Aller au contenu principal

Networking Multi-Cloud

1 - Architectures réseau​

1.1 Options de connectivité​

OptionLatenceBande passanteCoût
InternetVariableVariableBas
VPNMoyenneJusqu'à 1.25 GbpsMoyen
DedicatedFaible1-100 GbpsÉlevé

1.2 Planification des adresses IP​

# IP Planning Multi-Cloud
aws:
  region: eu-west-1
  vpc_cidr: "10.0.0.0/16"
  subnets:
    private:
      - "10.0.0.0/20"
      - "10.0.16.0/20"
      - "10.0.32.0/20"
    public:
      - "10.0.48.0/24"
      - "10.0.49.0/24"

azure:
  region: westeurope
  vnet_cidr: "10.1.0.0/16"
  subnets:
    private:
      - "10.1.0.0/20"
      - "10.1.16.0/20"
    gateway:
      - "10.1.255.0/24"

gcp:
  region: europe-west1
  vpc_cidr: "10.2.0.0/16"
  subnets:
    private:
      - "10.2.0.0/20"

2 - VPN Site-to-Site​

2.1 AWS VPN vers Azure​

# AWS - Customer Gateway
resource "aws_customer_gateway" "azure" {
  bgp_asn    = 65001
  ip_address = azurerm_public_ip.vpn.ip_address
  type       = "ipsec.1"
  
  tags = {
    Name = "azure-cgw"
  }
}

# AWS - VPN Gateway
resource "aws_vpn_gateway" "main" {
  vpc_id = aws_vpc.main.id
  
  tags = {
    Name = "main-vpn-gw"
  }
}

# AWS - VPN Connection
resource "aws_vpn_connection" "azure" {
  customer_gateway_id = aws_customer_gateway.azure.id
  vpn_gateway_id      = aws_vpn_gateway.main.id
  type                = "ipsec.1"
  
  static_routes_only = false
  
  tags = {
    Name = "aws-to-azure"
  }
}
# Azure - VPN Gateway
resource "azurerm_virtual_network_gateway" "main" {
  name                = "vpn-gateway"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  
  type     = "Vpn"
  vpn_type = "RouteBased"
  sku      = "VpnGw1"
  
  ip_configuration {
    public_ip_address_id          = azurerm_public_ip.vpn.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway.id
  }
}

# Azure - Local Gateway (AWS)
resource "azurerm_local_network_gateway" "aws" {
  name                = "aws-local-gw"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  
  gateway_address = aws_vpn_connection.azure.tunnel1_address
  address_space   = ["10.0.0.0/16"]
}

# Azure - Connection
resource "azurerm_virtual_network_gateway_connection" "aws" {
  name                       = "aws-connection"
  location                   = azurerm_resource_group.main.location
  resource_group_name        = azurerm_resource_group.main.name
  
  type                       = "IPsec"
  virtual_network_gateway_id = azurerm_virtual_network_gateway.main.id
  local_network_gateway_id   = azurerm_local_network_gateway.aws.id
  
  shared_key = aws_vpn_connection.azure.tunnel1_preshared_key
}

2.2 AWS VPN vers GCP​

# GCP - VPN Gateway
resource "google_compute_vpn_gateway" "main" {
  name    = "vpn-gateway"
  network = google_compute_network.main.id
  region  = var.gcp_region
}

# GCP - External VPN Gateway (AWS)
resource "google_compute_external_vpn_gateway" "aws" {
  name            = "aws-external-gateway"
  redundancy_type = "SINGLE_IP_INTERNALLY_REDUNDANT"
  
  interface {
    id         = 0
    ip_address = aws_vpn_connection.gcp.tunnel1_address
  }
}

# GCP - VPN Tunnel
resource "google_compute_vpn_tunnel" "aws" {
  name                  = "vpn-tunnel-aws"
  region                = var.gcp_region
  vpn_gateway           = google_compute_vpn_gateway.main.id
  peer_external_gateway = google_compute_external_vpn_gateway.aws.id
  
  shared_secret                     = aws_vpn_connection.gcp.tunnel1_preshared_key
  peer_external_gateway_interface   = 0
  vpn_gateway_interface             = 0
  
  router = google_compute_router.main.id
}

3 - Interconnexions dédiées​

3.1 Options par cloud​

CloudServiceBande passante
AWSDirect Connect1-100 Gbps
AzureExpressRoute50 Mbps - 100 Gbps
GCPCloud Interconnect10-200 Gbps

3.2 AWS Direct Connect​

resource "aws_dx_gateway" "main" {
  name            = "multicloud-dxgw"
  amazon_side_asn = 64512
}

resource "aws_dx_gateway_association" "main" {
  dx_gateway_id         = aws_dx_gateway.main.id
  associated_gateway_id = aws_vpn_gateway.main.id
  
  allowed_prefixes = ["10.0.0.0/16"]
}

3.3 Megaport / Equinix Fabric​

Utiliser un Cloud Router tiers pour connecter plusieurs clouds :

4 - DNS Multi-Cloud​

4.1 Architecture DNS​

4.2 Route 53 avec Health Checks​

# Health Check AWS
resource "aws_route53_health_check" "aws" {
  fqdn              = "app.aws.example.com"
  port              = 443
  type              = "HTTPS"
  resource_path     = "/health"
  failure_threshold = "3"
  request_interval  = "30"
}

# Health Check Azure
resource "aws_route53_health_check" "azure" {
  fqdn              = "app.azure.example.com"
  port              = 443
  type              = "HTTPS"
  resource_path     = "/health"
  failure_threshold = "3"
  request_interval  = "30"
}

# Failover Policy
resource "aws_route53_record" "primary" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "app.example.com"
  type    = "A"
  
  failover_routing_policy {
    type = "PRIMARY"
  }
  
  set_identifier  = "primary"
  health_check_id = aws_route53_health_check.aws.id
  
  alias {
    name                   = aws_lb.main.dns_name
    zone_id                = aws_lb.main.zone_id
    evaluate_target_health = true
  }
}

resource "aws_route53_record" "secondary" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "app.example.com"
  type    = "A"
  
  failover_routing_policy {
    type = "SECONDARY"
  }
  
  set_identifier  = "secondary"
  health_check_id = aws_route53_health_check.azure.id
  
  alias {
    name                   = "app.azure.example.com"
    zone_id                = "AZURE_ZONE_ID"
    evaluate_target_health = true
  }
}

4.3 Geo-Routing​

# Europe -> Azure
resource "aws_route53_record" "europe" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "app.example.com"
  type    = "A"
  
  geolocation_routing_policy {
    continent = "EU"
  }
  
  set_identifier = "europe"
  
  alias {
    name    = "app.azure.example.com"
    zone_id = "AZURE_ZONE_ID"
  }
}

# Americas -> AWS
resource "aws_route53_record" "americas" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "app.example.com"
  type    = "A"
  
  geolocation_routing_policy {
    continent = "NA"
  }
  
  set_identifier = "americas"
  
  alias {
    name    = aws_lb.main.dns_name
    zone_id = aws_lb.main.zone_id
  }
}

5 - Global Load Balancing​

5.1 Options​

SolutionTypeMulti-Cloud
CloudFlareSaaSOui
AWS Global AcceleratorAWSNon natif
Azure Front DoorAzureNon natif
GCP Global Load BalancerGCPNon natif

5.2 CloudFlare comme GLB​

# CloudFlare Load Balancer
resource "cloudflare_load_balancer" "main" {
  zone_id          = var.cloudflare_zone_id
  name             = "app.example.com"
  fallback_pool_id = cloudflare_load_balancer_pool.azure.id
  default_pool_ids = [
    cloudflare_load_balancer_pool.aws.id,
    cloudflare_load_balancer_pool.azure.id
  ]
  
  steering_policy = "geo"
  
  region_pools {
    region   = "WNAM"
    pool_ids = [cloudflare_load_balancer_pool.aws.id]
  }
  
  region_pools {
    region   = "WEU"
    pool_ids = [cloudflare_load_balancer_pool.azure.id]
  }
}

resource "cloudflare_load_balancer_pool" "aws" {
  name = "aws-pool"
  
  origins {
    name    = "aws-origin"
    address = "aws-app.example.com"
    enabled = true
  }
  
  monitor = cloudflare_load_balancer_monitor.main.id
}

resource "cloudflare_load_balancer_pool" "azure" {
  name = "azure-pool"
  
  origins {
    name    = "azure-origin"
    address = "azure-app.example.com"
    enabled = true
  }
  
  monitor = cloudflare_load_balancer_monitor.main.id
}

Résumé​

Dans ce chapitre, nous avons appris :

  • Les architectures réseau Multi-Cloud
  • Le VPN Site-to-Site entre clouds
  • Les interconnexions dédiées
  • Le DNS Multi-Cloud et failover
  • Le Global Load Balancing

Prochaine étape​

Dans le prochain chapitre, nous verrons Identity & Access Management.

→ Chapitre suivant : Identity & Access

← Retour à la table des matières