska ID nikaal leti hai. Doosri command isi zone ko Orders VPC se bhi jodti hai, taaki Orders ke servers bhi yeh naam resolve kar sakein. Teesri command zone mein payments.corp.internal naam ka A record banati hai, jo Payments server ke private IP ki taraf hai.

ZONE=$(aws route53 create-hosted-zone --name corp.internal --caller-reference scn2-$(date +%s) \
  --vpc VPCRegion=us-east-1,VPCId=$payments_VPC --hosted-zone-config PrivateZone=true \
  --query HostedZone.Id --output text | cut -d/ -f3)
aws route53 associate-vpc-with-hosted-zone --hosted-zone-id $ZONE --vpc VPCRegion=us-east-1,VPCId=$orders_VPC
aws route53 change-resource-record-sets --hosted-zone-id $ZONE --change-batch "{
  \"Changes\": [{\"Action\": \"UPSERT\", \"ResourceRecordSet\": {
    \"Name\": \"payments.corp.internal\", \"Type\": \"A\", \"TTL\": 60,
    \"ResourceRecords\": [{\"Value\": \"$PAY_IP\"}]}}]}"

PL-065 course se — asli console reference

Private hosted zone bhi isi 'Create hosted zone' form se banti hai — Type private chunna hoga.

Yeh command peering connection ke dono taraf "DNS resolution from peer VPC" option chalu karti hai.

aws ec2 modify-vpc-peering-connection-options --vpc-peering-connection-id $PCX \
  --requester-peering-connection-options AllowDnsResolutionFromRemoteVpc=true \
  --accepter-peering-connection-options AllowDnsResolutionFromRemoteVpc=true

Is option ke bina Orders VPC mein $PAY_DNS ka jawab public IP hota. Tab traffic internet se jaata, aur Payments SG use rok deta, kyunki woh sirf orders-sg ko allow karta hai. Verification V2 mein tum option ko ek baar band karke pehle aur baad, dono haalat dekhoge.