Checking in code for rt 7.27.10 and xray 3.35.0 version

This commit is contained in:
Giridharan Ramasamy
2021-12-02 21:29:06 +05:30
parent dfb3ee0eda
commit 57390ace44
389 changed files with 29988 additions and 0 deletions

View File

@@ -0,0 +1,14 @@
:quickstart-project-name: quickstart-aws-vpc
:partner-product-name: Amazon VPC
:partner-company-name:
:doc-month: July
:doc-year: 2020
:partner-contributors:
:quickstart-contributors: Santiago Cardenas, AWS Quick Start team
:deployment_time: 5 minutes
:default_deployment_region: us-west-2
// Uncomment these two attributes if you are leveraging
// - an AWS Marketplace listing.
// Additional content will be auto-generated based on these attributes.
// :marketplace_subscription:
// :marketplace_listing_url: https://example.com/

View File

@@ -0,0 +1,302 @@
// Add steps as necessary for accessing the software, post-configuration, and testing. Dont include full usage instructions for your software, but add links to your product documentation for that information.
//Should any sections not be applicable, remove them
== Add AWS services or other applications
// If Post-deployment steps are required, add them here. If not, remove the heading
After you use this Quick Start to build your VPC environment, you can deploy additional
Quick Starts or deploy your own applications on top of this AWS infrastructure. If you
decide to extend your AWS environment with https://aws.amazon.com/quickstart/[additional Quick Starts] for trial or production
use, we recommend that you choose the option to deploy the Quick Start into an existing
VPC, where that option is available.
If you decide to deploy additional private subnets with dedicated network ACLs, make sure
you review the configuration and adjust it accordingly. By default, the custom ACLs are
configured to allow all inbound and outbound traffic to flow in order to facilitate the
deployment of additional infrastructure. For more information, see https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html[Network ACLs] and
https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html[Recommended Network ACL Rules for Your VPC] in the Amazon VPC documentation.
== Best practices for using {partner-product-name} on AWS
// Provide post-deployment best practices for using the technology on AWS, including considerations such as migrating data, backups, ensuring high performance, high availability, etc. Link to software documentation for detailed information.
The architecture built by this Quick Start supports AWS best practices for high availability
and security. The Quick Start provides:
* Up to four Availability Zones for high availability and disaster recovery. (AWS
recommends maximizing your use of Availability Zones to isolate a data center outage.)
Availability Zones are geographically distributed within a region and spaced for best
insulation and stability in the event of a natural disaster.
* Separate subnets for unique routing requirements. AWS recommends using public
subnets for external-facing resources and private subnets for internal resources. For
each Availability Zone, this Quick Start provisions one public subnet and one private
subnet by default. (If you need public subnets only, you can disable the creation of the
private subnets.) For subnet sizing strategies, see the next section.
* Additional layer of security. AWS recommends using network ACLs as firewalls to
control inbound and outbound traffic at the subnet level. This Quick Start provides an
option to create a network ACL protected subnet in each Availability Zone. These
network ACLs provide individual controls that you can customize as a second layer of
defense.
We recommend that you use network ACLs sparingly for the following reasons: they can
be complex to manage, they are stateless, every IP address must be explicitly opened in
each (inbound/outbound) direction, and they affect a complete subnet. We recommend
that you use security groups more often than network ACLs, and create and apply these
based on a schema that works for your organization. Some examples are server roles and
application roles. For more information about security groups and network ACLs, see
the link:#_security[Security] section later in this guide.
* Independent route tables configured for every private subnet to control the flow of
traffic within and outside the Amazon VPC. The public subnets share a single routing
table, because they all use the same Internet gateway as the sole route to communicate
with the Internet.
* Highly available NAT gateways deployed, that offer major advantages in terms of deployment,
availability, and maintenance over NAT instances. For more information see the http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-nat-comparison.html[comparison]
provided in the Amazon VPC documentation.
* Spare capacity for additional subnets, to support your environment as it grows or
changes over time.
For additional information about these best practices, see the following documentation:
* http://d0.awsstatic.com/aws-answers/AWS_Single_VPC_Design.pdf[AWS Single VPC Design] from the AWS Answers website
* http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html[Your VPC and Subnets] in the Amazon VPC documentation
* https://medium.com/aws-activate-startup-blog/practical-vpc-design-8412e1a18dcc[Practical VPC Design] in the AWS Startups blog
* http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html[Network ACLs] in the Amazon VPC documentation
=== Subnet Sizing
In this Quick Start, the sizing of CIDR blocks used in the subnets is based on a typical
deployment, where private subnets would have roughly double the number of instances
found in public subnets. However, during deployment, you can use the CIDR block
parameters to resize the CIDR scopes to meet your architectural needs.
In the default subnet allocation, the VPC is divided into subnet types and then further
segmented per Availability Zone, as illustrated in link:#_architecture[Figure 1]. The Quick Start provides the
following default CIDR block sizes to maximize capacity:
[cols="60,40a", options="header",grid=none, frame=topbot, stripes=even]
|===
| VPC
^| 10.0.0.0/16
|Private subnets A
^|10.0.0.0/17
|
|
[cols="2,1", grid=rows, frame=topbot]
!===
! Availability Zone 1
^! 10.0.0.0/19
! Availability Zone 2
^! 10.0.32.0/19
! Availability Zone 3
^! 10.0.64.0/19
! Availability Zone 4
^! 10.0.96.0/19
!===
|Public subnets
^|10.0.128.0/18
|
|
[cols="2,1", grid=rows, frame=topbot]
!===
! Availability Zone 1
^! 10.0.128.0/20
! Availability Zone 2
^! 10.0.144.0/20
! Availability Zone 3
^! 10.0.160.0/20
! Availability Zone 4
^! 10.0.176.0/20
!===
|Private subnets B with
dedicated custom network
ACL
^|10.0.192.0/19
|
|
[cols="2,1", grid=rows, frame=topbot]
!===
! Availability Zone 1
^! 10.0.192.0/21
! Availability Zone 2
^! 10.0.200.0/21
! Availability Zone 3
^! 10.0.208.0/21
! Availability Zone 4
^! 10.0.216.0/21
!===
|Spare subnet capacity
^|10.0.224.0/19
|
|
[cols="2,1", grid=rows, frame=topbot]
!===
! Availability Zone 1
^! 10.0.224.0/21
! Availability Zone 2
^! 10.0.232.0/21
! Availability Zone 3
^! 10.0.240.0/21
! Availability Zone 4
^! 10.0.248.0/21
!===
|===
Alternatively, there may be situations where you would want to separate the CIDR scopes
by dividing the VPC into Availability Zones and then into subnet types. The recommended
CIDR blocks to maximize capacity for this scenario are as follows:
[cols="60,40a", options="header",grid=none, frame=topbot, stripes=even]
|===
| VPC
^| 10.0.0.0/16
|Availability Zone 1
^|10.0.0.0/18
|
|
[cols="2,1", grid=rows, frame=topbot]
!===
! Private subnet A
^! 10.0.0.0/19
! Public subnet
^! 10.0.32.0/20
! Private subnet B
^! 10.0.48.0/21
! Spare subnet capacity
^! 10.0.56.0/21
!===
|Availability Zone 2
^|10.0.64.0/18
|
|
[cols="2,1", grid=rows, frame=topbot]
!===
! Private subnet A
^! 10.0.64.0/19
! Public subnet
^! 10.0.96.0/20
! Private subnet B
^! 10.0.112.0/21
! Spare subnet capacity
^! 10.0.120.0/21
!===
|Availability Zone 3
^|10.0.128.0/18
|
|
[cols="2,1", grid=rows, frame=topbot]
!===
! Private subnet A
^! 10.0.128.0/19
! Public subnet
^! 10.0.160.0/20
! Private subnet B
^! 10.0.176.0/21
! Spare subnet capacity
^! 10.0.184.0/21
!===
|Availability Zone 4
^|10.0.192.0/18
|
|
[cols="2,1", grid=rows, frame=topbot]
!===
! Private subnet A
^! 10.0.192.0/19
! Public subnet
^! 10.0.224.0/20
! Private subnet B
^! 10.0.240.0/21
! Spare subnet capacity
^! 10.0.248.0/21
!===
|===
To customize the CIDR ranges for this scenario or to implement your own segmentation
strategy, you can configure the Quick Start parameters described in link:#_launch_a_new_vpc[Launch a new VPC]. For more
information about VPC and subnet sizing, see the https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html#VPC_Sizing[AWS documentation].
== Security
// Provide post-deployment best practices for using the technology on AWS, including considerations such as migrating data, backups, ensuring high performance, high availability, etc. Link to software documentation for detailed information.
=== Public and Private Subnets
This Quick Start provisions one public and one private subnet in each Availability Zone by
default. You can also choose to add additional private subnets with dedicated network
ACLs.
A public subnet is directly routable to the Internet via a route in the route table that points
to the Internet gateway. This type of subnet allows the use of Elastic IPs and public IPs, and
(if the security group and network ACLs permit) a public subnet is reachable from the
Internet. A public subnet is useful as a DMZ infrastructure for web servers and for Internetfacing Elastic Load Balancing (ELB) load balancers.
Private subnets can indirectly route to the Internet via a NAT gateway.
NAT Gateways reside in a public subnet in order to route directly to the Internet.
Instances in a private subnet are not externally reachable from outside the Amazon VPC,
regardless of whether they have a public or Elastic IP address attached. A private subnet is
useful for application servers and databases.
=== Using Security Groups and Network ACLs
The following table describes the differences between security groups and network ACLs:
|===
|Security group |Network ACL
// Space needed to maintain table headers
|Operates at the instance level (first layer of defense) |Operates at the subnet level (second layer of defense)
|Supports allow rules only |Supports allow rules and deny rules
|Is stateful: Return traffic is automatically allowed, regardless of any rules|Is stateless: Return traffic must be explicitly allowed by rules
|We evaluate all rules before deciding whether to allow traffic|We process rules in numerical order when deciding whether to allow traffic
|Applies to an instance only if someone specifies the security group when launching the instance, or associates the security group with the instance later on| Automatically applies to all instances in the subnets it's associated with (backup layer of defense, so you don't have to rely on someone specifying the security group)
|===
The network ACLs in this Quick Start are configured as follows:
* All public and private subnets are associated with the same default network ACL, which
is automatically created for all VPCs on AWS. This network ACL allows all inbound and
outbound traffic. As you deploy instances and services, you should associate them with
security groups and allow only the traffic and ports needed for your application.
* Each additional private subnet is associated with a custom network ACL (1:1 ratio).
These network ACLs are initially configured to allow all inbound and outbound traffic to
facilitate the deployment of additional instances and services. As with the other subnets,
you should use security groups to secure the environment internally, and you can lock
down the custom network ACLs during or after deployment as required by your
application.
== Other useful information
//Provide any other information of interest to users, especially focusing on areas where AWS or cloud usage differs from on-premises usage.
=== AWS services
* http://aws.amazon.com/documentation/cloudformation/[AWS CloudFormation]
* Amazon EC2
** http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/[User guide for Microsoft Windows]
** https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/[User guide for Linux:]
* http://aws.amazon.com/documentation/vpc/[Amazon VPC]
** https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html[Security groups]
** https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html[Network ACLs]
** http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-nat-gateway.html[NAT gateways]
* Best practices for implementing VPCs
** http://d0.awsstatic.com/aws-answers/AWS_Single_VPC_Design.pdf[AWS Single VPC Design]
** http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html[Your VPC and Subnets]
** https://medium.com/aws-activate-startup-blog/practical-vpc-design-8412e1a18dcc[Practical VPC Design]
=== Quick Start reference deployments
* https://aws.amazon.com/quickstart/[AWS Quick Start home page]
=== GitHub Repository
You can visit our https://fwd.aws/rdXz7[GitHub repository] to download the templates and scripts for this Quick
Start, to post your comments, and to share your customizations with others.

View File

@@ -0,0 +1,34 @@
Deploying this Quick Start for a new virtual private cloud (VPC) with
*default parameters* builds the following _{partner-product-name}_ environment in the
AWS Cloud.
// Replace this example diagram with your own. Send us your source PowerPoint file. Be sure to follow our guidelines here : http://(we should include these points on our contributors giude)
[#architecture1]
.Quick Start architecture for _{partner-product-name}_ on AWS
[link=images/architecture_diagram.png]
image::../images/architecture_diagram.png[Architecture,width=648,height=439]
NOTE: The IP addresses exclude five addresses from each subnet that are reserved and unavailable for use *
As shown in Figure 1, the Quick Start sets up the following:
The AWS CloudFormation template sets up the virtual network and creates networking
resources.
The template creates a Multi-AZ, multi-subnet VPC infrastructure with managed NAT
gateways in the public subnet for each Availability Zone. You can also create additional
private subnets with dedicated custom network access control lists (ACLs). Default subnet
sizes are based on a typical deployment but can be reconfigured, as discussed in the
link:#_subnet_sizing[Subnet Sizing] section.
The Quick Start also includes VPC endpoints, which provide a secure, reliable connection to
Amazon S3 without requiring an Internet gateway, a NAT gateway, or a virtual private
gateway. With these endpoints, you can access S3 resources from within the VPC created by
the Quick Start. These endpoints are valid only for the AWS Region in which you launch the
Quick Start.
The Quick Start uses the default endpoint policy, which gives any user or service within the
VPC full access to Amazon S3 resources. This policy supplements any IAM user policies or
S3 bucket policies that you may have in place.
The Quick Start also enables Domain Name System (DNS) resolution in the VPC. For more
information about VPC endpoints, see the https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-s3.html[AWS documentation].

View File

@@ -0,0 +1,52 @@
// We need to work around Step numbers here if we are going to potentially exclude the AMI subscription
=== Sign in to your AWS account
. Sign in to your AWS account at https://aws.amazon.com with an IAM user role that has the necessary permissions. For details, see link:#_planning_the_deployment[Planning the deployment] earlier in this guide.
. Make sure that your AWS account is configured correctly, as discussed in the link:#_technical_requirements[Technical requirements] section.
// Optional based on Marketplace listing. Not to be edited
ifdef::marketplace_subscription[]
=== Subscribe to the {partner-product-name} AMI
This Quick Start requires a subscription to the AMI for {partner-product-name} in AWS Marketplace.
. Sign in to your AWS account.
. {marketplace_listing_url}[Open the page for the {partner-product-name} AMI in AWS Marketplace], and then choose *Continue to Subscribe*.
. Review the terms and conditions for software usage, and then choose *Accept Terms*. +
A confirmation page loads, and an email confirmation is sent to the account owner. For detailed subscription instructions, see the https://aws.amazon.com/marketplace/help/200799470[AWS Marketplace documentation^].
. When the subscription process is complete, exit out of AWS Marketplace without further action. *Do not* provision the software from AWS Marketplace—the Quick Start deploys the AMI for you.
endif::marketplace_subscription[]
// \Not to be edited
=== Launch the Quick Start
NOTE: You are responsible for the cost of the AWS services used while running this Quick Start reference deployment. There is no additional cost for using this Quick Start. For full details, see the pricing pages for each AWS service used by this Quick Start. Prices are subject to change.
. Sign in to your AWS account, and choose the following option to launch the AWS CloudFormation template.
[cols=2*]
|===
^|https://fwd.aws/mm853[Deploy {partner-product-name} on AWS^]
^|link:=../../templates/aws-vpc.template.yaml[View template^]
|===
Also, make sure that the domain name option in the DHCP options is configured as explained in the http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_DHCP_Options.html[Amazon VPC documentation^]. You provide your VPC settings when you launch the Quick Start.
Each deployment takes about {deployment_time} to complete.
[start=2]
. Check the AWS Region thats displayed in the upper-right corner of the navigation bar, and change it if necessary. This is where the network infrastructure for {partner-product-name} will be built. The template is launched in the {default_deployment_region} Region by default.
// *Note:* This deployment includes Amazon EFS, which isnt currently supported in all AWS Regions. For a current list of supported Regions, see the https://docs.aws.amazon.com/general/latest/gr/elasticfilesystem.html[endpoints and quotas webpage].
[start=3]
. On the *Create stack* page, keep the default setting for the template URL, and then choose *Next*.
. On the *Specify stack details* page, change the stack name if needed. Review the parameters for the template. Provide values for the parameters that require input. For all other parameters, review the default settings and customize them as necessary. For example, you can change the network configuration parameters if you
want to reconfigure the subnet segmentation used for the VPC, as discussed earlier in
the link:#_subnet_sizing[Subnet Sizing] section.
// In the following tables, parameters are listed by category and described separately for the two deployment options:
// * Parameters for deploying {partner-product-name} into a new VPC
// * Parameters for deploying {partner-product-name} into an existing VPC

View File

@@ -0,0 +1,5 @@
// There are generally two deployment options. If additional are required, add them here
This Quick Start provides one deployment option:
* *Deploy a new VPC (end-to-end deployment)*. This option builds a new AWS environment consisting of the VPC, subnets, NAT gateways, security groups, and other infrastructure components.

View File

@@ -0,0 +1,23 @@
// Add any tips or answers to anticipated questions. This could include the following troubleshooting information. If you dont have any other Q&A to add, change “FAQ” to “Troubleshooting.”
== FAQ
*Q.* I encountered a *CREATE_FAILED* error when I launched the Quick Start.
*A.* If AWS CloudFormation fails to create the stack, we recommend that you relaunch the template with *Rollback on failure* set to *No*. (This setting is under *Advanced* in the AWS CloudFormation console, *Options* page.) With this setting, the stacks state is retained and the instance is left running, so you can troubleshoot the issue. (For Windows, look at the log files in %ProgramFiles%\Amazon\EC2ConfigService and C:\cfn\log.)
// If youre deploying on Linux instances, provide the location for log files on Linux, or omit this sentence.
WARNING: When you set *Rollback on failure* to *Disabled*, you continue to incur AWS charges for this stack. Please make sure to delete the stack when you finish troubleshooting.
For additional information, see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/troubleshooting.html[Troubleshooting AWS CloudFormation^] on the AWS website.
*Q.* I encountered a size limitation error when I deployed the AWS CloudFormation templates.
*A.* We recommend that you launch the Quick Start templates from the links in this guide or from another S3 bucket. If you deploy the templates from a local copy on your computer or from a location other than an S3 bucket, you might encounter template size limitations. For more information about AWS CloudFormation quotas, see the http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cloudformation-limits.html[AWS documentation^].
== Troubleshooting
The following table lists specific *CREATE_FAILED* error messages you might encounter.
If you encounter a template validation error during deployment, check for a mismatch in the values of the *Availability Zones* and *Number of Availability Zones* parameters. If you select more Availability Zones than you request, the AWS CloudFormation template wont validate. Correct the parameters so that theyre in sync, and redeploy the Quick Start.

View File

@@ -0,0 +1,3 @@
// Include details about the license and how they can sign up. If no license is required, clarify that.
There are no licencing requirements for this Quick Start

View File

@@ -0,0 +1,11 @@
// Replace the content in <>
// Identify your target audience and explain how/why they would use this Quick Start.
//Avoid borrowing text from third-party websites (copying text from AWS service documentation is fine). Also, avoid marketing-speak, focusing instead on the technical aspect.
This Quick Start provides a networking foundation for AWS Cloud infrastructures. It
deploys an Amazon Virtual Private Cloud (Amazon VPC) according to AWS best practices
and guidelines. Amazon VPC is the networking layer for Amazon Elastic Compute Cloud
(Amazon EC2) and provides a private, isolated section of the AWS Cloud where you can
launch AWS services and other resources in a virtual network. For a discussion of best
design practices for Amazon VPC environments, see the documentation and articles listed
in the link:#_other_useful_information[Other useful information] section.

View File

@@ -0,0 +1 @@
// If no preperation is required, remove all content from here

View File

@@ -0,0 +1,17 @@
// Replace the content in <>
// Briefly describe the software. Use consistent and clear branding.
// Include the benefits of using the software on AWS, and provide details on usage scenarios.
The Amazon VPC architecture includes public and private subnets. The first set of private
subnets share the default network access control list (ACL) from the Amazon VPC, and a
second, optional set of private subnets includes dedicated custom network ACLs per subnet.
Optionally you may choose to deploy a completely public VPC (no private subnets), or a completely private VPC (no public subnets).
The Quick Start divides the Amazon VPC address space in a predictable manner across
multiple Availability Zones, and deploys NAT gateways for outbound Internet access.
You can use this Quick Start as a building block for your own deployments. You can scale it
up or down by adding or removing subnets and Availability Zones according to your needs,
and add other infrastructure components and software layers to complete your AWS
environment.

View File

@@ -0,0 +1,29 @@
[cols=3*,options="header"]
|===
|Code
|Name
| Opt-in Status
|us-east-2 |US East (Ohio) |Not required
|us-east-1 |US East (N. Virginia) |Not required
|us-west-1 |US West (N. California) |Not required
|us-west-2 |US West (Oregon) |Not required
|af-south-1 |Africa (Cape Town) |Required
|ap-east-1 |Asia Pacific (Hong Kong) |Required
|ap-south-1 |Asia Pacific (Mumbai) |Not required
|ap-northeast-3 |Asia Pacific (Osaka-Local) |Not required
|ap-northeast-2 |Asia Pacific (Seoul) |Not required
|ap-southeast-1 |Asia Pacific (Singapore) |Not required
|ap-southeast-2 |Asia Pacific (Sydney) |Not required
|ap-northeast-1 |Asia Pacific (Tokyo) |Not required
|ca-central-1 |Canada (Central) |Not required
|eu-central-1 |Europe (Frankfurt) |Not required
|eu-west-1 |Europe (Ireland) |Not required
|eu-west-2 |Europe (London) |Not required
|eu-south-1 |Europe (Milan) |Required
|eu-west-3 |Europe (Paris) |Not required
|eu-north-1 |Europe (Stockholm) |Not required
|me-south-1 |Middle East (Bahrain) |Required
|sa-east-1 |South America (São Paulo) |Not required
|===

View File

@@ -0,0 +1,7 @@
// Replace the <n> in each row to specify the number of resources used in this deployment. Remove the rows for resources that arent used.
|===
|Resource |This deployment uses
// Space needed to maintain table headers
|VPCs |1
|===

View File

@@ -0,0 +1,6 @@
// Replace the content in <>
// Describe or link to specific knowledge requirements; for example: “familiarity with basic concepts in the areas of networking, database operations, and data encryption” or “familiarity with <software>.”
This Quick Start assumes familiarity with VPC architecure and CloudFormation.