aws(学习笔记第五课)

• AWS的firewall– SecurityGroup，代理转发技术

---

学习内容：

• AWS的firewall– SecurityGroup
• 代理转发技术

1. AWS的filewall– SecurityGroup

1. 控制进入虚拟服务器的网络流量
   • 通常的firewall(防火墙)配置
     
   • AWS上使用安全组进行网络流量的控制
     创建SecurityGroup并用来配置一个ec2 server，但是首先不配置入站和出站规则。新建一个CloudFormation的堆栈。

     {"AWSTemplateFormatVersion": "2010-09-09","Description": " (firewall 1)","Parameters": {"KeyName": {"Description": "Key Pair name","Type": "AWS::EC2::KeyPair::KeyName","Default": "my-cli-key"},"VPC": {"Description": "Just select the one and only default VPC","Type": "AWS::EC2::VPC::Id"},"Subnet": {"Description": "Just select one of the available subnets","Type": "AWS::EC2::Subnet::Id"}},"Mappings": {"EC2RegionMap": {"ap-northeast-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-cbf90ecb"},"ap-southeast-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-68d8e93a"},"ap-southeast-2": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-fd9cecc7"},"eu-central-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-a8221fb5"},"eu-west-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-a10897d6"},"sa-east-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-b52890a8"},"us-east-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-1ecae776"},"us-west-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-d114f295"},"us-west-2": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-e7527ed7"}}},"Resources": {"SecurityGroup": {"Type": "AWS::EC2::SecurityGroup","Properties": {"GroupDescription": "My security group","VpcId": {"Ref": "VPC"}}},"Server": {"Type": "AWS::EC2::Instance","Properties": {"ImageId": {"Fn::FindInMap": ["EC2RegionMap", {"Ref": "AWS::Region"}, "AmazonLinuxAMIHVMEBSBacked64bit"]},"InstanceType": "t2.micro","KeyName": {"Ref": "KeyName"},"SecurityGroupIds": [{"Ref": "SecurityGroup"}],"SubnetId": {"Ref": "Subnet"}}}},"Outputs": {"PublicName": {"Value": {"Fn::GetAtt": ["Server", "PublicDnsName"]},"Description": "Public name (connect via SSH as user ec2-user)"}}
     }
     

   • 创建堆栈
     
   • ec2 server被创建
   • 检查SecurityGroup
     没有创建任何入站规则。
   • 对该ip地址进行进行ping
     
   • 对该SecurityGroup加入ping协议

     {"AWSTemplateFormatVersion": "2010-09-09","Description": "(firewall 2)","Parameters": {"KeyName": {"Description": "Key Pair name","Type": "AWS::EC2::KeyPair::KeyName","Default": "my-cli-key"},"VPC": {"Description": "Just select the one and only default VPC","Type": "AWS::EC2::VPC::Id"},"Subnet": {"Description": "Just select one of the available subnets","Type": "AWS::EC2::Subnet::Id"}},"Mappings": {"EC2RegionMap": {"ap-northeast-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-cbf90ecb"},"ap-southeast-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-68d8e93a"},"ap-southeast-2": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-fd9cecc7"},"eu-central-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-a8221fb5"},"eu-west-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-a10897d6"},"sa-east-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-b52890a8"},"us-east-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-1ecae776"},"us-west-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-d114f295"},"us-west-2": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-e7527ed7"}}},"Resources": {"SecurityGroup": {"Type": "AWS::EC2::SecurityGroup","Properties": {"GroupDescription": "My security group","VpcId": {"Ref": "VPC"}}},"AllowInboundICMP": {"Type": "AWS::EC2::SecurityGroupIngress","Properties": {"GroupId": {"Ref": "SecurityGroup"},"IpProtocol": "icmp","FromPort": "-1","ToPort": "-1","CidrIp": "0.0.0.0/0"}},"Server": {"Type": "AWS::EC2::Instance","Properties": {"ImageId": {"Fn::FindInMap": ["EC2RegionMap", {"Ref": "AWS::Region"}, "AmazonLinuxAMIHVMEBSBacked64bit"]},"InstanceType": "t2.micro","KeyName": {"Ref": "KeyName"},"SecurityGroupIds": [{"Ref": "SecurityGroup"}],"SubnetId": {"Ref": "Subnet"}}}},"Outputs": {"PublicName": {"Value": {"Fn::GetAtt": ["Server", "PublicDnsName"]},"Description": "Public name (connect via SSH as user ec2-user)"}}
     }
     

   • 使用上面CloudFormation代码更新stack
     
     
   • stack更新结束
     *
   • 重新ping该ec2 server
     可以看出入站规则已经生效。
   • 检查ssh的22端口
   • 继续更新CloudFormation，对SecurityGroup配置开放22端口

     {"AWSTemplateFormatVersion": "2010-09-09","Description": " (firewall 3)","Parameters": {"KeyName": {"Description": "Key Pair name","Type": "AWS::EC2::KeyPair::KeyName","Default": "my-cli-key"},"VPC": {"Description": "Just select the one and only default VPC","Type": "AWS::EC2::VPC::Id"},"Subnet": {"Description": "Just select one of the available subnets","Type": "AWS::EC2::Subnet::Id"}},"Mappings": {"EC2RegionMap": {"ap-northeast-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-cbf90ecb"},"ap-southeast-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-68d8e93a"},"ap-southeast-2": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-fd9cecc7"},"eu-central-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-a8221fb5"},"eu-west-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-a10897d6"},"sa-east-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-b52890a8"},"us-east-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-1ecae776"},"us-west-1": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-d114f295"},"us-west-2": {"AmazonLinuxAMIHVMEBSBacked64bit": "ami-e7527ed7"}}},"Resources": {"SecurityGroup": {"Type": "AWS::EC2::SecurityGroup","Properties": {"GroupDescription": "My security group","VpcId": {"Ref": "VPC"}}},"AllowInboundICMP": {"Type": "AWS::EC2::SecurityGroupIngress","Properties": {"GroupId": {"Ref": "SecurityGroup"},"IpProtocol": "icmp","FromPort": "-1","ToPort": "-1","CidrIp": "0.0.0.0/0"}},"AllowInboundSSH": {"Type": "AWS::EC2::SecurityGroupIngress","Properties": {"GroupId": {"Ref": "SecurityGroup"},"IpProtocol": "tcp","FromPort": "22","ToPort": "22","CidrIp": "0.0.0.0/0"}},"Server": {"Type": "AWS::EC2::Instance","Properties": {"ImageId": {"Fn::FindInMap": ["EC2RegionMap", {"Ref": "AWS::Region"}, "AmazonLinuxAMIHVMEBSBacked64bit"]},"InstanceType": "t2.micro","KeyName": {"Ref": "KeyName"},"SecurityGroupIds": [{"Ref": "SecurityGroup"}],"SubnetId": {"Ref": "Subnet"}}}},"Outputs": {"PublicName": {"Value": {"Fn::GetAtt": ["Server", "PublicDnsName"]},"Description": "Public name (connect via SSH as user ec2-user)"}}
     }
     

   • ping这个ec2 server
     

2. 代理转发技术（AgentForward）

1. 使用git bash的场合
   
2. 使用putty的场合
   .