AWS networking concepts in a diagram
I remember the heady early days of the cloud when AWS networking was simple.<p>Even then, I saw this coming, of course. There&#x27;s no way to &quot;be everything for everybody&quot; without also duplicating the insanity that is legacy IPv4 data centre networking.<p>Just recently, I wanted to do something conceptually simple in Azure: <i>NOT</i> have the storage account with our database backups &quot;on the Internet&quot; for the world to poke and prod at will.<p>So simple! Just turn on the firewall... and <i>oh boy</i>...<p>You can whitelist only subnets. Individual subnets. One. At. A. Time. Not virtual networks. Definitely not &quot;all&quot; of your virtual networks, which works elsewhere perfectly fine.<p>Okay, fine, there&#x27;s a Private Endpoint feature as well. Sure, it kills performance and costs extra, but there&#x27;s nothing wrong with having this cost money, right? After all, flipping the address in some config of a software-defined-network (SDN) from &quot;public&quot; to &quot;private&quot; is <i>hard work</i> and the gremlins in the cloud need to be compensated.<p>Then, err... uh-oh. It doesn&#x27;t actually work! You need to override DNS to make your clients discover it. So you plug it into your AD domain. Now your PaaS services can&#x27;t access it.<p>Okay fine, you create a private DNS zone (which costs more money), link it to a hub network, link a DNS Resolver service to it (which costs more money), then set up a bazillion rules so that your AD domain still works, and then...<p>... where was I again? I started this a week ago.<p>Oh yeah, I just wanted to make sure Russian hackers can&#x27;t access our backups if a storage key leaks.<p>Maybe next week I can update the subscription templates to re-deploy all the virtual networks with the updated DNS settings.<p>Not idempotent, you say? Maybe next year they&#x27;ll have a preview?<p>Never mind, I hope the Russians won&#x27;t get mad at us in the next few months...