In Part-14 I kept saying "add the S3 gateway endpoint and that traffic stops costing NAT money". This Part-19 is that feature in full. A VPC endpoint lets instances in a private subnet reach AWS services - S3, DynamoDB, Systems Manager, ECR, CloudWatch Logs, Secrets Manager, two hundred more - without an …

Every time a security group or a network ACL drops a packet, it does so silently. Your SSH hangs, your health check fails, and nothing anywhere tells you which rule said no. VPC Flow Logs is the feature that ends the guessing - it writes one line for every network flow that reaches a network interface, with the …

In Part-5 I built one VPC. Real accounts have several - a dev VPC and a prod VPC, a VPC per team, a shared-services VPC with the monitoring and the directory - and sooner or later an instance in one needs to talk to a database in another privately, without going out to the internet and back in. The simplest way to do …

In Part-4 I launched an EC2 instance into the default VPC and did not think about the network at all. That is fine for a lab and wrong for everything else - a database with a public IP address is how companies end up in the news. In this Part-5 we build the network that every real AWS workload sits in: a VPC (Virtual …

In Part-10 we put an Application Load Balancer in front of an Auto Scaling group. The moment that ALB got a public DNS name, scanners started knocking - SQL injection in query strings, ../../etc/passwd in paths, login forms hammered from a thousand IPs. Security groups cannot help; they work on ports, not on the …

TL;DR An Azure virtual network is regional and spans every availability zone in the region, it is free, and its subnets are not zonal; the zone decision moves to the VM. That is the first difference from an AWS VPC. Azure reserves five addresses per subnet (network, gateway at .1, two for Azure DNS, broadcast), so a …

This is the companion page to my Git and GitHub blueprint - a free three-hour-twenty-minute course that starts at git init and ends with you rewriting history on purpose and resolving merge conflicts without sweating. Everything on this blog - Terraform, Ansible, Kubernetes manifests, this very site - lives in Git, …

This is the companion page to my free Terraform Associate full course - five hours and twenty-five minutes of hands-on Terraform in nineteen chapters. The video walks through every lab; this page gives you the timestamps, the detailed blog post for each chapter (most chapters are a condensed version of a post on this …

Every cloud journey starts with the same boring but important step - getting an account without getting a bill. In this Part-1 of my Google Cloud series we are going to create a Google Cloud account from scratch, claim the $300 welcome credit, and - this is the part most tutorials skip - understand exactly what the …

You have just installed a Kubernetes cluster - with kubeadm, with Kubespray, on a fresh EC2 instance - you type kubectl get nodes, and instead of your nodes you get - 1$ kubectl get nodes 2The connection to the server localhost:8080 was refused - did you specify the right host or port? Nothing is listening on …