Chapter 12: Security and AWS (Part 3 AWS Gateway services - 9 and counting)

Gateways come in all shapes and sizes!


Image result for The Porta Nigra

The Porta Nigra (Roman city gate) in France, it's even more impressive inside.

AWS Gateways?

Virtual Private Gateway (not 1st order service)

This is one of many "gateways" in AWS (you could make a computer game up around finding your way into AWS via the correct gateway?)  This one is for private connection between VPC and another network. I thought this was just called a VPN :-) It appears to be a hardware device.

Internet Gateway (not 1st order service)

Another gateway. To allow internet connection to AWS services.



How many other AWS gateways are there?

The only 2 gateways that are 1st order AWS services listed in the services/regions page are:

Amazon API Gateway (1st order service)


Amazon API Gateway

APIGateway_Diagram

Amazon Storage Gateway (1st order service)


Amazon Storage Gateway

Image result for amazon storage gateway


AWS Direct Connect (1st order service)


For hybrid storage solutions (on-premises and cloud storage). this seems to also use AWS Direct Connect. Isn't this just a VPN? No, looks like a faster/more secure connection for a VPN.
Does this count as a gateway service? Yes I think so as it uses gateways protocols.


There are also (that I could find):

NAT Gateway (not 1st order service)


NAT Gateways

Is a Managed NAT Gateway just the same?

Device Gateway (not 1st order service)

This is for IoT

Device Gateway

The AWS IoT Device Gateway enables devices to securely and efficiently communicate with AWS IoT. The Device Gateway can exchange messages using a publication/subscription model, which enables one-to-one and one-to-many communications. With this one-to-many communication pattern AWS IoT makes it possible for a connected device to broadcast data to multiple subscribers for a given topic. The Device Gateway supports MQTT, WebSockets, and HTTP 1.1 protocols and you can easily implement support for proprietary or legacy protocols. The Device Gateway scales automatically to support over a billion devices without provisioning infrastructure.
To learn more read Protocols in the AWS IoT user guide.
Looks like it's just an entry point into the message brokers as it uses MQTT

MQTT is a lightweight internet pub-sub protocol (like XMPP which I have used before).

And Remote Desktop Gateway RD Gateway

For connecting to windows AMIs with RDP. Don't need a VPN.

Quick Start architecture for Remote Desktop Gateway on the AWS Cloud



So here's my "final" list of AWS gateway services, 9 so far:

1st order gateway services

  • Amazon API Gateway
  • Amazon Storage Gateway (how many variants?)
  • Amazon Direct Connect (VPN)

Not 1st order gateway services (related to other services)

  • Virtual Private Gateway (VPC)
  • Internet Gateway (VPC)
  • NAT Gateway (VPC)
  • Device Gateway (IoT)
  • Remote Desktop Gateway (RD Gateway, Windows RDP)
  • AD Connector (see below, Active Directory Gateway)


And as usual there are more questions like: Which gateways can interoperate? (if any)? What things can connect to/from each gateway? And what would a reference architecture including all the gateways look like (And if there one? TODO May need to search by each gateway name)

API Gateway and Lambda whitepaper

Storage Gateway architectures

VPG/VPC connectivity options whitepaper

VPC architecture

Device Gateway? Not sure where the best AWS IoT material is yet, here's a picture:

How AWS IoT Works


PS
Possibly some other services are "gateway" services. E.g. Kinesis Firehose? This is listed as an import/export option in the April 2017 AWS service update slides.

Also VM Import/Export? Snowball? Import/Export Disk, Snowball and Snowmobile?!

What's Snowmobile? This sounds like they put your data centre on a truck and tow it to an AWS data centre!

AWS Snowmobile is an Exabyte-scale data transfer service used to move extremely large amounts of data to AWS. You can transfer up to 100PB per Snowmobile, a 45-foot long ruggedized shipping container, pulled by a semi-trailer truck. Snowmobile makes it easy to move massive volumes of data to the cloud, including video libraries, image repositories, or even a complete data center migration. Transferring data with Snowmobile is secure, fast and cost effective.

 Doesn't look anything like a snowmobile :-(

 Image result for aws snowmobile


snowmobiles are a lot more FUN!

Image result for snowmobile



So basically anything that allows you to get data in or out of AWS could count as a gateway...

Oh, so also Active Directory Connector to.

Yes, definitely a gateway service.

AD Connector is a directory gateway with which you can redirect directory requests to your on-premises Microsoft Active Directory without caching any information in the cloud. AD Connector comes in two sizes, small and large. A small AD Connector is designed for smaller organizations of up to 500 users. A large AD Connector can support larger organizations of up to 5,000 users.


Comments

  1. Unknown25 July 2018 at 02:26

    This is a very nice article. thank you for publishing this. i can understand this easily.AWS Online Training

    ReplyDelete
  2. Thanos1 February 2019 at 08:33

    This is a great information on Secure Internet Gateway

    ReplyDelete
  3. Rekha Roy22 November 2021 at 07:08

    Want to change your career in Selenium? Red Prism Group is one of the best training coaching for Selenium in Noida. Now start your career for Selenium Automation with Red Prism Group. Join training institute for selenium in noida.

    ReplyDelete

Post a Comment

Popular posts from this blog

Chapter 11: AWS Directory Service, Cloud Directory

Image
"Name or Number please?" So the 1st telephones systems were point to point, and then hub and spoke. You rang the local exchange, asked to talk to Auntie Jill and the "operator" (think the Matrix) would ring Auntie Jill's phone and connect you (literally with a patch cord) once Auntie Jill had answered. If you wanted to talk to someone not on the local network the operator would call another operator (how did they know which one?) and ask to them to connect and you would eventually get patched through. This was even more fun if you wanted to ring someone overseas, as you would hear the patchwork of operators, some speaking foreign languages (what fun), the the sounds getting fainter and weirder (lots of clicks, "undersea" sound effects like talking down a tube, echos, etc) until finally you heard Auntie Jill's voice saying "hello?" and you could talk to them (which was expensive, and the operators would sometimes break in and say
Read more

AWS Solution Architecture Certification Postscript

Image
So I sat the exam today and past ok yippee. Guess there's no need to continue blogging about AWS certification stuff!? The AWS Certified Solutions Architect – Associate exam is intended for individuals with experience designing distributed applications and systems on the AWS platform. Some general observations. The real exam is somewhat harder than the practice tests and practice exam (about 10% harder?) NONE of the practice test questions appear in the real exam. The focus is only what I would call the legacy IaaS Amazon services. Almost no questions on managed services, Machine Learning, Data Analytics, Lambda, etc. Lots of questions on what I would call systems and networks admin stuff.  I spent a few months trying to learn this stuff but actually I don't think it helped, I'm not sure I got any of these questions right. E.g. the sort of qns were if you have this sort of set up (VPCs, subnets, ACLs, groups, EC2, etc) and this doesn
Read more

Chapter 2: Amazon Simple Storage Service (S3) and Amazon Glacier Storage (for storing your beer?)

Image
Chapter 2: Amazon Simple Storage Service (Amazon S3) and Amazon Glacier Storage The Amazon Glacier Storage Service is designed for cheap long term archival storage, so you want things to stay put in it for a long time. It is a slightly odd choice of name these days given that global warming is a significant threat to Glaciers (Glaciers are "shrinking" and large dangerous chunks are falling off them as in the above image of the warning signs at a famous New Zealand Glacier (Franz Josef Glacier).  Maybe the Amazon "Glaciers" will be the only ones still around in a few 100 years. I initially found it "odd" that the AWS Solutions Architect Certification book introduced storage services before compute services.  However, in hindsight this sort of makes sense as S3 is one of the original services, is core to other services, and introduces many of the AWS concepts, and is a "managed" service so it simpler and more typical in some respects.
Read more