Cornell AWS customers now have two new options for easy access to the private Cornell network in AWS.
Resources deployed to subnets in either offering have network access to other Cornell network resources, specifically:
In the past, each Cornell AWS customer that required access to the private Cornell network in AWS received their own Cornell Standard VPC that provided an AWS VPC for their exclusive use. In contrast, the Multitenant Subnets option described in this document provides similar network connectivity in a set of AWS subnets shared among many Cornell AWS customers. The Exclusive Use Subnets option offers the same network connectivity but sharing is amongst a set of Cornell AWS customers that you specify.
The initial options of the Shared VPC deployment supplies only private subnets to opted-in Cornell AWS accounts. This means that neither option can be used to host a public web site or public APIs, for example. Please contact Cloud Support with feedback about your needs to access to public subnets in the Shared VPC. |
The following table compares the new Shared VPC options with the traditional Cornell Standard VPC.
Benefit | Feature | Description | Cornell Standard VPC | Shared VPC | |
---|---|---|---|---|---|
Multitenant Subnets | Exclusive Use Subnets | ||||
Ease of use | AWS Account integration | Subnets are visible directly from your AWS account, via the web console or API. | |||
No VPC management | Customers do not have to worry about managing a VPC. Subnet, route table, NAT gateway, endpoint, and network ACL management is performed by the CIT Cloud Team. | ||||
Fault-tolerance and Flexibility | AZ flexibility | Use subnets in any us-east-1 Availability Zone. | not by default | ||
Fault-tolerant internet access | Each subnet uses a NAT Gateway in the same Availability Zone as the subnet to route outgoing traffic to the public internet. A NAT Gateway failure in one zone won't affect subnets in other zones. | not by default | |||
Privileged network access | Private Cornell addressing | Resources are assigned IP addresses from the private Cornell network. As such, they reside on the Cornell network and can reach other resources on the Cornell network. | |||
Public subnets | Ability to deploy resources to public subnets, directly accessible from the internet. | ||||
Access to on-campus Cornell networks | Subnets have private network connectivity to the on-campus Cornell network. | ||||
Access to Cornell networks in Azure | Subnet have private network connectivity to private Cornell networks (VNETs) in Azure. | ||||
Access to on-campus Cornell networks | Subnets have private network connectivity to the on-campus Cornell network. | ||||
S3 and DynamoDB gateway endpoints | Gateway endpoints for S3 and Dynamo DB in the VPC make communication with those services quick and private. | not by default | |||
VPC Peering | Peer to arbitrary AWS VPCs | ||||
Security | Baseline network security | Subnets use the Cornell Baseline AWS Network ACL, managed by the CIT Cloud Team. | |||
Customer-defined security groups | Customers manage and control the Security Groups applied to their resources. Thus, they have the final say about what network connectivity is allowed. | ||||
CIDR-based access control | Subnet size allows subnet CIDR blocks to be used for meaningful network access control by your collaborators. | ||||
Known peers | Subnets are used only by teams you know. | ||||
Cost | "Free" NAT Gateways | NAT Gateways are managed and paid for by CIT. NAT Gateways run by customers typically cost at least $1/day. | |||
"Free" VPC Flow Logs | VPC Flow Logs are managed and paid for by CIT. | ||||
Pay for what you use | Customers pay for resources deployed to the Shared VPC as if they were using their own VPC. There are no additional charges for opting into either Shared VPC option. |
Both the Multitenant Subnets and the Exclusive Use Subnets options of the Shared VPC offering support many, many use cases. A few of those are:
Misuse cases are situations where the Multitenant Subnets and the Exclusive Use Subnets option should not or cannot be used. Some of those are:
By requesting and using any Shared VPC offering, you are consenting to follow the Guidelines for Use. |
Send a note to Cloud Support with the following information:
Before provisioning Exclusive Use Subnets we will probably need a short meeting to discuss details. But, get the process started by sending a note to Cloud Support with the following information:
Customers using the Shared VPC offerings must agree to abide by the following guidelines:
See also Best Practices.
These features are being considered for the future. Weigh in on them or suggest others by sending a note to Cloud Support. |
AWS reserves 5 addresses in each subnet for its own use. See Subnet Sizing.
CIDR Notation | Subnet Bits | Total Addresses | Useable Addresses |
---|---|---|---|
/28 | 28 | 16 | 11 |
/27 | 27 | 32 | 27 |
/26 | 26 | 64 | 59 |
/25 | 25 | 128 | 123 |
/24 | 24 | 256 | 251 |