Design Secure Architectures · Topic 3 of 6
Network Security and Edge Protection
Secure a VPC with subnets, security groups, network ACLs and endpoints, and protect applications at the edge with AWS WAF, Shield and Network Firewall.
- 5 min
- Includes a diagram
- Put load balancers in public subnets and application and database tiers in private subnets.
- Security groups are stateful and allow only. NACLs are stateless, support deny rules and apply to subnets.
- Chain security groups by referencing one as the source of another instead of using IP ranges.
What it is
Securing a workload on AWS starts with the network. You decide which parts of an application are reachable from the internet, which are private, and which traffic is allowed between tiers.
The usual pattern is a Virtual Private Cloud (VPC) with public subnets for load balancers and private subnets for application servers and databases. Several layers of filtering are then added: security groups, network access control lists (NACLs), and managed edge services for web attacks.
How it works
Subnets and routing
A subnet is public when its route table sends internet bound traffic to an internet gateway. Resources in private subnets have no such route. If they need outbound internet access (for patches, for example) they use a NAT gateway that sits in a public subnet and allows connections that start inside but not from outside.
Security groups and network ACLs
| Feature | Security group | Network ACL |
|---|---|---|
| Attached to | An elastic network interface (for example an instance) | A subnet |
| State | Stateful: replies are allowed automatically | Stateless: return traffic needs its own rule |
| Rule types | Allow only | Allow and deny |
| Evaluation | All rules are checked together | Rules are checked in number order, first match wins |
| Sources | Can reference another security group | IP ranges only |
Referencing a security group as a source is the standard way to say "only the load balancer may reach the app servers". Use a NACL when you need an explicit deny, for example to block a hostile IP range for a whole subnet.
Private access to AWS services
A gateway endpoint adds a route to a prefix list so private subnets reach Amazon S3 or Amazon DynamoDB without internet access. It has no hourly charge. An interface endpoint (powered by AWS PrivateLink) places a network interface with a private IP in your subnet and supports many other services and your own services shared across VPCs.
Endpoint policies can limit which buckets or actions a gateway endpoint allows, and a bucket policy can require traffic to come through a given endpoint.
Protecting the edge
| Service | Protects against | Where it attaches |
|---|---|---|
| AWS WAF | Layer 7 web attacks such as SQL injection, cross site scripting, bad bots, and rate based abuse | CloudFront, Application Load Balancer, API Gateway, AWS AppSync |
| AWS Shield Standard | Common network and transport layer DDoS attacks | Automatically on all AWS customers at no extra cost |
| AWS Shield Advanced | Larger and more complex DDoS attacks, with response support and cost protection | CloudFront, Route 53, ALB, Elastic IP and others |
| AWS Network Firewall | Stateful inspection, intrusion prevention and domain filtering inside a VPC | Dedicated firewall endpoints in a VPC |
| AWS Firewall Manager | Central management of WAF, Shield Advanced, security group and firewall rules across accounts | AWS Organizations |
Placing CloudFront in front of an application also hides the origin and absorbs traffic at edge locations. You can restrict an Application Load Balancer or an S3 origin so that only CloudFront can reach it.
Administrative access without open ports
Do not open port 22 or 3389 to the internet. AWS Systems Manager Session Manager gives shell access through an agent and IAM permissions, with no inbound ports and with session logging. A bastion host is the older pattern and needs a locked down security group.
Visibility
VPC Flow Logs record accepted and rejected IP traffic metadata for an interface, subnet or VPC, and they are useful to troubleshoot rules and to detect unusual traffic. Logs can go to CloudWatch Logs, S3 or Amazon Data Firehose. They do not capture packet contents.
If the question mentions SQL injection, cross site scripting or blocking a country at the web layer, the answer is AWS WAF. If it mentions volumetric DDoS, the answer is Shield.
What to remember for the exam
- Put load balancers in public subnets and application and database tiers in private subnets.
- Security groups are stateful and allow only. NACLs are stateless, support deny rules and apply to subnets.
- Chain security groups by referencing one as the source of another instead of using IP ranges.
- A NAT gateway gives private subnets outbound internet access, and an internet gateway is needed for public ones.
- Gateway endpoints exist for S3 and DynamoDB. Interface endpoints (PrivateLink) cover many other services.
- AWS WAF works at layer 7. Shield Standard is automatic, and Shield Advanced adds protection and response support.
- Use Firewall Manager to apply WAF and other rules across an organization.
- Session Manager removes the need for open administrative ports and bastion hosts.
Common mistakes
Expecting a security group to deny. Security groups have no deny rule. To block one address you need a NACL (or a WAF rule at the edge).
Forgetting ephemeral ports in a NACL. Because a NACL is stateless, a rule that allows inbound traffic needs a matching outbound rule for the reply ports.
Sending S3 traffic through a NAT gateway. This costs more and uses the internet path. A gateway endpoint keeps the traffic private and avoids the NAT data processing charge.
Using WAF for network floods. WAF inspects HTTP requests. Large network floods are the job of Shield and of the edge network.
Putting a database in a public subnet or opening its security group to 0.0.0.0/0 is almost always the wrong answer, even if the question says the database "must be reachable".
Check yourself
Which feature lets a security group allow only traffic from a load balancer?
Use the load balancer's security group as the source in the application's inbound rule.
How can instances in a private subnet reach S3 without using the internet?
Create a gateway VPC endpoint for S3 and add it to the subnet's route table.
Which service blocks SQL injection attempts against an Application Load Balancer?
AWS WAF, attached to the load balancer with an appropriate rule set.
Topic 3 of 6 in Design Secure Architectures
Test yourself on Design Secure Architectures
The full AWS SAA-C03 question bank has 823 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.