Amazon says in a blog post that they are so excited they can barely contain themselves.
Today we are releasing a set of features that expand the power and value of the Virtual Private Cloud.
Woo hoo, break out the cloud party hats. More power. More value. This EC2 goes all the way to 11…or maybe not.
You can think of this new collection of features as virtual networking for Amazon EC2. While I would hate to be innocently accused of hyperbole, I do think that today’s release legitimately qualifies as massive, one that may very well change the way that you think about EC2 and how it can be put to use in your environment.
Yes, ok, I see trusted security partners still are relied upon to provide advanced features for EC2/VPC. I take that to mean this a core/basic security announcement; it’s like an “oops, here’s that thing you have been looking for” release.
The first three comments on the blog post emphasize a sort of underwhelming-ness. Not everything you have been looking for is there yet.
- Simon, March 14, 2011 at 11:50 PM: “Whats the ETA on IPV6 support?”
- Pve, March 15, 2011 at 01:29 AM: “Now, what about your roadmap for IPv6 integration?”
- Roland, March 15, 2011 at 01:57 AM: “What about IPv6?”
Let me get out my language pattern analysis toolkit…yes, yes, aha! IPv6 apparently is not yet supported.
A little more digging and it appears the security group you can attach now to the VPC Internet gateway is stateless. Stateful-packet filtering is ages old. It also is required for PCI compliance (DSS v2.0 Requirement 1.3.6), and Amazon says they are PCI compliant. So perhaps I am missing something in this “new” networking model; but it looks to me that you would have to manually configure inbound high-level ports. That makes it neither secure nor compliant.
What about cost?
I think this is the best part of the Virtual Private Cloud: you can deploy a feature-packed private network at no additional charge! We don’t charge you for creating a VPC, subnet, ACLs, security groups, routing tables, or VPN Gateway, and there is no charge for traffic between S3 and your Amazon EC2 instances in VPC. Running Instances (including NAT instances), Elastic Block Storage, VPN Connections, Internet bandwidth, and unmapped Elastic IPs will incur our usual charges.
The usual charges. A NAT for 2-tiers with a private IP range to the public will set you back at least 0.09/hr — a micro instance is not allowed. So a networking instance you setup is going to bring cost but they are not adding an additional burden for the above networking features. Imagine if they tried to charge to add an ACL. Like I said, this is the “oops, here’s that thing you have been looking for” release. Party like it’s 1999. Or should I say dude, where’s my DMZ?
In related news an Amazon EC2 bicycle now has tires…and here’s the best part: they let you put in air and lubricate your chain at no additional charge!