MushyBook
All challenges

Defense in depth

expert

Scenario & brief

A compliance-critical system needs every security layer on at once — defense in depth. There's no WAF and no NAT yet: add them. By the end: nothing reaches the ALB except through the WAF; app, database, cache and S3 are all unreachable from the internet; there's no open inbound SSH; the database, cache and S3 are encrypted at rest, with TLS in transit on the ALB, app and database; and private-subnet egress works. Miss any single layer and the volcano stays hot.

3,000 rps peakp99 ≤ 200ms99.95% availdurability: criticalbudget $250/mo

Add components

Decide what this architecture actually needs — not every option belongs here.

Load Balancer

Networking

System health

Erupting · SLA breach

4

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $250/mo · within budget

Metrics

Security posture0
Connectivity25
Requirements met7

Requirements

  • WAF enabled at the edge — disabled (need enabled)
  • ALB accepts only from the WAF — from internet (need only from waf)
  • ALB serves TLS — cleartext (need encrypted in transit)
  • App servers private — public subnet (need private subnet)
  • No public SSH on app servers — public SSH open (need no public SSH)
  • App traffic encrypted in transit — cleartext (need encrypted in transit)
  • Database private — public subnet (need private subnet)
  • Database not internet-reachable — internet-reachable (need not internet-reachable)
  • Database encrypted at rest — plaintext (need encrypted at rest)
  • Database encrypted in transit — cleartext (need encrypted in transit)
  • Cache encrypted at rest — plaintext (need encrypted at rest)
  • S3 bucket not public — internet-reachable (need not internet-reachable)
  • S3 encrypted at rest — plaintext (need encrypted at rest)
  • Private subnets egress via NAT — no NAT (need private egress via NAT)

Advisor

  • WAF enabled at the edge: Add / turn this protection on.
  • ALB accepts only from the WAF: Restrict the security group to accept traffic only from waf.
  • ALB serves TLS: Require TLS/HTTPS in transit.
  • App servers private: Move it to the private subnet.
  • No public SSH on app servers: Close public SSH — use SSM Session Manager or a bastion host instead.
  • App traffic encrypted in transit: Require TLS/HTTPS in transit.

Discussion

Sign in to join the discussion.

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.