VPC

As explained in Secure APIs

A virtual private cloud is an isolated virtual network environment provided within a cloud platform.

A virtual private cloud (VPC) is an isolated cloud network environment. In AWS, resources in separate VPCs cannot communicate by default, helping separate platform components and limit exposure. section 9.2

Use VPCs as part of network segmentation: connect VPCs only through necessary peering, place internet-facing components in a DMZ, and keep services in private subnets. Restrict traffic with subnet ACLs and security groups, which control permitted IP addresses and ports. section 9.2

API platform layout

Channel inbound traffic through an API gateway in the DMZ while keeping internal APIs and databases in private subnets. A hardened bastion server can provide controlled access to those private resources. section 9.2

Figure 9.10 The DMZ is a region of our network that is exposed to the internet. It’s good practice to channel inbound traffic through the DMZ and keep all our services in private subnets. The DMZ can include elements such as an API gateway and bastion server.

Use the network-topology figure to distinguish the internet-facing DMZ from private service subnets. section 9.2

How Secure APIs covers it

How deep it goes

Explains isolation, peering, subnets, ACLs, and security groups, but stops short of provider configuration steps.

Examples

Uses an API gateway and bastion server in a DMZ while protecting internal APIs and databases in private subnets.

What it assumes

Assumes basic networking concepts such as subnets, IP addresses, ports, and inbound traffic.

What you can do after

Operate/configure network segmentation by isolating resources, controlling subnet traffic, and exposing only tested API endpoints.

How it connects

Connects VPCs with network segmentation, VPC peering, subnets, ACLs, security groups, DMZs, API gateways, and bastion servers.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Amazon Web Services in Action, Third Edition: An in-depth guide to AWSAmazon VPC is a logically isolated virtual network for resources in AWS.
• 

  liveBookmanning.com
  Google Anthos in ActionA virtual private cloud (VPC) is an isolated virtual network that provides address ranges, routing, and connectivity for cloud resources.
• 

  liveBookmanning.com
  Effective Platform EngineeringA virtual private cloud is an isolated logical network within a public cloud that contains configurable address space, subnets, routing, and connectivity controls.

Compare how 4 books explain VPC →

Related concepts

• subnetworkhas part · A subnetwork is a logical subdivision of an IP network with its own address range, routing scope, and network configuration.
• vpc-native clusterused by · A VPC-native cluster is a Kubernetes cluster whose pod and service networking is integrated with a cloud provider's virtual private cloud routing.
• private endpointused by · A private endpoint is a network interface that provides private connectivity to a cloud service through a private network address without exposing traffic to the public internet.
• role-based network structureused by · A role-based network structure organizes clusters and their networks according to operational roles such as production, nonproduction, and preview.
• VPC peeringused by · VPC peering is a cloud networking capability that privately connects separate virtual private clouds by enabling traffic routing between them.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.