My Learning Journey: Securing Your Cloud Infrastructure
Learn how to secure AWS workloads using VPCs, subnets, routing, and access controls to protect resources and control network traffic.
Securing cloud infrastructure starts with designing applications and networks that limit exposure and control access. A common approach is to separate an application into different layers and place resources in appropriate network locations.
Three-Tier Application Architecture
A typical web application can be divided into three layers:
- Presentation layer: The frontend users interact with.
- Business logic layer: The backend that processes requests and application logic.
- Data layer: Databases and other systems that store information.
Separating these layers makes applications easier to manage, scale, and secure. It also allows sensitive resources, such as databases, to remain isolated from direct internet access.
Using Amazon VPC
Amazon Virtual Private Cloud (Amazon VPC) provides a logically isolated network where AWS resources can be launched. It gives you control over:
- IP address ranges
- Subnets
- Route tables
- Network gateways
- Network traffic
Public and Private Subnets
A public subnet has a route to an Internet Gateway (IGW), allowing resources with public IP addresses to communicate with the internet. Public subnets are commonly used for internet-facing resources such as web servers.
A private subnet does not have a direct route to the Internet Gateway. It is suitable for backend applications, databases, and other resources that should not be directly accessible from the internet.
Route Tables
Route tables contain rules that determine where network traffic is sent. For example, a public subnet can use a route such as
0.0.0.0/0 to an Internet Gateway for internet access. Private subnets can use a NAT Gateway when resources need outbound internet access without allowing direct inbound connections.Managing IP Addresses
Resources in a VPC can have private IP addresses for communication within the network. Public IPv4 addresses can provide internet connectivity.
An Elastic IP address is a static public IPv4 address that can be associated with an AWS resource and re-associated when needed.
Building a Secure Network
A secure VPC design should avoid exposing every resource to the internet. Place internet-facing components in public subnets while keeping application servers and databases in private subnets. Combining VPCs, public and private subnets, route tables, Internet Gateways, and NAT Gateways provides better network isolation, controlled traffic flow, and a stronger foundation for securing AWS workloads.
Internet Gateway
An Internet Gateway (IGW) connects a VPC to the internet. Resources in a public subnet need a route such as
0.0.0.0/0 to the IGW and a public IPv4 address to access the internet.NAT Gateway
A NAT Gateway allows resources in private subnets to make outbound internet connections without being directly reachable from the internet. This is useful for updates and other external services while keeping private resources protected.
Security Groups
Security Groups act as virtual firewalls for resources such as EC2 instances. They control inbound and outbound traffic and are stateful, so return traffic is automatically allowed for permitted connections.
Network ACLs
Network Access Control Lists (NACLs) provide security at the subnet level. They control both inbound and outbound traffic and are stateless, meaning return traffic must be explicitly allowed. Rules are evaluated in numerical order.
Secure AWS infrastructure combines public and private subnets, controlled routing, Internet and NAT Gateways, Security Groups, and NACLs to limit exposure and provide multiple layers of network security.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article