云网络：配置双向连通路径与访问规则 · 拓扑文件与边界至完整隔离VPC配置

本篇以VPC 双向路径工作表为例；前置是子网/网卡关联、路由、安全组与 NACL。源码与输入与下文配置共用同一份文件，示例未执行。

核对日期2026-10-17；适用范围：以AWS VPC/EC2 2016-11-15 API对象模型为固定示例，核对2026-10-17官方中英文网络ACL/安全组资料；不是跨云通用配置或云端当前最新部署模板。示例未执行；真实环境仍需验证产品配置、权限、连通与恢复结果。先读起点理解前置，再按章节完成推演。

云网络：配置双向连通路径与访问规则

本篇以VPC 双向路径工作表为例；前置是子网/网卡关联、路由、安全组与 NACL。源码与输入与下文配置共用同一份文件，示例未执行。

拓扑文件与边界

云网络工作表由topology.json与paths.json完整定义子网、路由关联、安全组、NACL、DNS及成功失败案例。示例未执行，无服务、SDK或依赖安装；JSON是自定义审阅格式，不是AWS请求。它把规则假设显式列出，读者仍要在真实环境核对网卡关联、操作系统防火墙和数据库监听，本例不模拟这些运行组件。

正向连接逐跳

云网络正向路径从app10.40.1.10:49152到db10.40.2.10:5432，先核对app-sg出站目标db-sg、app子网NACL出站5432和local路由，再看db子网NACL入站5432与db-sg来源app-sg。工作表规则都满足才得出静态允许；任何一个阻断都不能靠另一个层的Allow覆盖。安全组ID引用是身份集合，不是DNS名，私有IP变化时应核对真实成员。

返回路径和失败推演

云网络返回路径从db:5432到app:49152，安全组有连接状态但两侧NACL仍要显式允许临时端口。移除app入站1024–65535规则即因隐式拒绝而失败，正向SYN通过不保证握手完成。课堂用宽临时范围表达机制，生产应根据客户端OS端口范围及来源网段缩窄。公网192.0.2.10既没有路由/公网地址也无来源授权，工作表预期拒绝。

完整隔离VPC配置

network.yaml完整声明VPC、两个子网、专属路由表与关联、两组安全组、NACL及关联/四条规则、私有zone和A记录。路由表自动具有VPC local路由，不添加公网默认路由、IGW、NAT或计算实例。模板app安全组出站使用10.40.2.0/24目的网段，JSON工作表则用db-sg目标引用表达更窄的身份设计；两者是明确的替代形式，真实部署前应选择符合依赖关系的规则。db组只放行app组入站，显式回环限定出站规则用于防止自动放行全部出站，已建立回流仍依安全组状态；NACL另显式放行回包。

示例example.invalid私有名称与10.40网段必须由读者映射到自有隔离环境，确保地址不重叠。A记录中的10.40.2.10仅预留数据库位置，模板没有数据库或监听程序，所以部署网络后仍不可据此判断应用可达。成功预期仅是网络对象与关联建立；DNS权限/配额/冲突或错误区域会导致失败。日后读者用自有change set流程审阅后执行。

安全组属性与默认出站规则

yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Isolated two-subnet teaching network; no public IP, IGW, NAT or compute; not deployed.
Resources:
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.40.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
  AppSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: {Ref: Vpc}
      CidrBlock: 10.40.1.0/24
      MapPublicIpOnLaunch: false
  DbSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: {Ref: Vpc}
      CidrBlock: 10.40.2.0/24
      MapPublicIpOnLaunch: false
  AppRoutes:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: {Ref: Vpc}
  DbRoutes:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: {Ref: Vpc}
  AppRouteAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: {Ref: AppRoutes}
      SubnetId: {Ref: AppSubnet}
  DbRouteAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: {Ref: DbRoutes}
      SubnetId: {Ref: DbSubnet}
  AppSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: {Ref: Vpc}
      GroupDescription: Application access only to database TCP5432
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 10.40.2.0/24
  DbSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: {Ref: Vpc}
      GroupDescription: Database ingress only from app group
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          SourceSecurityGroupId: {Ref: AppSg}
      # Explicit restricted rule prevents the automatic allow-all egress default.
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 127.0.0.1/32
  AppAcl:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId: {Ref: Vpc}
  DbAcl:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId: {Ref: Vpc}
  AppAclAssociation:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      SubnetId: {Ref: AppSubnet}
      NetworkAclId: {Ref: AppAcl}
  DbAclAssociation:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      SubnetId: {Ref: DbSubnet}
      NetworkAclId: {Ref: DbAcl}
  AppOut:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: {Ref: AppAcl}
      RuleNumber: 100
      Protocol: 6
      RuleAction: allow
      Egress: true
      CidrBlock: 10.40.2.0/24
      PortRange: {From: 5432, To: 5432}
  AppIn:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: {Ref: AppAcl}
      RuleNumber: 100
      Protocol: 6
      RuleAction: allow
      Egress: false
      CidrBlock: 10.40.2.0/24
      PortRange: {From: 1024, To: 65535}
  DbIn:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: {Ref: DbAcl}
      RuleNumber: 100
      Protocol: 6
      RuleAction: allow
      Egress: false
      CidrBlock: 10.40.1.0/24
      PortRange: {From: 5432, To: 5432}
  DbOut:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: {Ref: DbAcl}
      RuleNumber: 100
      Protocol: 6
      RuleAction: allow
      Egress: true
      CidrBlock: 10.40.1.0/24
      PortRange: {From: 1024, To: 65535}
  PrivateZone:
    Type: AWS::Route53::HostedZone
    Properties:
      Name: lab.example.invalid
      VPCs:
        - VPCId: {Ref: Vpc}
          VPCRegion: {Ref: 'AWS::Region'}
  DbRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: {Ref: PrivateZone}
      Name: db.lab.example.invalid
      Type: A
      TTL: '60'
      ResourceRecords: ['10.40.2.10']
Outputs:
  AppSubnetId:
    Value: {Ref: AppSubnet}
  DbSubnetId:
    Value: {Ref: DbSubnet}
  AppSecurityGroupId:
    Value: {Ref: AppSg}
  DbSecurityGroupId:
    Value: {Ref: DbSg}

云网络：配置双向连通路径与访问规则 · 拓扑文件与边界至完整隔离VPC配置 ​