IPv6 على AWS: VPC و EC2 و ELB وما بعدها

aws ec2 associate-vpc-cidr-block \
  --vpc-id vpc-0abc123def456 \
  --amazon-provided-ipv6-cidr-block

{
  "Ipv6CidrBlockAssociation": {
    "Ipv6CidrBlock": "2600:1f13:1234:5600::/56",
    "Ipv6CidrBlockState": {
      "State": "associating"
    }
  }
}

aws ec2 describe-vpcs --vpc-ids vpc-0abc123def456 \
  --query 'Vpcs[0].Ipv6CidrBlockAssociationSet[0].Ipv6CidrBlockState.State'

aws ec2 describe-vpcs --vpc-ids vpc-0abc123def456 \
  --query 'Vpcs[0].Ipv6CidrBlockAssociationSet[0].Ipv6CidrBlock'

# Public subnet A - 2600:1f13:1234:5600::/64
aws ec2 associate-subnet-cidr-block \
  --subnet-id subnet-0abc111 \
  --ipv6-cidr-block 2600:1f13:1234:5600::/64
 
# Public subnet B - 2600:1f13:1234:5601::/64
aws ec2 associate-subnet-cidr-block \
  --subnet-id subnet-0abc222 \
  --ipv6-cidr-block 2600:1f13:1234:5601::/64
 
# Private subnet A - 2600:1f13:1234:5610::/64
aws ec2 associate-subnet-cidr-block \
  --subnet-id subnet-0abc333 \
  --ipv6-cidr-block 2600:1f13:1234:5610::/64

aws ec2 modify-subnet-attribute \
  --subnet-id subnet-0abc111 \
  --assign-ipv6-address-on-creation

aws ec2 create-route \
  --route-table-id rtb-0abc123 \
  --destination-ipv6-cidr-block ::/0 \
  --gateway-id igw-0def456

aws ec2 create-route \
  --route-table-id rtb-0abc789 \
  --destination-ipv6-cidr-block ::/0 \
  --egress-only-internet-gateway-id eigw-0ghi012

aws ec2 describe-route-tables --route-table-ids rtb-0abc123 \
  --query 'RouteTables[0].Routes'

aws ec2 run-instances \
  --image-id ami-0abc123 \
  --instance-type t3.medium \
  --subnet-id subnet-0abc111 \
  --ipv6-address-count 1 \
  --key-name mykey \
  --security-group-ids sg-0abc456

aws ec2 run-instances \
  --image-id ami-0abc123 \
  --instance-type t3.medium \
  --subnet-id subnet-0abc111 \
  --ipv6-addresses Ipv6Address=2600:1f13:1234:5600::a \
  --key-name mykey \
  --security-group-ids sg-0abc456

aws ec2 describe-instances --instance-ids i-0abc123 \
  --query 'Reservations[0].Instances[0].NetworkInterfaces[0].NetworkInterfaceId'

aws ec2 assign-ipv6-addresses \
  --network-interface-id eni-0def456 \
  --ipv6-address-count 1

aws ec2 assign-ipv6-addresses \
  --network-interface-id eni-0def456 \
  --ipv6-addresses 2600:1f13:1234:5600::b

ip -6 addr show

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001
    inet6 2600:1f13:1234:5600::a/128 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::4a2:c9ff:fe12:3456/64 scope link
       valid_lft forever preferred_lft forever

ping6 google.com
curl -6 https://ifconfig.co

sudo cat /var/log/cloud-init.log | grep -i ipv6

# IPv4
aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc123 \
  --ip-permissions IpProtocol=tcp,FromPort=443,ToPort=443,IpRanges='[{CidrIp=0.0.0.0/0}]'
 
# IPv6
aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc123 \
  --ip-permissions IpProtocol=tcp,FromPort=443,ToPort=443,Ipv6Ranges='[{CidrIpv6=::/0}]'

aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc123 \
  --ip-permissions IpProtocol=tcp,FromPort=22,ToPort=22,Ipv6Ranges='[{CidrIpv6=2001:db8::/32,Description="Office IPv6"}]'

aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc123 \
  --ip-permissions IpProtocol=ipv6-icmp,FromPort=-1,ToPort=-1,Ipv6Ranges='[{CidrIpv6=::/0}]'

aws ec2 create-managed-prefix-list \
  --prefix-list-name org-ipv6-ranges \
  --address-family IPv6 \
  --max-entries 10 \
  --entries Cidr=2001:db8:100::/40,Description=HQ \
           Cidr=2001:db8:200::/40,Description=DataCenter

aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc123 \
  --ip-permissions IpProtocol=tcp,FromPort=443,ToPort=443,PrefixListIds='[{PrefixListId=pl-0abc123}]'

aws elbv2 create-load-balancer \
  --name my-alb \
  --subnets subnet-0abc111 subnet-0abc222 \
  --security-groups sg-0abc123 \
  --ip-address-type dualstack

aws elbv2 set-ip-address-type \
  --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/1234567890abcdef \
  --ip-address-type dualstack

dig my-alb-1234567890.us-east-1.elb.amazonaws.com A
dig my-alb-1234567890.us-east-1.elb.amazonaws.com AAAA

aws elbv2 create-load-balancer \
  --name my-nlb \
  --type network \
  --subnets subnet-0abc111 subnet-0abc222 \
  --ip-address-type dualstack

aws elbv2 create-target-group \
  --name my-targets-ipv4 \
  --protocol HTTP \
  --port 80 \
  --vpc-id vpc-0abc123 \
  --ip-address-type ipv4

aws elbv2 create-target-group \
  --name my-targets-ipv6 \
  --protocol HTTP \
  --port 80 \
  --vpc-id vpc-0abc123 \
  --ip-address-type ipv6

aws ec2 create-egress-only-internet-gateway \
  --vpc-id vpc-0abc123

{
  "EgressOnlyInternetGateway": {
    "EgressOnlyInternetGatewayId": "eigw-0abc123"
  }
}

aws ec2 create-route \
  --route-table-id rtb-0abc789 \
  --destination-ipv6-cidr-block ::/0 \
  --egress-only-internet-gateway-id eigw-0abc123

aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234567890ABC \
  --change-batch '{
    "Changes": [{
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "app.example.com",
        "Type": "AAAA",
        "TTL": 300,
        "ResourceRecords": [{"Value": "2600:1f13:1234:5600::a"}]
      }
    }]
  }'

aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234567890ABC \
  --change-batch '{
    "Changes": [{
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "app.example.com",
        "Type": "AAAA",
        "AliasTarget": {
          "HostedZoneId": "Z35SXDOTRQ7X7K",
          "DNSName": "my-alb-1234567890.us-east-1.elb.amazonaws.com",
          "EvaluateTargetHealth": true
        }
      }
    }]
  }'

aws route53 create-health-check \
  --health-check-config \
    IPAddress=2600:1f13:1234:5600::a,Port=443,Type=HTTPS,ResourcePath=/health,RequestInterval=30,FailureThreshold=3 \
  --caller-reference $(uuidgen)

dig d111111abcdef8.cloudfront.net AAAA

aws cloudfront create-distribution \
  --distribution-config file://distribution-config.json

{
  "Origins": {
    "Items": [{
      "Id": "my-origin",
      "DomainName": "example.com",
      "CustomOriginConfig": {
        "OriginProtocolPolicy": "https-only"
      }
    }]
  },
  "Enabled": true,
  "Comment": "My distribution"
}

# VPC with IPv6
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  assign_generated_ipv6_cidr_block = true
  enable_dns_support   = true
  enable_dns_hostnames = true
 
  tags = {
    Name = "main-vpc"
  }
}
 
# Internet Gateway
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
}
 
# Egress-Only Internet Gateway
resource "aws_egress_only_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
}
 
# Public Subnet
resource "aws_subnet" "public" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  ipv6_cidr_block         = cidrsubnet(aws_vpc.main.ipv6_cidr_block, 8, 1)
  assign_ipv6_address_on_creation = true
  availability_zone       = "us-east-1a"
 
  tags = {
    Name = "public-subnet"
  }
}
 
# Route Table for Public Subnet
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
 
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
 
  route {
    ipv6_cidr_block = "::/0"
    gateway_id      = aws_internet_gateway.main.id
  }
 
  tags = {
    Name = "public-rt"
  }
}
 
resource "aws_route_table_association" "public" {
  subnet_id      = aws_subnet.public.id
  route_table_id = aws_route_table.public.id
}
 
# Security Group
resource "aws_security_group" "web" {
  name        = "web-sg"
  description = "Allow HTTP/HTTPS"
  vpc_id      = aws_vpc.main.id
 
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
 
  ingress {
    from_port   = -1
    to_port     = -1
    protocol    = "ipv6-icmp"
    ipv6_cidr_blocks = ["::/0"]
  }
 
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
}
 
# EC2 Instance with IPv6
resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"  # Amazon Linux 2023
  instance_type = "t3.medium"
  subnet_id     = aws_subnet.public.id
  ipv6_address_count = 1
 
  vpc_security_group_ids = [aws_security_group.web.id]
 
  tags = {
    Name = "web-server"
  }
}
 
# Application Load Balancer
resource "aws_lb" "main" {
  name               = "main-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.web.id]
  subnets            = [aws_subnet.public.id]
  ip_address_type    = "dualstack"
 
  tags = {
    Name = "main-alb"
  }
}
 
# Output IPv6 CIDR
output "vpc_ipv6_cidr" {
  value = aws_vpc.main.ipv6_cidr_block
}
 
output "instance_ipv6" {
  value = aws_instance.web.ipv6_addresses
}

terraform init
terraform plan
terraform apply

# اختبار حل DNS
dig app.example.com AAAA
 
# اختبار الوصول إلى HTTP/HTTPS
curl -6 https://app.example.com
 
# اختبار من الحالة
ssh ec2-user@<instance-ipv6>
ping6 google.com
curl -6 https://ifconfig.co

aws ec2 create-network-insights-path \
  --source <instance-eni> \
  --destination <alb-eni> \
  --protocol tcp \
  --destination-port 443
 
aws ec2 start-network-insights-analysis \
  --network-insights-path-id <path-id>