AWS 的 VPC 開放自訂 IPv6 CIDR 了,但還是有 4 的倍數的限制...

AWS 的公告,VPC 裡的 IPv6 可以自訂 CIDR 了:「VPCs and subnets now support more sizes for IPv6 CIDRs」。

不過還是有限制,首先是 VPC 的大小必須是 /44/60 中 4 的倍數,也就是只有 /44/48/52/56 以及 /60 這五個可以用,而 subnet 也有類似的限制,但從 /44/64,所以剛好就是多了 /64 可以用:

Amazon VPC allows customers to create VPCs and subnets of different sizes using IPv6 CIDRs. With this capability, customers can now create VPCs in sizes between /44 and /60, and subnets in sizes between /44 and /64, in increments of /4.

先前的限制是 VPC 只能給 /56 以及 subnet 只能給 /64 的搭配,是個「可以動」但總是覺得「...」的設計:

Before today, AWS supported one standard IPv6 CIDR block size of /56 for VPC and /64 for subnet, whereas IPv4 CIDR block size were flexible for both VPCs and subnets.

不過我實際在 ap-northeast-1 上測試,發現如果是 AWS 發的 IPv6 address,固定就是 /56 的大小,然後 subnet 在選擇的時候可以選 /56/60/64

這邊提到 VPC 可以選擇大小,應該是其他方式帶進來的 IPv6 address?

另外這次的 /4 的遞增限制,我猜是 AWS 裡面 SDN 上面的限制?IPv4 的 CIDR 有 33 個大小 (/0/32),IPv6 上面如果也處理 33 個的話,反過來設計剛好是 /4 遞增的 workaround?

不過話說回來,我記得前陣子 AWS 公佈要收 Public IPv4 address 的費用時 (參考「AWS 將開始收取 IPv4 的 Public IP 費用」),Hacker News 上有人抱怨還是有很多 AWS 的服務是 IPv4 only,在純 IPv6 network 上面是不太會動的;把這些服務的 IPv6 endpoint 生出來應該要趕快放到 roadmap 上...

AWS 的台北區 (Local Zone) 開了

AWS 總算是宣佈啟用台北 Local Zone 了:「AWS Local Zones Expansion: Taipei and Delhi」,中文的公告在「AWS 宣布在台全新 AWS Local Zone 正式啟用」。

翻了一下先前的預告是六月初的時候,大概是四個月前,當時寫了「AWS 宣佈將在台灣推出 Local Zone」這篇。

看 Jeff Barr 提供的 screenshot 可以看到如同先前了解的,就是掛在東京區下面 (ap-northeast-1):

比較奇怪的地方是啟用的方式,我是在在 EC2 的 dashboard 上看到這個進去開 (然後是 Service health),在 VPC 裡面反而沒看到:

然後開了之後要等他幾分鐘啟用,不是幾秒後 refresh 就會出現,我大概等了兩分鐘,跟當初開其他 non-default region 的經驗類似:

然後再回到 VPC 裡面開 subnet,開完後再回到 EC2 上開機器,流程不是很直覺。

另外從「AWS Local Zones features」這邊可以看到目前的服務有限,另外 Jeff Barr 的公告也可以看到目前台北區支援的項目:

After you do this, you can launch Amazon Elastic Compute Cloud (Amazon EC2) instances, create Amazon Elastic Block Store (Amazon EBS) volumes,and make use of other services including Amazon Elastic Container Service (Amazon ECS), Amazon Elastic Kubernetes Service (Amazon EKS), and Amazon Virtual Private Cloud (Amazon VPC). The new Local Zones include T3, C5, M5, R5, and G4dn instances in select sizes, along with General Purpose SSD (gp2) EBS volumes.

不過這邊有不一致的地方:在 AWS 頁面上是寫 T3 是 upcoming,但 Jeff Barr 的公告則是說可以用 T3,這點晚點來測試看看才知道哪個是對的... 因為我現在連 m5.large 也開不起來:

只要把設定換到東京的 subnet 內就正常,這個錯誤訊息實在是不知道發生什麼事情 (已經設 gp2),還得繼續摸...

Linode 的 VPC 與 VLAN

看到 Linode 的「Go Private with VLANs and VPCs」這篇,裡面特地提到了 VLAN

Can a VLAN be used as a VPC on Linode?

The short answer is again, yes, we can use a VLAN as a VPC on Linode.

在「Common Use Cases for Linode's VLAN Service」這篇 (發現是 2021 年就有的資料) 裡面開頭就有提到:

This means that two or more Linodes connected via the VLAN can see each other as if they were directly connected to the same physical Ethernet network. This network supports all the logical Ethernet features like L2 broadcast and L2 multicast.

所以看起來的確是在 Linode 的 SDN 上面支援了 VLAN。記得早期是用 Cisco 的方案 (2013 年的時候有「Linode NextGen: The Network」這篇),現在不知道是什麼架構...

AWS Global Accelerator 支援 IPv6

AWSAnycast 服務 AWS Global Accelerator 宣佈支援 IPv6:「New for AWS Global Accelerator – Internet Protocol Version 6 (IPv6) Support」。

算是補功能,不過這個功能只對於「純 IPv6 環境」的使用者端有用 (沒有 DNS64 + NAT64 的轉換),目前商轉給一般使用者用的 IPv6 環境應該都還是有掛 DNS64 + NAT64 才對...

另外使用這個功能會需要 VPC 有 IPv6 能力:

To test this new feature, I need a dual-stack application with an ALB entry point. The application must be deployed in Amazon Virtual Private Cloud (Amazon VPC) and support IPv6 traffic.

然後 IPv4 會進到 IPv4 的服務裡,IPv6 則會進到 IPv6 的服務裡:

Protocol translation is not supported, neither IPv4 to IPv6 nor IPv6 to IPv4. For example, Global Accelerator will not allow me to configure a dual-stack accelerator with an IPv4-only ALB endpoint. Also, for IPv6 ALB endpoints, client IP preservation must be enabled.

短時間還用不太到,但之後應該有機會...

Route 53 支援 DNS64,以及 NAT Gateway 支援 NAT64

AWS 宣佈了一套機制,讓 IPv6-only 的機器可以連到 IPv4-only 的服務:「Let Your IPv6-only Workloads Connect to IPv4 Services」。

首先是 DNS64,針對只有 IPv4-only 的 A record 自動加上 AAAA record (如果已經有 AAAA record 的則不變),這邊提到的 64:ff9b::/96 是來自 DNS64 標準內的規範:

The DNS resolver first checks if the record contains an IPv6 address (AAAA record). If it does, the IPv6 address is returned. The IPv6 host can connect to the service using just IPv6. When the record only contains an IPv4 address, the Route 53 resolver synthesizes an IPv6 address by prepending the well-known 64:ff9b::/96 prefix to the IPv4 address.

再來就是 NAT Gateway 可以把 64:ff9b::/96 透過 NAT64 轉到 IPv4 network 上:

You may configure subnet routing to send all packets starting with 64:ff9b::/96 to the NAT gateway. The NAT gateway recognizes the IPv6 address prefix, extracts the IPv4 address from it, and initiates an IPv4 connection to the destination. As usual, the source IPv4 address is the IPv4 address of the NAT gateway itself.

由於有些 protocol 會帶 IP address 資訊,所以不能保證 NAT64 一定會動,但大多數的情況應該是可以解決,至少提供了 IPv6-only server 連到 IPv4-only network 上的方法...

AWS App Runner 總算可以存取 VPC 內的資源了

算是上個星期的消息了,App Runner 這個產品剛出來的時候無法連到 VPC 內的資源,不知道要怎麼用,現在總算是把這個功能補上了:「New for App Runner – VPC Support」。

不過還是不看好,旁邊還有 AWS Elastic BeanstalkAWS Amplify 同質性超高的服務,都是只寫 code 丟上去就能跑:

AWS App Runner is a fully managed service that makes it easy for developers to quickly deploy containerized web applications and APIs, at scale and with no prior infrastructure experience required. Start with your source code or a container image. App Runner builds and deploys the web application automatically, load balances traffic with encryption, scales to meet your traffic needs, and makes it easy for your services to communicate with other AWS services and applications that run in a private Amazon VPC. With App Runner, rather than thinking about servers or scaling, you have more time to focus on your applications.

AWS Elastic Beanstalk is an easy-to-use service for deploying and scaling web applications and services developed with Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker on familiar servers such as Apache, Nginx, Passenger, and IIS.

You can simply upload your code and Elastic Beanstalk automatically handles the deployment, from capacity provisioning, load balancing, auto-scaling to application health monitoring. At the same time, you retain full control over the AWS resources powering your application and can access the underlying resources at any time.

AWS Amplify is a set of purpose-built tools and features that lets frontend web and mobile developers quickly and easily build full-stack applications on AWS, with the flexibility to leverage the breadth of AWS services as your use cases evolve. With Amplify, you can configure a web or mobile app backend, connect your app in minutes, visually build a web frontend UI, and easily manage app content outside the AWS console. Ship faster and scale effortlessly—with no cloud expertise needed.

更不用說旁邊還有 Lambda 類的架構...

Amazon VPC 支援純 IPv6 的網段了

Amazon VPC 支援純 IPv6 的網段了:「Amazon Virtual Private Cloud (VPC) customers can now create IPv6-only subnets and EC2 instances」。

先前機器都還是要設一個 IPv4 位置,所以網段都必須有 IPv4 network space,這次推出使得機器可以跑在 IPv6-only network 上了,不過 Linux 裡面應該還是會有個 lo127.0.0.1...

短時間應該用不到,不過可以先玩看看感覺一下...

AWS 宣佈 EC2-Classic 退役的計畫

AWS 宣佈了歷史悠久的 EC2-Classic 的退役計畫:「EC2-Classic is Retiring – Here’s How to Prepare」。

EC2-Classic 是 VPC 出來之前的產物,後來出現 VPC 的設計讓整個網路架構更有彈性,而且後來的新機種也都出在 VPC 上,EC2-Classic 算是歷史產物。

目前宣佈的幾個時間點,首先是 2013 年年底的帳號已經是 VPC-only,除非有另外開 support ticket 要求要有 EC2-Classic:

All AWS accounts created after December 4, 2013 are already VPC-only, unless EC2-Classic was enabled as a result of a support request.

接下來是今年的十月底,如果 AWS 帳號沒有使用 EC2-Classic 就會自動關閉 EC2-Classic 的權限,另外也會停止販售 EC2-Classic 的 RI:

On October 30, 2021 we will disable EC2-Classic in Regions for AWS accounts that have no active EC2-Classic resources in the Region, as listed below. We will also stop selling 1-year and 3-year Reserved Instances for EC2-Classic.

最後會希望在 2022 年八月中的時候全部轉移完:

On August 15, 2022 we expect all migrations to be complete, with no remaining EC2-Classic resources present in any AWS account.

看起來沒用完的 RI 會退錢?