AWS VPC - Attack and Defense

AWS Virtual Private Cloud (VPC) (opens in new tab)is a software-defined-network construct in your AWS account. It logically separates your network traffic from the network traffic of other AWS Customers. Customers can define their CIDR ranges, connect their VPCs, or connect their VPCs to their on-premises networks. 

AWS VPCs are a regional construct. You need to create a VPC in every region you want to deploy VPC-based workloads. 

By default, when a new AWS account is created, default VPCs are deployed in all the standard regions. Each of these VPCs uses the same 172.31.0.0/16 CIDR Range. VPCs you create can use any CIDR range (you’re not limited to RFC1918 CIDR ranges). 

You can see your VPCs on the VPC Dashboard (opens in new tab). The dashboard is helpful because it allows you to view VPC activity across all regions. 

VPCs have a VPC ID that begins with “vpc-”. This VPC ID is unique across all AWS. VPC IDs used to be eight characters long, but in 2018 AWS extended them to be 17 characters long. You can tell older VPCs by the short identifier. 

Networking in a VPC is different from networking in an on-premises environment. Because of the software-defined and multi-tenant nature of the public cloud, VPCs don't need things like ARP to discover where the network devices reside. ARP tables are visible for compatibility with the Operating System’s networking stack, but typical attack techniques like ARP Spoofing will not work in a VPC environment. 

If you haven't already done so, click the orange Cloud Details button at the top-right of the page, generate the Cloud Environment, and use the Credentials provided to access your TryHackMe Cloud Sandbox (AWS console).

Go to the VPC Console (opens in new tab) and have a look around. Note: all resources are deployed in us-east-1 (N. Virginia).

Global Listing of all VPCs. Note: for all the Try Hack Me labs, we will be using US East (N. Virginia), also known as us-east-1.

Sample VPC ID in the VPC Console