Ƙofar S3 ko maƙalar ƙarshe ta fuska don abokin ciniki na cikin gida?

Isar da S3 daga hanyar sadarwar ofis ta hanyar VPN na waje ba matsalar hanya ba ce da hanyar tsayayya za ta iya warwarewa ita kaɗai. Ana haɗa maƙalar ƙarshe ta ƙofa da allunan hanya kuma tana hidimar buƙatun da suka tashi a cikin VPC. Maƙalar ƙarshe ta fuska tana sanya fuskokin sadarwa masu sassauci da adireshi na sirri a cikin ƙananan hanyoyin sadarwarka, kuma ana iya isa waɗannan adireshin daga cikin gida ta hanyar VPN ko Direct Connect. Inda buƙatar ta fara ne ke ƙayyade wanne daga cikin biyun kuke buƙata da gaske, kuma aikin DNS, ƙungiyar tsaro da manufa ya biyo bayan wannan amsar.

Raba nau’ikan maƙalar ƙarshe bisa inda buƙatar ta fara

Maƙalar ƙarshe ta ƙofa tana bayyana a matsayin shigarwar allon hanya da ke nuna jerin prefix ɗin da ake sarrafawa. Ba ta da fuskar sadarwa, ba ta da ƙungiyar tsaro kuma ba ta da nata adireshin sirri, kuma wannan ne dalilin da ya sa mai masaukin cikin gida ba zai iya yin hanya zuwa gare ta ba: babu wani abu a wancan gefen da za a yi hanya zuwa gare shi. Zirga-zirgar daga cikin VPC tana isa S3 ne saboda allon hanyar ƙaramin hanyar sadarwa yana aika wannan prefix zuwa maƙalar ƙarshe. Zirga-zirgar daga ko’ina wani wuri ba ta da irin wannan shigarwar da za ta bi.

Maƙalar ƙarshe ta fuska tarin fuskokin sadarwa ne a cikin ƙananan hanyoyin da kuka zaɓa, kowace tana da adireshin sirri daga wannan ƙaramar hanyar da ƙungiyar tsaro da aka haɗa. Wannan shi ne sifin da abokin ciniki mai gauraya zai iya amfani da shi, domin wuri ne na yau da kullum da bututunka zai iya ɗaukar fakiti zuwa gare shi. Hakanan yana nufin maƙalar ƙarshe tana cinye adireshi a cikin ƙaramar hanyar kuma suna iya ƙarewa.

aws ec2 describe-vpc-endpoints --query "VpcEndpoints[].{Id:VpcEndpointId,Type:VpcEndpointType,Service:ServiceName,State:State}" --output table

Karanta ginshiƙin Type maimakon sunan. VPC ɗaya yawanci tana riƙe da nau’ikan biyu don sabis ɗaya, kuma shigarwar da aikinka na cikin gida ke buƙata ita ce ta fuska.

Gina hanyar zuwa adireshin fuska kafin gwada S3

Abubuwa uku dole ne su zama gaskiya a lokaci ɗaya: mai tura hanya na cikin gida yana da hanya zuwa ƙaramar hanyar maƙalar ƙarshe, hanyar dawowa daga wannan ƙaramar hanyar tana isa hanyar sadarwar abokin ciniki, kuma ƙungiyar tsaro ta maƙalar ƙarshe tana karɓar kewayon tushen abokin ciniki. ACL na sadarwar ƙaramar hanyar na iya har yanzu jefar da fakiti bayan duk ukun sun wuce, don haka duba shi a matsayin abu na huɗu ba a matsayin tunani na baya ba.

Hanyar da ke aiki zuwa wani misalin EC2 a cikin VPC ba ta tabbatar da kome daga cikin waɗannan. Tana nuna cewa bututu yana aiki, wanda shi ne kawai ɓangaren hanyar da ka riga ka sani. Tabbatar da adireshin maƙalar ƙarshe daban, sannan ka tabbatar da cewa sunan yana warware zuwa gare shi.

ip route get 10.60.4.37
nc -vz 10.60.4.37 443
openssl s_client -connect 10.60.4.37:443 -servername bucket.vpce-0123456789abcdef0-abc123.s3.us-east-1.vpce.amazonaws.com </dev/null

Umarni na farko yana nuna wace fuska abokin ciniki zai yi amfani da ita. Na biyu yana tabbatar da musayar hannu ta TCP. Na uku yana tabbatar da cewa TLS yana kammalawa da takardar shaida mai inganci ga sunan maƙalar ƙarshe, kuma wannan ita ce binciken da ke kama kuskuren adireshi kafin ka zargi izini.

Yanke shawara wace amsar DNS aikace-aikacen ke samu

Kasancewar maƙalar ƙarshe ta fuska a cikin VPC ba ta juyar da SDK na cikin gida da kanta. Abokin ciniki ko yana amfani da sunan da ya keɓanta da maƙalar ƙarshe da AWS ke wallafawa ga wannan maƙala, ko yankin da aka karɓi bakuncin sirri da ka sanya shi warwarewa daga ofis da gangan.

Don warwarewar gauraya, mai warwarewa na cikin gida yana buƙatar hanyar da aka goyi baya zuwa cikin ra’ayin DNS na VPC, yawanci ta hanyar maƙalar ƙarshe mai shigowa ta Resolver. Kunna DNS na sirri ba tare da fahimtar waɗanne tushen tambaya yake shafawa ba shine hanyar da bincike zai fara mayar da adireshin da ofis ba za ta iya isa ba. Saitin yana canza amsoshi ga tambayoyin da ke zuwa ta hanyar mai warwarewar VPC, ba ga kowane abokin ciniki a ko’ina ba.

dig +short bucket.vpce-0123456789abcdef0-abc123.s3.us-east-1.vpce.amazonaws.com
aws s3api head-bucket --bucket example-artifacts --endpoint-url https://bucket.vpce-0123456789abcdef0-abc123.s3.us-east-1.vpce.amazonaws.com

Gudanar da duka biyu a kan mai masaukin aikace-aikacen, ba a kan akwatin tsalle a cikin VPC ba. Mai warwarewar da ke amsawa a can shine wanda aikinka ke amfani da shi, kuma amsa daban daga wani mai masauki daban ita ce tushen ruɗani mafi yawa a wannan ƙira.

Isarsu ba izini ba ce

Buƙatar da ta isa maƙalar ƙarshe har yanzu tana buƙatar babban mai izini kuma izinin guga da ya dace. Manufar maƙalar ƙarshe na iya taƙaita abin da maƙalar ke yarda da shi, kuma manufar guga na iya taƙaita shi kuma. Isar da fuska ba ta faɗi kome game da waɗanne abubuwa mai kira zai iya karantawa ba.

Gwada duka bangarorin biyu: kira ɗaya mai izini marar lahani a kan gugar da aka nufa, da kira ɗaya da ake tsammanin za a ƙi shi don wani asali ko albarkatu da ke wajen manufar. Ajiye sunan maƙalar ƙarshe, adireshin da aka warware da mahallin manufar tare da sakamakon domin na gaba ya iya maimaita shi. Ƙin da ya ambaci nau’in manufar yana ceton awa ɗaya na zato.

A ƙarshe, yi la’akari da farashin zaɓuɓɓukan biyu kafin samarwa. Maƙalar ƙarshe ta fuska tana lissafin kuɗi ga kowace awa ta fuska da kowace gigabyte, yayin da ta ƙofa ba ta yin haka, kuma wannan bambanci ne ke yanke tambayar ga yawancin ayyuka masu ƙaramin girma waɗanda kawai suke buƙatar shiga daga gefen VPC.