My week 3 Takeaways – Securing Cloud Infrastructure with AWS
A reflection on my AWS Cloud Security learning journey, exploring VPCs, subnets, IP addressing, routing, network security, and how AWS infrastructure components work together to build secure and reliable cloud environments.
My Learning Takeaways – Securing Cloud Infrastructure with AWS
As I continue my AWS Cloud Security Foundations journey, this module introduced me to the practical side of securing cloud infrastructure, particularly how networking components work together to protect resources and manage communication.
One thing that stood out to me is that cloud security is not just about restricting access. It also involves understanding how resources are connected, how traffic moves, and how to create an environment where applications can operate securely without unnecessary exposure.
Here are some of my key takeaways from this learning experience.
1. Understanding Cloud Infrastructure
I learned that cloud infrastructure consists of the resources required to run applications and services, including servers, networks, storage, and security components.
Securing this infrastructure means ensuring that these resources are properly configured, protected from unauthorized access, and available when needed.
This helped me understand why security should be considered from the beginning of an infrastructure design rather than being treated as something to add later.
2. Three-Tier Architecture
One of the concepts I found interesting was the three-tier architecture, which separates an application into three layers:
- Presentation Layer: The part users interact with, such as a website or application interface.
- Application Layer: Handles the processing and logic behind the application.
- Data Layer: Responsible for storing and managing information.
- Application Layer: Handles the processing and logic behind the application.
- Data Layer: Responsible for storing and managing information.
A practical example is a student portal. The login page represents the presentation layer, the system that processes login requests belongs to the application layer, while student records are managed within the data layer.
I learned that separating these layers helps improve organization, security, scalability, and maintenance.
3. Virtual Private Cloud (VPC) and CIDR
VPC stands for Virtual Private Cloud. It provides a logically isolated network environment within AWS where cloud resources can be launched and managed.
I understood a VPC as creating my own private network within AWS, where I have control over IP address ranges, subnets, routing, and network access.
Another important concept I learned was CIDR, which stands for Classless Inter-Domain Routing. It is a method of representing IP address ranges using a network address and prefix length.
For example:
- "10.0.0.0/16" – An example of a VPC address range.
- "10.0.1.0/24" – An example of a public subnet range.
- "10.0.2.0/24" – An example of a private subnet range.
- "10.0.1.0/24" – An example of a public subnet range.
- "10.0.2.0/24" – An example of a private subnet range.
I also learned that as the prefix length increases, the total number of IP addresses in the range decreases.
This helped me better understand how AWS allocates network addresses to different resources.
4. Public and Private Subnets
A subnet is a smaller network within a VPC.
I learned that public and private subnets serve different purposes.
A public subnet has a route to an Internet Gateway, allowing internet connectivity when the required configurations are in place.
A private subnet does not have a direct route to an Internet Gateway and is commonly used for resources such as databases that should not be directly accessible from the internet.
This distinction helped me understand why not every resource in a cloud environment should be exposed publicly.
5. Routing, Route Tables, and Internet Gateway
This section helped me understand how network communication is directed.
Routing is the process of determining where network traffic should go, while a Route Table contains the rules that guide this traffic.
I also learned about the Internet Gateway (IGW), which enables communication between a VPC and the internet when properly configured.
One route that caught my attention was:
"0.0.0.0/0 → Internet Gateway"
I understood this as a default route directing traffic for all IPv4 destinations through the specified gateway, provided no more specific route takes precedence.
It was interesting to see how a simple routing configuration can determine whether a resource has a path to the internet.
6. Security Groups and Network ACLs
Another important part of this module was understanding the difference between Security Groups and Network Access Control Lists (NACLs).
Security Groups act as virtual firewalls associated with resources such as EC2 instances. They control inbound and outbound traffic and are stateful.
Network ACLs operate at the subnet level and support both Allow and Deny rules. Unlike Security Groups, they are stateless, meaning inbound and outbound traffic must be evaluated independently.
My major takeaway here is that both provide network security, but they operate at different levels and serve complementary purposes.
7. Load Balancers and Amazon EC2
I also learned about Load Balancers and Amazon EC2.
EC2 stands for Elastic Compute Cloud. It provides virtual computing capacity in AWS, allowing users to run applications, host websites, and perform computing tasks.
A Load Balancer distributes incoming traffic across multiple targets, such as EC2 instances.
I found this concept easier to understand by comparing it to distributing customers among several service attendants rather than allowing one person to handle everyone.
In a cloud environment, load balancing helps improve application availability, scalability, and performance.
My Key Takeaway
This module has helped me see cloud infrastructure from a broader perspective.
Previously, terms such as VPC, CIDR, subnetting, routing, and network security seemed like separate technical concepts. However, I am beginning to understand how they connect and work together to create a functional and secure cloud environment.
I have also realized that building secure infrastructure requires more than simply deploying resources. It requires thoughtful network design, proper access control, and an understanding of how traffic moves between different components.
As I continue this journey, my focus is on strengthening my practical understanding and becoming more confident in configuring and securing AWS resources.
Every new concept is another step forward in my growth as an aspiring cloud security professional.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article