VPC Segmentation and Endpoints

What it is

A Virtual Private Cloud (VPC) is your private network in AWS. Network security in a VPC means dividing it into tiers, controlling traffic between them with security groups and network ACLs, and keeping AWS service traffic off the public internet with endpoints.

The exam gives you a symptom or a requirement and asks which control to change, so you need a clear picture of what each control does and how they differ.

How it works

Subnet tiers and routing

Place resources by exposure.

Public subnets have a route to an internet gateway and hold only load balancers or NAT gateways. Private subnets reach the internet only through a NAT gateway. Isolated subnets have no internet route at all, and hold databases.

Route tables decide where traffic can go. A subnet is public only because its route table points to an internet gateway, not because of its name. Keep sensitive subnets on separate route tables so a change to one does not expose others.

Security groups versus network ACLs

Use security groups as the main control, and referencing another security group as source gives tier to tier rules that survive IP changes. Use network ACLs for broad subnet level rules and explicit denies, such as blocking a known bad address range.

Because network ACLs are stateless, return traffic needs an outbound rule for ephemeral ports (the high numbered client ports). A frequent fault is allowing port 443 inbound while denying the return ports outbound.

Inbound  rule 100  TCP 443        0.0.0.0/0   ALLOW
Outbound rule 100  TCP 1024-65535 0.0.0.0/0   ALLOW

VPC endpoints

Endpoints let resources in a VPC reach AWS services privately, without an internet gateway or NAT.

A gateway endpoint adds a route, so it affects every subnet whose route table carries the entry. An interface endpoint is reached by a private IP and DNS name, and it has a security group that must allow the clients.

Endpoint policies and data perimeter

An endpoint policy is a resource policy on the endpoint that limits which principals can use it and which actions and resources are allowed through it.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": ["s3:GetObject", "s3:PutObject"],
    "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*"
  }]
}

This endpoint lets traffic through to one bucket only. The bucket can in turn insist on private access by checking the endpoint.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": ["arn:aws:s3:::amzn-s3-demo-bucket", "arn:aws:s3:::amzn-s3-demo-bucket/*"],
    "Condition": { "StringNotEquals": { "aws:SourceVpce": "vpce-0123456789abcdef0" } }
  }]
}

Be careful with this deny pattern, because it also blocks access from the console and from administrators outside the VPC. Add an exception for a trusted administrative role if you still need that access.

The combination of endpoint policies, bucket policies with aws:SourceVpce, aws:SourceVpc or aws:PrincipalOrgID, and SCPs is called a data perimeter. It keeps your data in trusted identities, from expected networks, and to trusted resources.

Connecting VPCs

PrivateLink is the most restrictive choice, because consumers reach only the service and cannot route into your VPC. It also works with overlapping address ranges.

Outbound control and public access

Block unnecessary public IP assignment, and control outbound traffic through NAT gateways with firewall inspection. VPC Block Public Access can block internet gateway traffic for all VPCs in an account Region, with exclusions for the VPCs or subnets that need internet access.