Internet Gateways (IGWs) In Depth

All WinJoes know what an internet gateway is. Many affectionally refer to these as IGWs. But few know what these gateways do in amazing depth.

We aim to bridge that gap and confer, dare we say it, in-depth knowledge. We educate the new generation of "gateway gurus", or "IGW gurus".

So one question for you - NAT. How do IGWs interact with NATs - if at all? Does this differ in AWS versus other clouds? Exercise for the reader.

Subnets are Routing Boundaries not Security Boundaries

AWS, as well as other cloud providers, use subnets to partition virtual networks (e.g. in AWS VPC - Virtual Private Cloud).  

These subnets divide up the IP address space into separate compartments for routing traffic.

In AWS, another way of saying this is "each subnet is a slice of your VPC's CIDR block".

Each subnet block in AWS is tied to a particular AZ, or Availability Zone. Subnets cannot span AZs and this preserves the availability pattern (e.g. one private subnet per AZ).

There are many types of subnet in AWS.  Examples are:

• Public subnet - subnet has a direct route to an internet gateway. Resources in the public subnet can access the public internet.
• Private subnet - subnet has NO direct route to an internet gateway. Resources in the subnet require a NAT device to access the public internet
• VPN-only subnet - the subnet has a route to a Site-to-Site VPN connection through virtual private gateway. The subnet has no route to an internet gateway
• Isolated subnet - not connected to the internet - in fact, no routes to destination outside its VPC
• EVS subnet - a type of subnet created by Amazon EVS (very specific to VMware)

(Sidebar: internet gateway - bridge ("network bridge","network component")  between private network and the internet,enabling traffic routing, protocol translation, NAT, DHCP and security filtering)

Choosing Network Size in AWS - Forward Slash Notation

Network size (in terms of IP address ranges) in AWS is specified using CIDR notation. 

(Sidenote: CIDR stands for classless interdomain routing, which replaced the now obsolete classful networking architecture which prevailed from 1981 to 1993, when CIDR was introduced.  If you are interested in the classful system have a look at RFC 791 which covers IP and describe the class system).

Example:

192.162.1.0/24

The forward slash 24 means the first 24 bits are fixed.  The rest (i.e. last 8 bits) are flexible.

From the AWS documentation: 

"When working with networks in the AWS Cloud, you choose your network size by using CIDR notation. In AWS, the smallest IP range you can have is /28, which provides 16 IP addresses (2^4). The largest IP range you can have is a /16, which provides 65,536 IP addresses (2^16)."

AWS Global Infrastructure and Services

AWS Regions and Availability Zones

AWS Service Endpoints

AWS Services by Region

Python secrets module

The secrets module in Python is used to generate cryptographically strong random numbers.

This should be used in preference to the random module, for modeling and simulation, not cryptography.

The background -

Random numbers are used in cryptographic applications e.g. in key generation, initialization vectors and nonces, and salts in certain signature schemes.

One-time pads also require a truly random source.

Hennessy and Patterson - The "HP" Book

You know if you know.

The "HP Book's" Take on Parallel Processing

Parallelism at multiple levels is a driving force of computer design.  

Belief in that driving force, in pushing it forward, in harnessing it for the progress of humanity - is essential for the computer-oriented changemaker.

Fundamentally applications have two types of parallelism - the data-level and the task-level. Data-level parallelism is what makes GPUs so powerful.