Ingabe i-S3 gateway noma i-interface endpoint yeklayenti yasendaweni?

Ukufinyelela ku-S3 kusuka kunethiwekhi yasehhovisi nge-VPN yesayithi akusiyo inkinga yomzila i-route eqinile engayixazulula yodwa. I-gateway endpoint inamathiselwe kumathebula emizila futhi ikhonza izicelo ezivela ngaphakathi kwe-VPC. I-interface endpoint ibeka ama-interface enethiwekhi anwebekayo anamakheli ayimfihlo kuma-subnet akho, futhi lawo makheli ayafinyeleleka kusuka endaweni nge-VPN noma i-Direct Connect. Lapho isicelo siqala khona kunquma ukuthi yikuphi kwalaba ababili okudinga ngempela, futhi umsebenzi we-DNS, iqembu lokuphepha nenqubomgomo ulandela leyo mpendulo.

Ehlukanisa izinhlobo ze-endpoint ngokusho kokuthi isicelo siqala kuphi

I-gateway endpoint ivela njengengxenye yethebula lomzila ekhomba ohlwini lwama-prefix aphethwe. Ayinayo i-interface yenethiwekhi, iqembu lokuphepha noma ikheli layo eliyimfihlo, futhi yikho kanye okwenza ukuthi umsingathi wasendaweni akakwazi ukuyenza i-route: ngaphesheya akukho lutho okungayenziwa i-route. Ithrafikhi evela ngaphakathi kwe-VPC ifinyelela ku-S3 ngoba ithebula lomzila le-subnet lithumela leyo prefix ku-endpoint. Ithrafikhi evela kunoma yikuphi okunye ayinayo ingxenye enjalo engayilanda.

I-interface endpoint iqoqo lama-interface enethiwekhi kuma-subnet okhetha wona, ngayinye inekheli eliyimfihlo elivela kuleyo subnet kanye neqembu lokuphepha elinamathiselwe. Lesi yisimo i-klayenti ehlanganisiwe engasisebenzisa, ngoba iyindawo ejwayelekile i-tunnel yakho engathwala amaphakethe iye kuyo. Futhi kusho ukuthi i-endpoint isebenzisa amakheli ku-subnet futhi angaphela.

aws ec2 describe-vpc-endpoints --query "VpcEndpoints[].{Id:VpcEndpointId,Type:VpcEndpointType,Service:ServiceName,State:State}" --output table

Funda ikholomu ye-Type hhayi igama. I-VPC eyodwa ivamise ukuba nezinhlobo zombili zesevisi eyodwa, futhi ingxenye edingwa uhlelo lwakho lwasendaweni ileyo ye-interface.

Yakha indlela eya ekhelini le-interface ngaphambi kokuhlola i-S3

Izinto ezintathu kufanele zibe yiqiniso ngasikhathi sinye: i-router yasendaweni inendlela eya ku-subnet ye-endpoint, indlela yokubuyela emuva kusuka kuleyo subnet ifinyelela kunethiwekhi yeklayenti, futhi iqembu lokuphepha le-endpoint lamukela ibanga lomthombo weklayenti. I-ACL yenethiwekhi ye-subnet isengalahla iphakethe ngemuva kokuthi zontathu zidlulile, ngakho-ke yihlole njengento yesine hhayi njengomcabango wangemuva.

Indlela esebenza eya kunoma iyiphi i-EC2 instance ngaphakathi kwe-VPC ayifakazeli lutho kwalokhu. Ikhombisa kuphela ukuthi i-tunnel iphezulu, okuyiyo ingxenye eyodwa yendlela obukwazi kakade. Fakazela ikheli le-endpoint ngokwehlukana, bese ufakazela ukuthi igama lixazululeka kulo.

ip route get 10.60.4.37
nc -vz 10.60.4.37 443
openssl s_client -connect 10.60.4.37:443 -servername bucket.vpce-0123456789abcdef0-abc123.s3.us-east-1.vpce.amazonaws.com </dev/null

Umyalo wokuqala ukhombisa ukuthi i-klayenti izosebenzisa iyiphi i-interface. Owesibili ufakazela ukuxhawula kwe-TCP. Owesithathu ufakazela ukuthi i-TLS iqedwa ngesitifiketi esivumelekile egameni le-endpoint, futhi lolu wukuhlola okubamba ikheli elingalungile ngaphambi kokuthi usole izimvume.

Nquma ukuthi iyiphi impendulo ye-DNS etholwa uhlelo

Ukuba khona kwe-interface endpoint ku-VPC akuguquli i-SDK yasendaweni ngokwayo. I-klayenti isebenzisa igama eliqondene ne-endpoint elishicilelwe yi-AWS yaleyondlela, noma indawo ebungazwe ngasese oyenze ngamabomu ukuthi ixazululeke kusuka ehhovisi.

Ukuze kuxazululwe ngendlela ehlanganisiwe, isixazululi sasendaweni sidinga indlela esekelwayo yokungena kumbono we-DNS we-VPC, ngokuvamile nge-endpoint yokungena ye-Resolver. Ukuvula i-DNS yasese ugcwalise ngaphandle kokuqonda ukuthi ithinta imithombo yemibuzo eni, yiyo indlela ukusesha okuqala ngayo ukubuyisela ikheli ihoffisi elingakwazi ukufinyelela kulo. Lokhu kulungiselelwa kushintsha izimpendulo zemibuzo engena ngesixazululi se-VPC, hhayi zayo yonke i-klayenti yonke indawo.

dig +short bucket.vpce-0123456789abcdef0-abc123.s3.us-east-1.vpce.amazonaws.com
aws s3api head-bucket --bucket example-artifacts --endpoint-url https://bucket.vpce-0123456789abcdef0-abc123.s3.us-east-1.vpce.amazonaws.com

Gijima zombili kumsingathi wohlelo, hhayi ebhokisini lokugxuma ngaphakathi kwe-VPC. Isixazululi esiphendula lapho yiso esisetshenziswa umthwalo wakho womsebenzi, futhi impendulo ehlukile evela kumsingathi ohlukile iwumthombo ojwayelekile wokudideka kulo mklamo.

Ukufinyeleleka akusona isigunyazo

Isicelo esifika ku-endpoint sisadinga umphathi ogunyaziwe kanye nemvume yebhakethe esebenzayo. Inqubomgomo ye-endpoint inganciphisa lokho i-endpoint evumela kona, futhi inqubomgomo yebhakethe ingakunciphisa futhi. Ukufinyelela ku-interface akusho lutho ngokuthi yiziphi izinto umshayi angazifunda.

Hlola izinhlangothi zombili: ucingo olugunyaziwe olungenabungozi oluya ebhaketheni elihlosiwe, nokunye okulindeleke ukuthi kunqatshwe ngobunikazi noma umthombo ngaphandle kwenqubomgomo. Gcina igama le-endpoint, ikheli elixazululiwe kanye nomongo wenqubomgomo kanye nomphumela ukuze umuntu olandelayo akwazi ukuphinda. Ukwenqatshwa okusho uhlobo lwenqubomgomo konga ihora lokucabanga.

Ekugcineni, linganisa intengo yalezi zinketho ezimbili ngaphambi kokuhlinzeka. I-interface endpoint ikhokhiswa ngehora le-interface nangegigabhayithi, kuyilapho i-gateway endpoint ingakhokhiswa kanjalo, futhi umehluko lowo unquma umbuzo emisebenzini eminingi yomthwalo womthamo ophansi edinga kuphela ukufinyelela ohlangothini lwe-VPC.