AWS re:Invent 2015 | (NET403) Another Day, Another Billion Packets

There's lots on [LINK] , and talks on youtube ( [VIDEO] is a fav). But the TLDR is this: VPC stands for "Virtual Private Cloud" and it gives you your own virtual data center on AWS. You get a private network that uses whatever IP range you'd like, and you can connect to it privately via VPN or Direct Connect (physical links). You can also connect it to the internet with Elastic IP Addresses. VPCs are free and you can create and edit them programmatically (add subnets, change routes, manage ACLs and security groups) - so they're a useful way to manage an environment of things like EC2 instances, containers, Elastic Load Balancers, RDS databases, Lambda functions, and more, without needing to worry as much about them being exposed to things you don't control. With this latest PrivateLink feature, it's now possible to offer services between VPCs. So you can build a service in its own VPC, and map into other ones, securely.

Here's the ever excellent Eric Brandwine explaining what AWS does at L3 wrt VPC: [VIDEO] Here's the super versatile Colm Mac explaining what AWS does at L4: [LINK] --- Google has been very open about their network infrastructure, here's a nice summary from 2015: [LINK] and not mentioned in that blog... their NetworkLoadBalancer, Maglev: [LINK] (AWS equivalent of which would be HyperPlane: [LINK] allegedly based on S3's load balancer).

You can't snoop on traffic between hosts in the same VPC. Here is a good video explaining why [VIDEO] . The tl;dr; is that your guest OS (the EC2 instance) is not connected to the physical layer 2 network. The host OS hypervisor is and when it receives a packet from the physical NIC, if that packet is not directed to the guest OS then it won't be passed to it. So the NIC on the guest OS (your EC2 instance) will never even see the packets that are not intended for it. Of course this gets slightly more complicated because AWS added some tools for traffic mirroring. So theoretically someone with the right access could setup a mirror to a host they control in the VPC and sniff the traffic that way. But if someone were able to pull that off then you're likely f'ed either way.