5 ms·

Well what you are describing is VPC (which for new accounts for a while now is enabled by default), but VPC is software isolation which creates private networks

Well what you are describing is VPC (which for new accounts for a while now is enabled by default), but VPC is software isolation which creates private networks, but EC2 Classic is technically shared private IP space between all customers. There is a big difference between the two.

vertex-four 12y ago
EC2 Classic hasn't been a thing that exists for a couple of years now (aside from for accounts that were grandfathered in).
- res0nat0r 12y ago
  But the fact it it does exist, and I'd venture to guess most major customers who have been using EC2 for a long time now still use it currently and it is still available to many people and is not going away anytime soon.
  - mentat 12y ago
    While this has been down voted, it is correct.
justinsb 12y ago
EC2 (and OpenStack) uses security groups to give you the best of both worlds: shared address space so you _can_ route to other customers; but the firewall means you have to explicitly allow the traffic.
- res0nat0r 12y ago
  Yup EC2 security groups are great for ease of management. Group to Group communication for something like load balancers to auto scaling back-end app servers is great as you don't have to worry at all about tracking IP addresses.
nirvdrum 12y ago
Even with EC2 classic, every machine is locked down from every other. The typical way around this is to modify the default security group, which is limited to your account and your instances. It's a different approach than VPC, but everyone had effectively private networks with EC2 Classic, unless they really went out of their way to open up everything to everyone. Granted we're probably now distinguishing between being able to see unencrypted traffic and being able to access ports on a machine. They're both bad, but I'd argue having your DB port exposed to the world is probably worse.

5 ms·

Well what you are describing is VPC (which for new accounts for a while now is enabled by default), but VPC is software isolation which creates private networks

by res0nat0r 12y ago

vertex-four 12y ago
EC2 Classic hasn't been a thing that exists for a couple of years now (aside from for accounts that were grandfathered in).
- res0nat0r 12y ago
  But the fact it it does exist, and I'd venture to guess most major customers who have been using EC2 for a long time now still use it currently and it is still available to many people and is not going away anytime soon.
  - mentat 12y ago
    While this has been down voted, it is correct.
justinsb 12y ago
EC2 (and OpenStack) uses security groups to give you the best of both worlds: shared address space so you _can_ route to other customers; but the firewall means you have to explicitly allow the traffic.
- res0nat0r 12y ago
  Yup EC2 security groups are great for ease of management. Group to Group communication for something like load balancers to auto scaling back-end app servers is great as you don't have to worry at all about tracking IP addresses.
nirvdrum 12y ago
Even with EC2 classic, every machine is locked down from every other. The typical way around this is to modify the default security group, which is limited to your account and your instances. It's a different approach than VPC, but everyone had effectively private networks with EC2 Classic, unless they really went out of their way to open up everything to everyone. Granted we're probably now distinguishing between being able to see unencrypted traffic and being able to access ports on a machine. They're both bad, but I'd argue having your DB port exposed to the world is probably worse.