Documentation
9 posts tagged Documentation.
Stop and start an instance and one of its four addresses changes, which is the one in the firewall
Private IPv4, IPv6 and an Elastic IP all survive a stop and start. The auto-assigned public IPv4 does not: it is released on stop and a new one is assigned on start, and the old one can never be recovered. Associate an Elastic IP later and the public address is released then too. Every address costs the same $0.005 an hour, so the one that changes is the one with no reason to exist.
Networking6 minTransit Gateway charges whoever sends, so an inspection VPC pays for every gigabyte it did not originate
Data processing is billed per gigabyte sent to the Transit Gateway, to the owner of the attachment that sent it. Route spoke traffic through an inspection VPC and every gigabyte is sent twice: once by the spoke, once by the inspection VPC on the way back. The charge doubles and half of it lands on the central network account. Flexible Cost Allocation exists to move it, with conditions.
Networking8 minTen kinds of traffic VPC Flow Logs never record
A flow log with no REJECT lines is routinely read as proof that nothing was blocked. AWS documents ten categories of traffic that flow logs exclude by design, and several of them are precisely the traffic you would be looking for when something is wrong.
Networking6 minus-east-1a is not the same place in your account and theirs
Availability Zone names are mapped per account, deliberately and randomly, in every Region that existed before November 2012. A PrivateLink consumer who builds in us-east-1a can be refused an endpoint for a service that is, by the provider's naming, in us-east-1a. The identifier that is the same everywhere is the AZ ID, and almost nothing is written in it.
Networking6 minThe network failures that present as success
Most AWS networking incidents announce themselves with a timeout. A smaller set return a valid answer and do the wrong thing, and every diagnostic instinct that works on the first kind has nothing to grab on the second.
Networking5 minProxy protocol is sent on health checks, where it carries nothing useful
Enable it on an NLB target group and the header is prepended to health check connections too. On those connections it contains no client information at all, so the feature adds nothing there and still marks every target unhealthy.
Networking5 minA Resolver rule outranks your private hosted zone, and the zone is never consulted
Two DNS sources can claim the same domain in one VPC. The Resolver rule wins at equal specificity and the hosted zone is never read — and nothing in the answer reliably tells you which source served it, so the check has to be a configuration check.
Networking6 minThe misconfiguration that does not appear in the API output
A subnet with no explicit route table association is returned by nothing. DescribeRouteTables says so in one line of its own reference, and it means "check the route tables" structurally cannot find the problem.
Networking4 minWhen the AWS docs contradict themselves: NLB client IP preservation
Two pages in the same Network Load Balancer user guide state opposite defaults for client IP preservation. The disagreement decides which security group rules are correct, and getting it wrong produces a target that passes health checks and refuses every client.
Networking6 min