PEBD6027 · RPS minggu 7 · 2x50 menit
Cloud Networking
VPC · Subnet · Route Table · Security Group · NAT Gateway
Peta Pembelajaran Hari Ini
Sub-CPMK 7: merancang VPC sederhana dengan subnet publik/privat. Empat indikator.
- 3 tipe storage: object/block/file
- S3 anatomi: bucket, key, region
- Hitung biaya S3 untuk 1TB foto UMKM
- EBS untuk EC2 boot & data
- EFS shared file system
- CDN CloudFront + backup 3-2-1 rule
Posisi 14P: setelah storage P6, hari ini networking. P8 database & serverless.
Mengapa VPC Penting untuk Bisnis Digital
VPC = isolasi & keamanan. Bila DB terekspos publik, satu kesalahan = kiamat bisnis.
Insiden 2022+
~30%
Breach data Indonesia terkait misconfig network (BSSN, dihedge)
Biaya Breach
$3-5M
IBM Cost of Data Breach 2023 — termasuk denda UU PDP
UU PDP 27/2022: perusahaan wajib lindungi data pribadi. Misconfig VPC = bukti kelalaian, bisa kena denda 2% omzet tahunan.
Bagian 1 · 1/4
VPC Anatomi
Diskusi: bila startup fintech punya 50 EC2 instance dan 5 RDS DB, kenapa tidak bisa semua di 1 public subnet?
VPC, Region, AZ, CIDR — Anatomi
VPC berlapis region, AZ, subnet. CIDR block menentukan kapasitas IP.
- Virtual network isolated di AWS
- Scoped per region (cross-region impossible)
- 1 VPC bisa span banyak AZ
- CIDR block: /16 (65k IP) hingga /28 (16 IP)
- Data center fisik terisolasi
- 2-6 AZ per region
- ap-southeast-3 Jakarta punya 3 AZ
- Multi-AZ = high availability
- Sub-range CIDR dalam VPC
- 1 subnet = 1 AZ
- Publik: punya route ke internet
- Privat: tidak punya direct internet route
- Notasi: 10.0.0.0/16
- /16 = 65,536 IP
- AWSReserved 5 IP per subnet
- Plan kapasitas sebelum create VPC
Aturan CIDR: hindari overlap dengan on-prem atau VPC lain. RFC 1918: 10.x, 172.16-31.x, 192.168.x.
Subnet Publik vs Privat
Pembedaan paling fundamental di VPC. Salah pilih = bencana keamanan atau biaya meledak.
| Aspek | Subnet Publik | Subnet Privat |
|---|
| Route ke Internet | Ya, langsung via Internet Gateway | Tidak langsung (NAT Gateway) |
| IP Publik | Ya (auto-assign opsional) | Tidak |
| Use Case | Web server, load balancer, bastion | DB, app tier, internal services |
| Egress Cost | Standar ($0,09/GB) | + NAT processing $0,045/GB |
| Risk Level | Tinggi (terekspos) | Rendah (terisolasi) |
Bank arsitektur: subnet publik hanya untuk ALB & bastion. DB & app tier di privat. Compliance OJK wajib.
Route Table & Internet Gateway
Route table menentukan ke mana packet pergi. Internet Gateway = jembatan ke internet.
- Tabel aturan routing per subnet
- Destination + Target
- Default: local (dalam VPC)
- Tambah route 0.0.0.0/0 ke IGW untuk publik
- Component VPC-side ke internet
- Horizontally scaled, highly available
- Gratis (no hourly charge)
- Hanya egress yang kena biaya
Privat subnet TIDAK punya route 0.0.0.0/0 ke IGW. Itu definisi privat.
Studi Kasus: Bank Jago Multi-Account VPC
Bank Jago (bank digital Indonesia) membangun arsitektur VPC hub-spoke multi-account.
Arsitektur hub-spoke Bank Jago (public case study AWS, dihedge): hub VPC = shared services (AD, DNS, logging), spoke VPC per environment (dev, staging, prod), Transit Gateway connect semua VPC, network firewall inspeksi traffic east-west, AWS Organizations SCP guardrails, CloudTrail audit.
- Isolasi blast radius
- Quota AWS terpisah per akun
- Billing terpisah per tim
- Compliance audit lebih mudah
- Risk management: 1 akun compromised
- Cost allocation per business unit
- Sesuai POJK 38/2016 TP dan OJK
- Foundation scaling tim engineering
Pelajaran: arsitektur network = bisnis decision. Hub-spoke = trade-off complexity vs governance.
Bagian 2 · 2/4
Security Group & NACL
Diskusi: bila attacker compromise 1 EC2 di app tier, bagaimana cegah mereka lateral ke DB subnet?
Security Group (SG) — Stateful Firewall
SG = firewall stateful di level instance. Aturan allow-only, paling sering dipakai.
- Stateful: return traffic auto-allowed
- Allow-only (tidak ada deny)
- Attached ke ENI/instance
- Bisa reference SG lain (best practice)
- Least privilege: hanya port yg perlu
- Reference SG bukan CIDR
- SG per tier (web, app, db)
- Tidak ada 0.0.0.0/0 di port sensitif
Anti-pattern: SG allow 0.0.0.0/0 port 22 (SSH) = pintu terbuka brute-force. Pakai SSM Session Manager sebagai gantinya.
NACL — Stateless Firewall Subnet
NACL = firewall stateless di level subnet. Aturan allow & deny, dievaluasi berurutan.
- Stateless: return traffic harus explicit allow
- Allow & deny rules
- Dievaluasi berurutan (rule number)
- Per-subnet (1 NACL default per VPC)
- Block IP jahat known
- Subnet-level defense in depth
- Compliance PCI-DSS tier segmentation
- Sekunder setelah SG
NACL jarang diubah sehari-hari. SG yang utama. NACL untuk subnet-level pattern deny.
Hitung dari Nol: NAT Gateway Cost
Startup fintech 10 EC2 di privat subnet, 500 GB egress/bulan ke API eksternal. Berapa biaya NAT?
| Langkah | Komponen | Perhitungan | Nilai |
|---|
| 1 | NAT Gateway hourly | 24 jam × 30 hari × $0,045 | $32,40/bulan |
| 2 | NAT processing 500 GB | 500 × $0,045 | $22,50/bulan |
| 3 | Total NAT Gateway | 32,40 + 22,50 | $54,90 ≈ Rp 878rb/bln |
| 4 | Alternatif: VPC Endpoint S3 | Tier 1: ~$0,01/GB | $5/bulan (50% hemat) |
| 5 | Alternatif: instance NAT sendiri | t3.micro + IP publik | ~$10/bulan (kompleks) |
| 6 | Banding egress publik subnet | 500 × $0,09 (tanpa NAT) | $45/bulan |
| 7 | Insight | NAT lebih mahal tapi isolasi | Trade-off security vs cost |
Harga AWS public (dihedge). VPC Endpoint hemat besar bila egress ke AWS service (S3, DynamoDB).
Bagian 3 · 3/4
NAT, Peering, Transit Gateway
Diskusi: bila startup punya 5 VPC berbeda (dev/staging/prod/analytics/security), bagaimana connect mereka?
NAT Gateway vs NAT Instance
Dua opsi egress untuk subnet privat. Trade-off: managed vs self-managed.
- Fully managed AWS
- Auto-scale, highly available
- Cost: $0,045/jam + processing
- Bandwidth sampai 100 Gbps
- EC2 dengan NAT AMI
- Manual config & monitoring
- Cost: instance saja
- Single point of failure
Untuk production serius, NAT Gateway. Untuk lab/belajar, NAT instance cukup.
VPC Peering
VPC Peering = koneksi langsung antar 2 VPC. Privat, no internet, no VPN.
- 1-to-1 connection antar VPC
- Privat via AWS backbone
- Cross-region & cross-account
- Tidak transitive (A-B-C tidak otomatis)
- CIDR tidak boleh overlap
- Full-mesh untuk N VPC butuh N²/2
- Manual route table update
- Max 125 peering per VPC default
VPC Peering cocok untuk 2-3 VPC. Untuk kompleksitas lebih, Transit Gateway.
Transit Gateway (TGW)
TGW = hub central untuk multiple VPC. Menggantikan kompleksitas full-mesh peering.
- Hub VPC central
- Tiap VPC attach sekali
- Route table central di TGW
- Connect VPN, Direct Connect juga
- $0,05/jam per attachment
- $0,02/GB processing
- Contoh: 5 VPC = 5 attachment
- Bandwidth aggregate
Bank multi-account pakai TGW untuk hub-spoke. Compliance & cost control lebih mudah.
Bagian 4 · 4/4
Hybrid & Penutup
Diskusi: bila perusahaan RI punya DC on-prem Cibitung dan AWS Jakarta, bagaimana connect?
Site-to-Site VPN & Direct Connect
Dua opsi hybrid cloud networking. Trade-off: cost vs performance vs reliability.
| Aspek | Site-to-Site VPN | Direct Connect |
|---|
| Media | Internet publik (IPsec) | Fiber dedicated (1/10/100 Gbps) |
| Latency | Variabel (50-200 ms) | Rendah & konsisten (di bawah 5 ms) |
| Throughput | 1,25 Gbps per tunnel | Sampai 100 Gbps |
| Cost | Murah (~$36/bulan) | Premium ($0,30/jam + port) |
| Use Case | Backup DC, dev/test | Production hybrid, latency-sensitive |
| SLA | Best effort | 99,99% (dihedge) |
Indonesia: Telkom, Lintasarta, DCI Indonesia sediakan Direct Connect ke AWS Jakarta.
VPC Flow Logs & Network Monitoring
Flow Logs catat semua traffic IP di VPC. Penting untuk security audit & troubleshooting.
- Catat accept/reject packet
- Destination: S3, CloudWatch Logs
- Format: src_ip dst_ip port action
- 5-tuple + bytes/packets
- Security forensics post-incident
- Compliance audit POJK
- Troubleshooting connectivity
- Cost attribution per service
VPC Flow Logs wajib untuk fintech & bank. POJK audit trail mensyaratkan logging network minimal 5 tahun.
Ringkasan Kunci Pertemuan 7
Hari ini Anda menguasai desain VPC end-to-end: subnet, routing, firewall, hybrid.
Subnetting
Publik vs privat · CIDR · Route table — fondasi isolasi network.
Firewall
Security Group stateful + NACL stateless = defense in depth.
Hybrid
NAT Gateway egress · VPC Peering · Transit Gateway · Direct Connect.
Tiga lensa P7: subnet publik/privat · SG reference · TGW untuk skala.
Persiapan P8: Database & Serverless. Baca Wittig bab 8 (DynamoDB) & 10 (Lambda). Kuis 5 menit soal CIDR & subnet publik/privat.