Security Group settings for using sagemaker notebooks in private subnet - amazon-web-services

I am new to sagemaker, and am hoping to use sagemaker in a VPC with a private subnet, so data accessed from s3 is not exposed to public internet.
I have created a vpc with a private subnet (no internet or nat gateway), and have attached a vpc s3 gateway endpoint - with this, can I apply the subnet's default security group settings to the sagemaker notebook instances? ..or are some additional configurations to this required?
Also, I'm hoping to keep internet access for the sagemaker notebook instance, so I can still download python packages (but just wanting to ensure data read from s3 using the private subnet is all okay with its default security group)
Thank you

Related

AWS Cloud9 Environment Creation Failing on both Public and Private Subnets

I'm trying to create an AWS Cloud9 environment to access a DocumentDB server for direct access. However, when creating the Cloud9 environment it takes forever then dies with an error regarding an inability to connect to the functional backing EC2 instance. My VPC has 2 public and private subnets and no matter which subnet I use all of them fail with the same error. I have a web server running on the same VPC under one of the private subnets that can be accessed from the open internet perfectly fine and access my DocumentDB database. I have two NAT gateways, one hooked to each of my public subnets. I also have route tables set up to access the open internet. Is there something that could be obviously affecting the Cloud9 environment's ability to connect to it's EC2 instance?
It turns out that my private subnet route tables were misconfigured; they were forwarding 0.0.0.0/0 to an internet gateway, not to my NAT gateway.

AWS ECS: Issue when access external network

I have an issue regarding to AWS VPC networking, I want to access external API from my ECS task, I've configured ECS in a Private subnet and the only way to access this ECS is trough an load balancer, in some services like Lambda is working (I can access external resources) but in ECS I can't access to them, I tried modifying the security group rules + modify ACL rules but isn't working, If anyone know how I can do, I be very grateful, thanks.
ps: I created the VPC on the UI that AWS has.
For resources in a private subnet to access the Internet, the only option is to send that traffic through a NAT Gateway.
You will have to create an AWS NAT Gateway in at least one of the public subnets of your VPC, and then add a route in each of the private subnets to that NAT Gateway.

Cross Account DMS Replication for RDS instances behind Bastion machines

I have production stacks inside a Production account and development stacks inside a Development account. The stacks are identical and are setup as follows:
Each stack as its own VPC.
Within the VPC are two public subnets spanning to AZs and two private subnets spanning to AZs.
The private Subnets contain the RDS instance.
The public Subnets contain a Bastion EC2 instance which can access the RDS instance.
To access the RDS instance, I either have to SSH into the Bastion machine and access it from there, or I create an SSH tunnel via the Bastion to access it through a Database client application such as PGAdmin.
Current DMS setup:
I would like to be able to use DMS (Database Migration Service) to replication an RDS instance from Production into Development. So far I am trying the following but cannot get it to work:
Create a VPC peering connection between Development VPC and Production VPC
Create a replication instance in the private subnet of the Development VPC
Update the private subnet route tables in the development VPC to route traffic to the CIDR of the production VPC through the VPC peering connection
Ensure the Security group for the replication instance can access both RDS instances.
Main Problem:
When creating the source endpoint in DMS, the wizard only shows RDS instances from the same account and the same region, and only allows RDS instances to be configured using server names and ports, however, the RDS instances in my stacks can only be accessed via Bastion machines using tunnelling. Therefore the test endpoint connection always fails.
Any ideas of how to achieve this cross account replication?
Any good step by step blogs that detail how to do this? I have found a few but they don't seem to have RDS instances sitting behind bastion machines and so they all assume the endpoint configuration wizard can be populated using server names and ports.
Many thanks.
Securing the RDS instances via the Bastion host is sound security practice, of course, for developer/operational access.
For DMS migration service however, you should expect to open security group for both the Target and Source RDS database instances to allow the migration instance to have access to both.
From Network Security for AWS Database Migration Service:
The replication instance must have access to the source and target endpoints. The security group for the replication instance must have network ACLs or rules that allow egress from the instance out on the database port to the database endpoints.
Database endpoints must include network ACLs and security group rules that allow incoming access from the replication instance. You can achieve this using the replication instance's security group, the private IP address, the public IP address, or the NAT gateway’s public address, depending on your configuration.
See
https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.Network.html
For network addressing and to open the RDS private subnet, you'll need a NAT on both source and target. They can be added easily, and then terminated after the migration.
You can now use Network Address Translation (NAT) Gateway, a highly available AWS managed service that makes it easy to connect to the Internet from instances within a private subnet in an AWS Virtual Private Cloud (VPC).
See
https://aws.amazon.com/about-aws/whats-new/2015/12/introducing-amazon-vpc-nat-gateway-a-managed-nat-service/

How to create Private and Public subnets in GCP?

How to create Private and Public subnets in GCP? It is not same as AWS.
In GCP tags decides whether a subnet is private or public.
For public network create routes in VPC section and select the next-hop to Default Internet gateway
For private network create routes in VPC section and select the next-hop to specify and instance and select the nat instance
When create VM , you can change external IP to none.
This will requir NAT / LB to expose services and something like bastion server to login.
Though it's been a while since this was posted but thought to post this anyway as I ran into the same issue. I was doing a GCP-based lab challenge with an instruction to make a VPC private but I couldn't figure it out until I found this statement from an AWS doc located here.
If your subnet is associated with a route table that has a route to an >internet gateway, it's known as a public subnet.
In GCP you will need to remove the default route for internet access to make the VPC private. To make machines in the VPC gain internet access to download updates for example, you will need to create a cloud NAT gateway with cloud router

Can I use AWS ECR from within a private subnet

I have a private subnet inside a VPC, that cannot route to the internet. I'm trying to access amazon ECR, but getting a timeout. My guess is that ECR requires internet connection, however I cannot find any documentation that says that.
Does ECR require internet connection? Is there a way to use it from within a private subnet?
Update 2020
Interface VPC Endpoints are now supported for ECR; meaning now we can configure an endpoint from our private subnet to ECR without a NAT Gateway and still be able to pull images from it.
Documentation: Amazon ECS interface VPC endpoints (AWS PrivateLink)
A private subnet is truly private and only in/out traffic that you specify will be allowed. S3 has VPC Endpoints that allow you to connect to S3 (http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-endpoints.html) without routing through the public internet. VPC endpoint functionality for AWS ECR has been requested (https://forums.aws.amazon.com/thread.jspa?threadID=222124) but to the best of my knowledge it is not yet currently available.
An VPC endpoint for ECR is not available, but requested as the first issue on AWS' container roadmap (created 2018-11-28), implemented as a PrivateLink.
It's in state "Coming soon".
It will cost minimum around 22$/month (PrivateLink costs for 3 availability zones in us-east, without traffic costs), if they don't state it otherwise.