aws(学习笔记第六课) AWS的虚拟私有，共有子网以及ACL,定义公网碉堡主机子网以及varnish反向代理

news2025/1/13 10:01:39

aws(学习笔记第六课)

  • AWS的虚拟私有，共有子网以及ACL，定义公网碉堡主机子网以及varnish反向代理

学习内容：

  • AWS的虚拟私有，共有子网以及ACL
  • 定义公网碉堡主机子网，私有子网和共有子网以及varnish反向代理

1. AWS的虚拟私有，共有子网以及ACL

  1. AWS的虚拟私有子网，共有云以及ACL
    • AWS的虚拟私有子网
      用户可以在AWS上定义自己的私有子网，比如数据库，应用程序和apache的server，可以在私有网络上构建，之后通过共有网络，进行访问，向外提供服务。其实和C++的面向对象中，private的变量和方法，一定不要定义成public的，对终端用户公开，如出一辙。能在私有云中定义，不需要公开的服务，都要定义要私有云中。
    • AWS的虚拟共有云
      与上面的AWS私有云对应的就是共有云，共有云最终提供给用户服务，对于终端客户开发网络端口，共有网络的服务承上启下，既可以提供服务给用公户，同时能够访问私有子网的应用服务，数据库服务等其他服务。
      ，
    • ACL(network access control list)和SecuityGroup的区别
      • 应用的对象不同
        ACL的设定对象是Subnet，对于Subnet设定网络访问规则。注意，默认的场合，同一个VPC之间的网络都是相通的，但是如果定义了ACL，那么就会根据ACL的限制，没有允许的网络是不通的
        SecurityGroup的设定对象是ec2 server等服务，而不是Subnet。 在这里插入图片描述
      • 有状态（state）和无状态(stateless)
        • ACL没有状态，允许入站的包，如果没有符合出站规则，那么也不能出站。
        • SecurityGroup有状态，允许入站的包，那么都会出站允许。

2. 定义公网碉堡主机子网，私有子网和共有子网

  1. 整体网络拓扑(这里右边的共有子网使用varnish进行反向代理，公开私有子网的apache server)
    在这里插入图片描述

  2. 逐步创建VPC以及其他服务

    • 创建VPC和IGW (Internet GateWay)

      		"VPC": {
			"Type": "AWS::EC2::VPC",
			"Properties": {
				"CidrBlock": "10.0.0.0/16",
				"EnableDnsHostnames": "true"
			}
		},
		"InternetGateway": {
			"Type": "AWS::EC2::InternetGateway",
			"Properties": {
			}
		},
		"VPCGatewayAttachment": {
			"Type": "AWS::EC2::VPCGatewayAttachment",
			"Properties": {
				"VpcId": {"Ref": "VPC"},
				"InternetGatewayId": {"Ref": "InternetGateway"}
			}
		},

    • 创建堡垒机子网(共有子网) Bastion
      CidrBlock是10.0.1.0/24
      RoutePublicSSHBastionToInternet定义，堡垒机子网能够访问internet。
      NetworkAclEntryInPublicSSHBastionSSH，定义internet的其他主机能够访问使用22端口访问（入站规则，egress = true）。
      NetworkAclEntryInPublicSSHBastionEphemeralPorts，定义VPC主机能够访问使用随机端口访问（入站规则，egress = true）。
      NetworkAclEntryOutPublicSSHBastionSSH，定义堡垒子网的主机能够通过22端口访问其他主机（出站规则，egress = false）。
      NetworkAclEntryOutPublicSSHBastionEphemeralPorts，定义internet的主机，能够访问使用随机端口访问（出站规则，egress = false）。

      		"SubnetPublicSSHBastion": {
			"Type": "AWS::EC2::Subnet",
			"Properties": {
				"AvailabilityZone": {"Fn::Select": ["0", {"Fn::GetAZs": ""}]},
				"CidrBlock": "10.0.1.0/24",
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTablePublicSSHBastion": {
			"Type": "AWS::EC2::RouteTable",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTableAssociationPublicSSHBastion": {
			"Type": "AWS::EC2::SubnetRouteTableAssociation",
			"Properties": {
				"SubnetId": {"Ref": "SubnetPublicSSHBastion"},
				"RouteTableId": {"Ref": "RouteTablePublicSSHBastion"}
			}
		},
		"RoutePublicSSHBastionToInternet": {
			"Type": "AWS::EC2::Route",
			"Properties": {
				"RouteTableId": {"Ref": "RouteTablePublicSSHBastion"},
				"DestinationCidrBlock": "0.0.0.0/0",
				"GatewayId": {"Ref": "InternetGateway"}
			},
			"DependsOn": "VPCGatewayAttachment"
		},
		"NetworkAclPublicSSHBastion": {
			"Type": "AWS::EC2::NetworkAcl",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"SubnetNetworkAclAssociationPublicSSHBastion": {
			"Type": "AWS::EC2::SubnetNetworkAclAssociation",
			"Properties": {
				"SubnetId": {"Ref": "SubnetPublicSSHBastion"},
				"NetworkAclId": {"Ref": "NetworkAclPublicSSHBastion"}
			}
		},
		"NetworkAclEntryInPublicSSHBastionSSH": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicSSHBastion"},
				"RuleNumber": "100",
				"Protocol": "6",
				"PortRange": {
					"From": "22",
					"To": "22"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryInPublicSSHBastionEphemeralPorts": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicSSHBastion"},
				"RuleNumber": "200",
				"Protocol": "6",
				"PortRange": {
					"From": "1024",
					"To": "65535"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "10.0.0.0/16"
			}
		},
		"NetworkAclEntryOutPublicSSHBastionSSH": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicSSHBastion"},
				"RuleNumber": "100",
				"Protocol": "6",
				"PortRange": {
					"From": "22",
					"To": "22"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "10.0.0.0/16"
			}
		},
		"NetworkAclEntryOutPublicSSHBastionEphemeralPorts": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicSSHBastion"},
				"RuleNumber": "200",
				"Protocol": "6",
				"PortRange": {
					"From": "1024",
					"To": "65535"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},

    • 创建varnish子网(共有子网) varnish

      		"SubnetPublicVarnish": {
			"Type": "AWS::EC2::Subnet",
			"Properties": {
				"AvailabilityZone": {"Fn::Select": ["0", {"Fn::GetAZs": ""}]},
				"CidrBlock": "10.0.2.0/24",
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTablePublicVarnish": {
			"Type": "AWS::EC2::RouteTable",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTableAssociationPublicVarnish": {
			"Type": "AWS::EC2::SubnetRouteTableAssociation",
			"Properties": {
				"SubnetId": {"Ref": "SubnetPublicVarnish"},
				"RouteTableId": {"Ref": "RouteTablePublicVarnish"}
			}
		},
		"RoutePublicVarnishToInternet": {
			"Type": "AWS::EC2::Route",
			"Properties": {
				"RouteTableId": {"Ref": "RouteTablePublicVarnish"},
				"DestinationCidrBlock": "0.0.0.0/0",
				"GatewayId": {"Ref": "InternetGateway"}
			},
			"DependsOn": "VPCGatewayAttachment"
		},
		"NetworkAclPublicVarnish": {
			"Type": "AWS::EC2::NetworkAcl",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"SubnetNetworkAclAssociationPublicVarnish": {
			"Type": "AWS::EC2::SubnetNetworkAclAssociation",
			"Properties": {
				"SubnetId": {"Ref": "SubnetPublicVarnish"},
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"}
			}
		},
		"NetworkAclEntryInPublicVarnishSSH": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"},
				"RuleNumber": "100",
				"Protocol": "6",
				"PortRange": {
					"From": "22",
					"To": "22"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "10.0.1.0/24"
			}
		},
		"NetworkAclEntryInPublicVarnishHTTP": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"},
				"RuleNumber": "110",
				"Protocol": "6",
				"PortRange": {
					"From": "80",
					"To": "80"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryInPublicVarnishEphemeralPorts": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"},
				"RuleNumber": "200",
				"Protocol": "6",
				"PortRange": {
					"From": "1024",
					"To": "65535"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryOutPublicVarnishHTTP": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"},
				"RuleNumber": "100",
				"Protocol": "6",
				"PortRange": {
					"From": "80",
					"To": "80"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryOutPublicVarnishHTTPS": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"},
				"RuleNumber": "110",
				"Protocol": "6",
				"PortRange": {
					"From": "443",
					"To": "443"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryOutPublicVarnishEphemeralPorts": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"},
				"RuleNumber": "200",
				"Protocol": "6",
				"PortRange": {
					"From": "1024",
					"To": "65535"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},

    • 创建私有子网

      		"SubnetPrivateApache": {
			"Type": "AWS::EC2::Subnet",
			"Properties": {
				"AvailabilityZone": {"Fn::Select": ["0", {"Fn::GetAZs": ""}]},
				"CidrBlock": "10.0.3.0/24",
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTablePrivateApache": {
			"Type": "AWS::EC2::RouteTable",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTableAssociationPrivateApache": {
			"Type": "AWS::EC2::SubnetRouteTableAssociation",
			"Properties": {
				"SubnetId": {"Ref": "SubnetPrivateApache"},
				"RouteTableId": {"Ref": "RouteTablePrivateApache"}
			}
		},
		"RoutePrivateApacheToInternet": {
			"Type": "AWS::EC2::Route",
			"Properties": {
				"RouteTableId": {"Ref": "RouteTablePrivateApache"},
				"DestinationCidrBlock": "0.0.0.0/0",
				"InstanceId": {"Ref": "NatServer"}
			}
		},
		"NetworkAclPrivateApache": {
			"Type": "AWS::EC2::NetworkAcl",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"SubnetNetworkAclAssociationPrivateApache": {
			"Type": "AWS::EC2::SubnetNetworkAclAssociation",
			"Properties": {
				"SubnetId": {"Ref": "SubnetPrivateApache"},
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"}
			}
		},
		"NetworkAclEntryInPrivateApacheSSH": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"},
				"RuleNumber": "100",
				"Protocol": "6",
				"PortRange": {
					"From": "22",
					"To": "22"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "10.0.1.0/24"
			}
		},
		"NetworkAclEntryInPrivateApacheHTTP": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"},
				"RuleNumber": "110",
				"Protocol": "6",
				"PortRange": {
					"From": "80",
					"To": "80"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "10.0.2.0/24"
			}
		},
		"NetworkAclEntryInPrivateApacheEphemeralPorts": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"},
				"RuleNumber": "200",
				"Protocol": "6",
				"PortRange": {
					"From": "1024",
					"To": "65535"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryOutPrivateApacheHTTP": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"},
				"RuleNumber": "100",
				"Protocol": "6",
				"PortRange": {
					"From": "80",
					"To": "80"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryOutPrivateApacheHTTPS": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"},
				"RuleNumber": "110",
				"Protocol": "6",
				"PortRange": {
					"From": "443",
					"To": "443"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryOutPrivateApacheEphemeralPorts": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"},
				"RuleNumber": "200",
				"Protocol": "6",
				"PortRange": {
					"From": "1024",
					"To": "65535"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "10.0.0.0/16"
			}
		},

    • 创建整体的AWS的stack

      {
	"AWSTemplateFormatVersion": "2010-09-09",
	"Description": "(VPC)",
	"Parameters": {
		"KeyName": {
			"Description": "Key Pair name",
			"Type": "AWS::EC2::KeyPair::KeyName",
			"Default": "my-cli-key"
		}
	},
	"Mappings": {
		"EC2RegionMap": {
			"ap-northeast-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-cbf90ecb", "AmazonLinuxNATAMIHVMEBSBacked64bit": "ami-03cf3903"},
			"ap-southeast-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-68d8e93a", "AmazonLinuxNATAMIHVMEBSBacked64bit": "ami-b49dace6"},
			"ap-southeast-2": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-fd9cecc7", "AmazonLinuxNATAMIHVMEBSBacked64bit": "ami-e7ee9edd"},
			"eu-central-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-a8221fb5", "AmazonLinuxNATAMIHVMEBSBacked64bit": "ami-46073a5b"},
			"eu-west-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-a10897d6", "AmazonLinuxNATAMIHVMEBSBacked64bit": "ami-6975eb1e"},
			"sa-east-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-b52890a8", "AmazonLinuxNATAMIHVMEBSBacked64bit": "ami-fbfa41e6"},
			"us-east-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-1ecae776", "AmazonLinuxNATAMIHVMEBSBacked64bit": "ami-303b1458"},
			"us-west-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-d114f295", "AmazonLinuxNATAMIHVMEBSBacked64bit": "ami-7da94839"},
			"us-west-2": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-e7527ed7", "AmazonLinuxNATAMIHVMEBSBacked64bit": "ami-69ae8259"}
		}
	},
	"Resources": {
		"SecurityGroup": {
			"Type": "AWS::EC2::SecurityGroup",
			"Properties": {
				"GroupDescription": "My security group",
				"VpcId": {"Ref": "VPC"}
			}
		},
		"SecurityGroupIngress": {
			"Type": "AWS::EC2::SecurityGroupIngress",
			"Properties":{
				"IpProtocol": "-1",
				"FromPort": "-1",
				"ToPort": "-1",
				"CidrIp": "0.0.0.0/0",
				"GroupId": {"Ref": "SecurityGroup"}
			}
		},
		"SecurityGroupEgress": {
			"Type": "AWS::EC2::SecurityGroupEgress",
			"Properties":{
				"IpProtocol": "-1",
				"FromPort": "-1",
				"ToPort": "-1",
				"CidrIp": "0.0.0.0/0",
				"GroupId": {"Ref": "SecurityGroup"}
			}
		},
		"VPC": {
			"Type": "AWS::EC2::VPC",
			"Properties": {
				"CidrBlock": "10.0.0.0/16",
				"EnableDnsHostnames": "true"
			}
		},
		"InternetGateway": {
			"Type": "AWS::EC2::InternetGateway",
			"Properties": {
			}
		},
		"VPCGatewayAttachment": {
			"Type": "AWS::EC2::VPCGatewayAttachment",
			"Properties": {
				"VpcId": {"Ref": "VPC"},
				"InternetGatewayId": {"Ref": "InternetGateway"}
			}
		},
		"SubnetPublicSSHBastion": {
			"Type": "AWS::EC2::Subnet",
			"Properties": {
				"AvailabilityZone": {"Fn::Select": ["0", {"Fn::GetAZs": ""}]},
				"CidrBlock": "10.0.1.0/24",
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTablePublicSSHBastion": {
			"Type": "AWS::EC2::RouteTable",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTableAssociationPublicSSHBastion": {
			"Type": "AWS::EC2::SubnetRouteTableAssociation",
			"Properties": {
				"SubnetId": {"Ref": "SubnetPublicSSHBastion"},
				"RouteTableId": {"Ref": "RouteTablePublicSSHBastion"}
			}
		},
		"RoutePublicSSHBastionToInternet": {
			"Type": "AWS::EC2::Route",
			"Properties": {
				"RouteTableId": {"Ref": "RouteTablePublicSSHBastion"},
				"DestinationCidrBlock": "0.0.0.0/0",
				"GatewayId": {"Ref": "InternetGateway"}
			},
			"DependsOn": "VPCGatewayAttachment"
		},
		"NetworkAclPublicSSHBastion": {
			"Type": "AWS::EC2::NetworkAcl",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"SubnetNetworkAclAssociationPublicSSHBastion": {
			"Type": "AWS::EC2::SubnetNetworkAclAssociation",
			"Properties": {
				"SubnetId": {"Ref": "SubnetPublicSSHBastion"},
				"NetworkAclId": {"Ref": "NetworkAclPublicSSHBastion"}
			}
		},
		"NetworkAclEntryInPublicSSHBastionSSH": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicSSHBastion"},
				"RuleNumber": "100",
				"Protocol": "6",
				"PortRange": {
					"From": "22",
					"To": "22"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryInPublicSSHBastionEphemeralPorts": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicSSHBastion"},
				"RuleNumber": "200",
				"Protocol": "6",
				"PortRange": {
					"From": "1024",
					"To": "65535"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "10.0.0.0/16"
			}
		},
		"NetworkAclEntryOutPublicSSHBastionSSH": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicSSHBastion"},
				"RuleNumber": "100",
				"Protocol": "6",
				"PortRange": {
					"From": "22",
					"To": "22"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "10.0.0.0/16"
			}
		},
		"NetworkAclEntryOutPublicSSHBastionEphemeralPorts": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicSSHBastion"},
				"RuleNumber": "200",
				"Protocol": "6",
				"PortRange": {
					"From": "1024",
					"To": "65535"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"SubnetPublicVarnish": {
			"Type": "AWS::EC2::Subnet",
			"Properties": {
				"AvailabilityZone": {"Fn::Select": ["0", {"Fn::GetAZs": ""}]},
				"CidrBlock": "10.0.2.0/24",
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTablePublicVarnish": {
			"Type": "AWS::EC2::RouteTable",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTableAssociationPublicVarnish": {
			"Type": "AWS::EC2::SubnetRouteTableAssociation",
			"Properties": {
				"SubnetId": {"Ref": "SubnetPublicVarnish"},
				"RouteTableId": {"Ref": "RouteTablePublicVarnish"}
			}
		},
		"RoutePublicVarnishToInternet": {
			"Type": "AWS::EC2::Route",
			"Properties": {
				"RouteTableId": {"Ref": "RouteTablePublicVarnish"},
				"DestinationCidrBlock": "0.0.0.0/0",
				"GatewayId": {"Ref": "InternetGateway"}
			},
			"DependsOn": "VPCGatewayAttachment"
		},
		"NetworkAclPublicVarnish": {
			"Type": "AWS::EC2::NetworkAcl",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"SubnetNetworkAclAssociationPublicVarnish": {
			"Type": "AWS::EC2::SubnetNetworkAclAssociation",
			"Properties": {
				"SubnetId": {"Ref": "SubnetPublicVarnish"},
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"}
			}
		},
		"NetworkAclEntryInPublicVarnishSSH": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"},
				"RuleNumber": "100",
				"Protocol": "6",
				"PortRange": {
					"From": "22",
					"To": "22"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "10.0.1.0/24"
			}
		},
		"NetworkAclEntryInPublicVarnishHTTP": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"},
				"RuleNumber": "110",
				"Protocol": "6",
				"PortRange": {
					"From": "80",
					"To": "80"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryInPublicVarnishEphemeralPorts": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"},
				"RuleNumber": "200",
				"Protocol": "6",
				"PortRange": {
					"From": "1024",
					"To": "65535"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryOutPublicVarnishHTTP": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"},
				"RuleNumber": "100",
				"Protocol": "6",
				"PortRange": {
					"From": "80",
					"To": "80"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryOutPublicVarnishHTTPS": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"},
				"RuleNumber": "110",
				"Protocol": "6",
				"PortRange": {
					"From": "443",
					"To": "443"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryOutPublicVarnishEphemeralPorts": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPublicVarnish"},
				"RuleNumber": "200",
				"Protocol": "6",
				"PortRange": {
					"From": "1024",
					"To": "65535"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"SubnetPrivateApache": {
			"Type": "AWS::EC2::Subnet",
			"Properties": {
				"AvailabilityZone": {"Fn::Select": ["0", {"Fn::GetAZs": ""}]},
				"CidrBlock": "10.0.3.0/24",
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTablePrivateApache": {
			"Type": "AWS::EC2::RouteTable",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"RouteTableAssociationPrivateApache": {
			"Type": "AWS::EC2::SubnetRouteTableAssociation",
			"Properties": {
				"SubnetId": {"Ref": "SubnetPrivateApache"},
				"RouteTableId": {"Ref": "RouteTablePrivateApache"}
			}
		},
		"NetworkAclPrivateApache": {
			"Type": "AWS::EC2::NetworkAcl",
			"Properties": {
				"VpcId": {"Ref": "VPC"}
			}
		},
		"SubnetNetworkAclAssociationPrivateApache": {
			"Type": "AWS::EC2::SubnetNetworkAclAssociation",
			"Properties": {
				"SubnetId": {"Ref": "SubnetPrivateApache"},
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"}
			}
		},
		"NetworkAclEntryInPrivateApacheSSH": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"},
				"RuleNumber": "100",
				"Protocol": "6",
				"PortRange": {
					"From": "22",
					"To": "22"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "10.0.1.0/24"
			}
		},
		"NetworkAclEntryInPrivateApacheHTTP": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"},
				"RuleNumber": "110",
				"Protocol": "6",
				"PortRange": {
					"From": "80",
					"To": "80"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "10.0.2.0/24"
			}
		},
		"NetworkAclEntryInPrivateApacheEphemeralPorts": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"},
				"RuleNumber": "200",
				"Protocol": "6",
				"PortRange": {
					"From": "1024",
					"To": "65535"
				},
				"RuleAction": "allow",
				"Egress": "false",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryOutPrivateApacheHTTP": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"},
				"RuleNumber": "100",
				"Protocol": "6",
				"PortRange": {
					"From": "80",
					"To": "80"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryOutPrivateApacheHTTPS": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"},
				"RuleNumber": "110",
				"Protocol": "6",
				"PortRange": {
					"From": "443",
					"To": "443"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "0.0.0.0/0"
			}
		},
		"NetworkAclEntryOutPrivateApacheEphemeralPorts": {
			"Type": "AWS::EC2::NetworkAclEntry",
			"Properties": {
				"NetworkAclId": {"Ref": "NetworkAclPrivateApache"},
				"RuleNumber": "200",
				"Protocol": "6",
				"PortRange": {
					"From": "1024",
					"To": "65535"
				},
				"RuleAction": "allow",
				"Egress": "true",
				"CidrBlock": "10.0.0.0/16"
			}
		},
		"BastionHost": {
			"Type": "AWS::EC2::Instance",
			"Properties": {
				"ImageId": {"Fn::FindInMap": ["EC2RegionMap", {"Ref": "AWS::Region"}, "AmazonLinuxAMIHVMEBSBacked64bit"]},
				"InstanceType": "t2.micro",
				"KeyName": {"Ref": "KeyName"},
				"NetworkInterfaces": [{
					"AssociatePublicIpAddress": "true",
					"DeleteOnTermination": "true",
					"SubnetId": {"Ref": "SubnetPublicSSHBastion"},
					"DeviceIndex": "0",
					"GroupSet": [{"Ref": "SecurityGroup"}]
				}]
			},
			"DependsOn": "VPCGatewayAttachment"
		},
		"VarnishServer": {
			"Type": "AWS::EC2::Instance",
			"Properties": {
				"ImageId": {"Fn::FindInMap": ["EC2RegionMap", {"Ref": "AWS::Region"}, "AmazonLinuxAMIHVMEBSBacked64bit"]},
				"InstanceType": "t2.micro",
				"KeyName": {"Ref": "KeyName"},
				"NetworkInterfaces": [{
					"AssociatePublicIpAddress": "true",
					"DeleteOnTermination": "true",
					"SubnetId": {"Ref": "SubnetPublicVarnish"},
					"DeviceIndex": "0",
					"GroupSet": [{"Ref": "SecurityGroup"}]
				}],
				"UserData": {"Fn::Base64": {"Fn::Join": ["", [
					"#!/bin/bash -ex\n",
					"yum -y install varnish-3.0.7\n",
					"cat > /etc/varnish/default.vcl << EOF\n",
					"backend default {\n",
					"  .host = \"", {"Fn::GetAtt": ["ApacheServer", "PrivateIp"]} ,"\";\n",
					"  .port = \"80\";\n",
					"}\n",
					"EOF\n",
					"sed -i.bak \"s/^VARNISH_LISTEN_PORT=.*/VARNISH_LISTEN_PORT=80/\" /etc/sysconfig/varnish\n",
					"service varnish start\n",
					"/opt/aws/bin/cfn-signal --stack ", {"Ref": "AWS::StackName"}, " --resource VarnishServer --region ", {"Ref": "AWS::Region"}, "\n"
				]]}}
			},
			"CreationPolicy": {
				"ResourceSignal": {
					"Timeout": "PT5M"
				}
			},
			"DependsOn": "VPCGatewayAttachment"
		},
		"ApacheServer": {
			"Type": "AWS::EC2::Instance",
			"Properties": {
				"ImageId": {"Fn::FindInMap": ["EC2RegionMap", {"Ref": "AWS::Region"}, "AmazonLinuxAMIHVMEBSBacked64bit"]},
				"InstanceType": "t2.micro",
				"KeyName": {"Ref": "KeyName"},
				"NetworkInterfaces": [{
					"AssociatePublicIpAddress": "false",
					"DeleteOnTermination": "true",
					"SubnetId": {"Ref": "SubnetPrivateApache"},
					"DeviceIndex": "0",
					"GroupSet": [{"Ref": "SecurityGroup"}]
				}],
				"UserData": {"Fn::Base64": {"Fn::Join": ["", [
					"#!/bin/bash -ex\n",
					"yum -y install httpd\n",
					"service httpd start\n",
					"/opt/aws/bin/cfn-signal --stack ", {"Ref": "AWS::StackName"}, " --resource ApacheServer --region ", {"Ref": "AWS::Region"}, "\n"
				]]}}
			}
		}
	},
	"Outputs": {
		"BastionHostPublicName": {
			"Value": {"Fn::GetAtt": ["BastionHost", "PublicDnsName"]},
			"Description": "connect via SSH as user ec2-user"
		},
		"VarnishServerPublicName": {
			"Value": {"Fn::GetAtt": ["VarnishServer", "PublicDnsName"]},
			"Description": "handles HTTP requests"
		},
		"VarnishServerPrivateIp": {
			"Value": {"Fn::GetAtt": ["VarnishServer", "PrivateIp"]},
			"Description": "connect via SSH from bastion host"
		},
		"ApacheServerPrivateIp": {
			"Value": {"Fn::GetAtt": ["ApacheServer", "PrivateIp"]},
			"Description": "connect via SSH from bastion host"
		}
	}
}

    • 测试创建结果

      • 执行结果
        在这里插入图片描述
      • 通过堡垒机SSH访问apache server(私有子网)
      • 通过堡varnish反向代理HTTP访问apache server(私有子网)
        注意，这里创建的bastin堡垒机有些ssh连接错误，正在调试。。。

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.coloradmin.cn/o/2215193.html

如若内容造成侵权/违法违规/事实不符，请联系多彩编程网进行投诉反馈，一经查实，立即删除！

相关文章

分享一个中国行政区划多边形2024版（含有十段线）

分享一个中国行政区划多边形2024版（含有十段线）

全国省市县三级行政区划分类 全国有省市县界限数据 十段线 有需要自取
阅读更多...
[Linux系统编程] 线程同步(互斥锁，读写锁，死锁，条件变量，信号量)

[Linux系统编程] 线程同步(互斥锁，读写锁，死锁，条件变量，信号量)

一.线程同步概念 线程同步&#xff1a; 协同步调&#xff0c;对公共区域数据按序互斥访问。防止数据混乱&#xff0c;产生与时间有关的错误。 数据混乱的原因&#xff1a; 1.资源共享(独享资源则不会) 2.调度随机(意味着数据访问会出现竞争)—线程间竞争 3.线程间缺乏必要同步…
阅读更多...
一篇闪击常用放大器电路（学习笔记）

一篇闪击常用放大器电路（学习笔记）

文章目录 声明概念名词经典电路分析反向放大器同向放大器加法器减法器积分电路微分电路差分放大电路电流->电压转换电路电压->电流转换电路 虚短与虚断一、虚短二、虚断 一些碎碎念 声明 ​ 本文是主要基于以下两篇博客所做的笔记&#xff1a; 模电四&#xff1a;基本放…
阅读更多...
图论day60|108.冗余连接（卡码网） 、109.冗余连接II（卡码网）【并查集 摧毁信心的一题，胆小的走开！】

图论day60|108.冗余连接（卡码网） 、109.冗余连接II（卡码网）【并查集 摧毁信心的一题，胆小的走开！】

图论day60|108.冗余连接&#xff08;卡码网&#xff09;、109.冗余连接II&#xff08;卡码网&#xff09;【并查集 摧毁信心的一题&#xff0c;胆小的走开&#xff01;】 108.冗余连接&#xff08;卡码网&#xff09;109.冗余连接II&#xff08;卡码网&#xff09;【并查集 摧毁…
阅读更多...
Flythings学习（四）串口通信

Flythings学习（四）串口通信

文章目录 1 串口编程基本步骤1.1 打开串口1.2 配置串口 1.3 读串口1.4 发送串口1.5 关闭串口 2 综合使用3 如何在软件上保证串口稳定通信4 flythings中的串口通讯5 协议接收部分使用和修改方法6 通讯协议数据怎么和UI控件对接 1 串口编程基本步骤 串口通信有5个步骤 1.打开串口…
阅读更多...
【干货】Ftrans跨网数据摆渡系统，如何实现网间数据安全高效流转？

【干货】Ftrans跨网数据摆渡系统，如何实现网间数据安全高效流转？

随着企业数字化转型的逐步深入&#xff0c;企业投入了大量资源进行信息系统建设&#xff0c;信息化程度日益提升。在这一过程中&#xff0c;企业也越来越重视核心数据资产的保护&#xff0c;数据资产的安全防护成为企业面临的重大挑战。 一、网络隔离的必要性 绝大多数企业为…
阅读更多...
步进电机定时器与编码器定时器关系

步进电机定时器与编码器定时器关系

速度环PID比较计数器的增量公式&#xff1a; 位置环PID比较计数器的增量公式&#xff1a;
阅读更多...
【 香格里拉酒店-注册/登录安全分析报告】

【 香格里拉酒店-注册/登录安全分析报告】

前言 由于网站注册入口容易被黑客攻击&#xff0c;存在如下安全问题&#xff1a; 暴力破解密码&#xff0c;造成用户信息泄露短信盗刷的安全问题&#xff0c;影响业务及导致用户投诉带来经济损失&#xff0c;尤其是后付费客户&#xff0c;风险巨大&#xff0c;造成亏损无底洞 …
阅读更多...
gitLab配置ssh

gitLab配置ssh

1打开git命令行&#xff0c;创建秘钥 ssh-keygen -t rsa -b 4096 -C "用户名xxx.com" 2执行下面的命令查看公钥 cat ~/.ssh/id_rsa.pub 3#复制公钥到gitlab网址上ssh页面添加ssh的key&#xff08;公钥&#xff09; 4本地的git命令行中添加账户邮箱 git config -…
阅读更多...
TOMCAT配置jdk版本的地方

TOMCAT配置jdk版本的地方

阅读更多...
Centos安装Nginx 非Docker

Centos安装Nginx 非Docker

客户的机器属于 Centos7 系列&#xff0c;由于其较为陈旧&#xff0c;2024开始众多镜像和软件源都已失效。此篇文章将详细记录在 Centos7 操作系统上从零开始安装 Nginx 的整个流程。 本文Nginx是安装在/usr/local/nginx下 详细步骤如下&#xff1a; 准备Nginx安装包&#x…
阅读更多...
ABB高性能矢量型变频器ACS380的性能优势

ABB高性能矢量型变频器ACS380的性能优势

ABB ACS380变频器是一款可靠、易用、灵活的高性能矢量型变频器&#xff0c;其优异的电机控制、耐久的设计以及与所有主要工业自动化网络的连接性而成为各类设备电机驱动的理想之选。 1. 广泛的功率范围 ABB ACS380 变频器拥有广泛的功率输出区间&#xff0c;在单项 230V 电压下…
阅读更多...
springboot员工管理系统-计算机毕业设计源码35173

springboot员工管理系统-计算机毕业设计源码35173

目 录 1 绪论 1.1 研究背景与意义 1.2国内外研究现状 1.3论文结构与章节安排 2 系统分析 2.1 可行性分析 2.1.1 技术可行性分析 2.1.2 经济可行性分析 2.1.3 法律可行性分析 2.2 系统功能分析 2.2.1 功能性分析 2.2.2 非功能性分析 2.3 系统用例分析 2.4 系统流程…
阅读更多...
第三方软件测评机构分享：软件性能测试方法

第三方软件测评机构分享：软件性能测试方法

软件性能测试指测试人员通过各种手段检测产品是否符合性能指标、评估系统服务能力和完成系统优化的测试活动&#xff0c;专业第三方软件测评机构卓码软件测评简要分享以下几种性能测试方法&#xff1a; 1.压力测试 　　通过对软件系统不断施加压力&#xff0c;识别系统性能拐…
阅读更多...
07 django管理系统 - 部门管理 - 搜索部门

07 django管理系统 - 部门管理 - 搜索部门

在dept_list.html中&#xff0c;添加搜索框 <div class"container-fluid"><div style"margin-bottom: 10px" class"clearfix"><div class"panel panel-default"><!-- Default panel contents --><div clas…
阅读更多...
工程文件参考——STM32+HAL+SPI主从机通讯

工程文件参考——STM32+HAL+SPI主从机通讯

文章目录 前言CubeMX设置SPI设置NSS设置 SPI从机代码SPI主机代码 前言 关于如何简单的写一个稳定的SPI主从机通讯&#xff0c;思路很简单 1、SPI高速传输的时候很容易出现错位之类的问题&#xff0c;CRC的校验首先是必要的。在STM32中SPI使用DMA通讯可以自动执行CRC的校验&…
阅读更多...
路由器原理和静态路由配置

路由器原理和静态路由配置

一、路由器的工作原理 根据路由表转发数据 接收数据包→查看目的地址→与路由表进行匹配找到转发端口→转发到该端口 二、路由表的形成 它是路由器中维护的路由条目的集合&#xff0c;路由器根据路由表做路径选择&#xff0c;里面记录了网段ip地址和对应下一跳接口的接口号。…
阅读更多...
人工智能实训室建设的必要性

人工智能实训室建设的必要性

在当今科技迅猛发展的时代&#xff0c;人工智能&#xff08;AI&#xff09;已不再局限于科幻电影的虚构情节&#xff0c;而是作为一股颠覆性力量&#xff0c;深刻影响着全球经济、社会乃至文化的发展。随着《新一代人工智能发展规划》等政策的出台&#xff0c;中国已明确将人工…
阅读更多...
RA6M5——GPIO

RA6M5——GPIO

文章目录 GPIO输入输出RASC图形化配置输出模式&#xff1a;输入模式&#xff1a;配置选项&#xff1a; 接口函数实例代码&#xff1a; GPIO输入输出 RASC图形化配置 输出模式&#xff1a; 输入模式&#xff1a; 配置选项&#xff1a; 配置项取值/描述Model “Input mode”&a…
阅读更多...
疾病防控|基于springBoot的疾病防控综合系统设计与实现(附项目源码+论文+数据库）

疾病防控|基于springBoot的疾病防控综合系统设计与实现(附项目源码+论文+数据库）

私信或留言即免费送开题报告和任务书&#xff08;可指定任意题目&#xff09; 目录 一、摘要 二、相关技术 三、系统设计 四、数据库设计 五、核心代码 六、论文参考 七、源码获取 一、摘要 在如今社会上&#xff0c;关于信息上面的处理&#xff0c;没有任何…
阅读更多...
推荐文章
最新文章

Copyright @ 2022~2023