Page History

...

Cornell AWS customers that opt-in to use the Shared VPC will experience the following benefits:

• Privileged Network Access
  • Resources using the Shared VPC are assigned private IP addresses from the private Cornell network. As such, they reside on the Cornell network and potentially can reach other resources on the Cornell network.
•  EaseLess VPC management –
  • The Shared VPC can be used without the need to setup and manage your own VPC.
  • The CIT Cloud Team manages manages the subnets, network ACLs, and Route Tables in the Shared VPC. Customers manage the Security Groups applied to their EC2 instances and other resources deployed in the Shared VPC.
• Cheaper
  • Each Cornell Standard VPC contains at least one NAT Gateway, which typically costs about $1/day to run. In contrast, NAT Gateways deployed in the Shared VPC are managed and paid for by CIT.
  • VPC Flow Logs in the Shared VPC are paid for by CIT.
• Increased resiliency
  • Customers using the Shared VPC have access to subnets in all of the Availability Zones in the us-east-1 AWS Region. In contrast, the Cornell Standard VPC is typically deployed only to two Availability Zones.
  • Each private subnet in the Shared VPC utilizes a NAT Gateway local to the Availability Zone where the subnet is deployed. In contrast, private subnets in the Cornell Standard VPC typically utilize a single NAT Gateway in a single Availability Zone.
• Availability Zone matching
  • Since the Shared VPC offers access to all Availability Zones in us-east-1, customers have the option to deploy resources in specific AZs if they are trying to deploy resources in the same AZs as deployed by partners or vendors.

...

While the CIT Cloud team manages the Network ACL associated with the Shared VPC, you are completely responsible for managing the overall network access to the resources you deploy to the Shared VPC (e.g., by using Security Groups and host firewalls) and to managing the resources themselves (e.g, EC2 instances) according to best practices and Cornell policy.

Do my resources deployed to the Shared VPC automatically have access to a target resource (X) which is also on the Cornell network?

From an access (reachability) perspective, a resource deployed to the Shared VPC is no different from any other AWS resource deployed to a VPC connected to the Cornell network. You may still have to work with the team that manages the target resource to allow your resource to access that resource. E.g., you may still need to ask that traffic from your specific resource (e.g., specific private IP address) be allowed to reach the target resource.

Am I charged for using the Shared VPC?

...