Module 4: Securing Your Infrastructure
In Module 4 of AWS Academy Cloud Security Foundations, I explored how VPC architecture, subnets, security groups, network ACLs, load balancers, and compute resources work together to create a more secure cloud infrastructure.
Introduction
In Module 4 of AWS Academy Cloud Security Foundations, I explored how AWS networking components and security controls work together to protect cloud infrastructure.
Structure of a Three-Tier Web Application
I started by learning about the three-tier web application architecture, which separates an application into the presentation, application, and database tiers.
Separating these tiers helps control how the different components communicate and can reduce unnecessary exposure between them.
Using a VPC
I then explored Amazon Virtual Private Cloud (VPC), which provides a logically isolated network for AWS resources.
I learned how a VPC uses components such as subnets and route tables to organize resources and control network communication. AWS also recommends using subnets to isolate different application tiers within a VPC.
Public and Private Subnets
A key part of the module was understanding public and private subnets
A public subnet has a route to an internet gateway, while resources that should not be directly accessible from the internet can be placed in private subnets.
This showed me how network placement itself can be an important security consideration.
Security Groups
I also learned about AWS security groups which control the inbound and outbound traffic allowed for associated resources.
Security groups are stateful, so response traffic for an allowed connection is automatically allowed. They support allow rules and can be used to control access based on factors such as protocol, port, and source or destination.
Network ACLs
Another important concept was network Access Control Lists (NACLs).
NACLs operate at the subnet level, unlike security groups, which operate at the resource level. NACLs are stateless and support both allow and deny rules. Their rules are evaluated in numerical order, starting with the lowest number.
Understanding the difference between security groups and NACLs helped me see how they can provide different layers of network protection.
Load Balancers
I also explored AWS load balancers, and their role in distributing incoming application traffic across targets.
This helped me understand how traffic management fits into an application architecture while security controls determine which traffic is permitted to reach the relevant resources.
Protecting Compute Resources
The module also covered protecting compute resources by controlling network access and avoiding unnecessary exposure.
One principle that stood out to me was the importance of allowing only the traffic that is required for a resource to perform its intended function.
Key Takeaway
Module 4 helped me understand that securing cloud infrastructure involves more than protecting individual resources.
VPC design, subnet segmentation, traffic rules, security groups, network ACLs, and load balancing all play different roles in building a secure and well-organized AWS environment
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article