Page Comparison

...

At a high level, a VPC is a named container for virtual network.  For example, the Synapse production VPC was assigned a CIDR of 10.2220.0.0/16.  This means Synapse networks contains 65,536 IP address between 10.2220.0.0 and 10.2220.255.255.  The VPC is then further divided into subnets which can be declared as either Private or Public.  Instances contained in Public subnets can be assigned public IP addresses and therefore can be seen on the public internet.  Conversely, instances deployed in private subnets do not have public IP address and cannot be seen by the public internet.  Instance in private subnets are only visible to machines deployed within the containing VPC.  We will cover how internal developers can access to machines in private subnets in a later section.Image RemovedImage Added

Figure 1. Synapse VPC

The Synapse VPC is divided into two six public and six twenty-four private subnets that span two six Availability Zone (AZ): us-east-1a and , us-east-b, us-east-c, us-east-d, us-east-e, us-east-f (see Figure 1).   The deployment of all instances (EC2s and Databases) across two six zones ensure redundancy should an outage occur in a single zone (such as the event in April 2011), and broadens the availablity of instance types. For details on each subnet see Table 1.

...

Table 1.  Synapse VPC 10.22.0.0/16 subnets

...

Given that subnet address cannot overlap and must be allocated from a fix range of IP addresses (defined by the VPC), it would be awkward to dynamical allocate new subnets for each new stack.  Instead, we decided to create fixed/permanent subnets to deploy new stacks into each week, thus returning to the blue green naming scheme.  Since we occasionally need to have three production-capable stacks running at a time, we included a red subnets.  We will continue to give each new stack a numeric designation, but we will also assign a color to each new stack.  Each color will be assigned in a round-robin manner.  For example, stack 226 will be deployed to Red, 227 to Blue, 228 to Green, 229 to Red etc.. The Orange subnets are reserved for shared resources such as the ID generator database.

Public subnets

Any machine that must be publicly visible must be deployed to a public subnet.  Since it is not possible to isolate public subnets from each other, there was little value in creating a public subnet for each color.  Instead, one public subnet per availability zone was created.  Each public subnet will contain the Elastic Beanstalk loadbalancers for each environment (portal, repo, works) of each stack.  There is also a NAT Gateway deployed to each public subnet (need one NAT per AZ).  We will cover the details of the NAT Gateways in a later section.

...

...

Table 4. CIDR for each Color Group

...

...

...

...

Earlier we stated that instances deployed to private subnets are only visible to machines within the same VPC.  This is a true statement.  So how does a developer connect to an instances deployed in a private subnet?  The short answer: the developer must tunnel into the target VPC.  Figure 2. shows an example of an of how a developer connects to the MySQL database at 10.2220.47.107 contained within a private subnet.

...

When a developer makes a VPN connection to vpn.sagebase.org, the VPN client will add a route for 10.2220.0.0/16 on the developer's machine.  This route will direct all network traffic with a destination within 10.2220.0.0/16 to Sage-Admin-Central firewall.  Once connected to the VPN, an attempt to connect to 10.2220.47.107 will proceed as follows:

1. The call to 10.2220.47.107 will be directed to the Sage Firewall
2. If the VPN users belongs to the 'Synapse Developers' group the request will be forwarded to the SNAT
3. The SNAT (a type of NAT) will replace the caller's real address with its own address: 10.1.33.107 and forward the request
4. A route table entry directs all traffic with a destination of 10.2220.0.0/16 to the Synapse VPC Peering connection.
5. The peering connection has been granted access to allow all traffic between the two VPC (10.1.0.0/16 and 10.2220.0.0/16) so the request can tunnel to the Synapse VPC
6. Once in the Synapse VPC, requestor's address will be 10.1.33.107.  Since the database security group allows 10.1.0.0/16 to connect on port 3306, the connection is allowed if the correct database username/password is provided.

...

The resources of the Synapse stack are manged as five separate cloud formation stacks templates shown in Table 9..  All template JSON files are created by merging actual templates with input parameters using Apache's Velocity.

Table 9.  The cloudformation templates of Synapse

...