clovis

Chasing Kubernetes wisdom • DevOps Engineer • laC addict • Building platforms

[clovis @clovisdsdo]

@uday_devops Marketing beats everything

[clovis @clovisdsdo]

@_jaydeepkarale @nikitabier Has he left?

[Dhanush N @Dhanush_Nehru]

@clovisdsdo These two often causes confusion because they are tightly integrated but they fundamentally serve two different roles:

DNS Resolution (the Client side) and DNS Authoritative Hosting (the Server side).

[Karan Jagtiani @karanjagtiani04]

@clovisdsdo The VPC DNS server is Route 53 Resolver. It's what your EC2 instance asks to look up a name. Route 53 hosted zones hold the records. For a private zone attached to your VPC, Resolver answers from those records; for a public domain, it resolves through public DNS.

[clovis @clovisdsdo]

What is the difference between an AWS VPC DNS server and a Route 53 DNS server? How do they work together?

[clovis @clovisdsdo]

@_jaydeepkarale You are not alone

[clovis @clovisdsdo]

Do you still read terraform docs?

[Akhilesh Mishra @livingdevops]

Why do Terraform docs still exist when no one is reading them anymore?

[clovis @clovisdsdo]

@violainemb Alors là , ils iront certainement chez leurs enfants encombrer . Le chômage est une maladie à éviter l

[clovis @clovisdsdo]

@DataSecChron Happy anniversary

[clovis @clovisdsdo]

Everything to know about the ENI in AWS

1️⃣ENI is a virtual network card that connects an AWS resource to a subnet inside your VPC.
2️⃣Every EC2 instance needs a primary ENI to communicate on the network.
3️⃣AWS creates the primary ENI automatically when you launch an EC2 instance.
4️⃣You can create additional ENIs and attach them to supported EC2 instances when your architecture needs more than one network interface.
5️⃣An ENI gets its private IP address from the subnet where it is created.
6️⃣An ENI can have multiple IP addresses, including private IPv4 and IPv6 addresses.
7️⃣Security groups are associated with the ENI and control which inbound and outbound traffic is allowed.
8️⃣Traffic to and from the EC2 instance flows through the ENI.
9️⃣The subnet route table determines where that traffic is sent, such as another subnet, the internet, a NAT Gateway, or another VPC.
1️⃣0️⃣An ENI does not provide internet access by itself. Internet access still depends on routing, gateways, and security rules.
1️⃣0️⃣ENIs are used by many AWS services, including RDS, Lambda, ECS/Fargate, EKS, load balancers, and Interface VPC Endpoints.
1️⃣1️⃣A secondary ENI can be detached and moved to another compatible EC2 instance in the same Availability Zone.
An Elastic IP can be associated with an ENI through one of its private IPv4 addresses.
1️⃣2️⃣ENIs are important for troubleshooting because IP addresses, security groups, and network traffic are all tied closely to the interface.

[Mayaki Ujeh Emmanuel @MayakiUjeh]

@clovisdsdo Another VPC is already using “same CIDR” and “new CIDR” conficts with another VPC

[Qasim Shah @Qasimshah710]

@clovisdsdo The correct answer is A. Another VPC is already using the same CIDR.
A secondary CIDR block cannot overlap with an existing CIDR range in another VPC.

[clovis @clovisdsdo]

@MayakiUjeh Not at all

[clovis @clovisdsdo]

AWS VPC Networking Quiz

You have an existing VPC, but you’re running out of IP addresses.
You try to add a secondary CIDR block, but AWS won’t allow it.
What could be preventing the new CIDR from being added?

A. Another VPC is already using the same CIDR
B. You’ve reached the subnet limit
C. You’ve reached the VPC limit
D. The new CIDR conflicts with an existing VPC route

[Derrick Washington 💻🏀⛳️🏌🏾 @CPUFXRnDMV]

@clovisdsdo That is D my man.

You can add another VPC route but not the same size or larger.

If you already have /24 you can add /25.

[clovis @clovisdsdo]

One of the most underrated building blocks in AWS: the ENI.

You launch an EC2 instance, choose a subnet, and get a private IP address.

But what connects that instance to your network?
👉The ENI: Elastic Network Interface.

1️⃣What is it, and why is it needed?
A physical computer uses a network card to communicate with other devices. An EC2 instance uses a virtual network card, called an ENI.
The instance provides the computing power: CPU and memory. The ENI provides its connection to a subnet in your VPC.
That is why every EC2 instance has a primary ENI, even when you never create one yourself. It is a required part of the instance’s networking—not an optional internet-access feature.

2️⃣How does it work?
Imagine your EC2 instance has the private IP address 10.0.1.10.
That address is assigned to its ENI. The interface also has a MAC address and associated security groups. An ENI can hold more than one IP address.
When another application connects to 10.0.1.10, the traffic reaches your instance through that interface. The associated security groups control which incoming and outgoing traffic is allowed.
Choosing a subnet tells AWS where the connection belongs. The ENI gives the instance that connection.

3️⃣Who creates the ENI?
AWS creates one automatically: During a normal EC2 launch, AWS creates and attaches the primary ENI using your network settings. You do not need to create it separately.
You can create additional ones: These are secondary ENIs. You can attach them to compatible EC2 instances in the same Availability Zone when your design needs additional network interfaces.
Other AWS services create them for you: Some services create and manage ENIs in your VPC as part of their setup. You generally manage those through the service not by detaching their ENIs yourself.

4️⃣Where else are ENIs used?
RDS uses service-managed ENIs to connect database instances to your VPC.

Lambda creates or reuses managed ENIs when you configure a function to access resources in your VPC, such as a private database.

ECS on Fargate gives each task its own ENI for network communication.

EKS with the Amazon VPC CNI uses ENIs attached to EC2 worker nodes to support pod networking and assign VPC IP addresses to pods.

An ENI alone does not provide internet access. The appropriate routing and security settings still need to be in place.

[Ayaan 🐧 @twtayaan]

Every DevOps team has all four. Sometimes it’s the same person.

[clovis @clovisdsdo]

@DataSecChron Keep trying

[clovis @clovisdsdo]

@AIM_SCREENAME One benefit of using AI

[clovis @clovisdsdo]

We sign some of the most important documents in our lives without reading them.

- Car insurance policy
- Apartment lease
- Job offer letter

The only time we suddenly read every single line carefully is when something goes wrong.

Do you read everything before signing?