Networking

Objective

The actions page once listed networking as OPEN and put VPCs and subnets under “not implemented”. That is out of date on both counts — there is per-tenant networking, created for you, and a default VPC on top of it.

What you get, and when

POST /v1/onboard creates four the networking service objects in your project, in order, and looks each one up by name before creating it — so a retry after a failure finishes the job rather than making a second of everything:

Object	Name	Detail
Network	default	Yours, in your project
Subnet	default	10.200.0.0/24, DNS 9.9.9.9 and 149.112.112.112
Router	default	External gateway on the guests network
Router interface	—	The router attached to your subnet

You do not create these and you do not need to. They exist before your first launch.

Every project gets the same private range

10.200.0.0/24. All of them.

That is deliberate, not a collision waiting to happen: projects are isolated by their own router, so two customers’ 10.200.0.5 are on different networks behind different routers and never meet. The address you get is not a hint about how many customers there are, and it is stable for you.

It also means you cannot pick your own CIDR. There is one subnet, it is a /24, and it gives you 253 usable addresses.

Why the per-project network exists at all

ec2-api places a machine only on a non-external network the calling project owns. Without a network of your own there is nothing for a launch to attach to — so ensureNetwork is not a nicety, it is what makes RunInstances work.

The guests network is the external network: the gateway your router points at, and the pool floating addresses come from. It is not where your instances live.

EC2-Classic is off, so you have a default VPC

disable_ec2_classic = True

The reason is Terraform. Amazon retired EC2-Classic and the AWS provider assumes it is gone: the provider revokes the default egress rule of every security group it creates, and this API refuses that on a classic group. With classic disabled, each project gets a default VPC on first use, and its security groups, instances and addresses are VPC ones — the shape the provider expects.

Consequences:

• A launch that names no subnet lands in your default VPC.
• Security groups have egress rules as well as ingress rules; the default group allows all egress until something revokes it.
• aws_security_group applies without the classic-mode error.

Security groups

Action	Status
CreateSecurityGroup	Available
DescribeSecurityGroups	Available
AuthorizeSecurityGroupIngress	Available
AuthorizeSecurityGroupEgress	Available
RevokeSecurityGroupIngress	Available
RevokeSecurityGroupEgress	Available
DeleteSecurityGroup	Available

They map onto the networking service security groups: stateful, deny-by-default on ingress, and evaluated as a union when several are attached to one port — the same semantics as EC2. A group that references another security group as its source works, because the networking service supports remote group ids.

A group written for AWS behaves the same way here.

Addresses

Every instance gets a private address on your own subnet. A public address is not automatic.

DescribeAddresses is available. Floating addresses are allocated from the guests external network your router already points at.

OPEN (Michael): whether AllocateAddress and AssociateAddress are offered through the EC2 API. Through the cloud platform directly the networking service floating-IP calls are the ones to use — see Account developer guide:

cloud floating ip create guests
cloud server add floating ip <server> <ip>

Outbound traffic works without any of this: your router does NAT.

Isolation, stated precisely

Customer projects are separated at layer 3 by their own network and router. Another customer is not on your broadcast domain and cannot reach your instances by private address.

What that does not give you:

• No microsegmentation inside your own project. Every instance of yours is on one flat /24 and can reach every other. Security groups are the tool for separating your own tiers, and they are the only tool.
• No network ACLs, no subnet-level policy, no route control.
• No multiple subnets, so you cannot put a database on a subnet with no route out.

[!primary]

the infrastructure repository gap 8 says every VM shares one bridge and can reach every other VM, and calls per-tenant networking a hard blocker. That note predates ensureNetwork and describes the platform team’s own shared guests network, not a customer project. The per-project network, subnet and router described above are what a customer account actually gets.

Not implemented

Named so their absence is deliberate. Each returns InvalidAction:

Customer-managed VPCs and additional subnets, route tables, internet gateways, NAT gateways, VPC peering, transit gateways, VPN connections, VPC endpoints, network ACLs, Elastic Network Interfaces as first-class resources, flow logs, and IPv6.

There is also no load balancer — Octavia is not deployed and there is no elasticloadbalancing endpoint.

Go further

• EC2 API actions
• Account API — where the network is created
• Account developer guide — the networking service directly
• Instance metadata and user data
• Service endpoints