MushyBook
All challenges

Segment a multi-tier VPC

advanced

Scenario & brief

A three-tier system (web → app → data) was deployed flat: every tier is public and its security group trusts the entire VPC. One compromised host can reach anything.

By the end, each tier should trust only the tier directly in front of it — web from the ALB, app from web, data from app — with web, app, and database all unreachable from the internet directly, the database encrypted at rest, and NAT still providing egress. Only the ALB stays public.

2,000 rps peakp99 ≤ 200ms99.95% availdurability: criticalbudget $200/mo

Load Balancer

Networking

System health

Erupting · SLA breach

15

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture20
Connectivity40
Requirements met30

Requirements

  • Load balancer is internet-facing — internet-facing (need internet-facing)
  • Web tier in a private subnet — public subnet (need private subnet)
  • App tier in a private subnet — public subnet (need private subnet)
  • Data tier in a private subnet — public subnet (need private subnet)
  • Web tier accepts only from the ALB — from vpc (need only from alb)
  • App tier accepts only from the web tier — from vpc (need only from web)
  • Data tier accepts only from the app tier — from vpc (need only from app)
  • Database not reachable from the internet — isolated (need not internet-reachable)
  • Database encrypted at rest — plaintext (need encrypted at rest)
  • Private subnets egress via NAT — no NAT (need private egress via NAT)

Advisor

  • Web tier in a private subnet: Move it to the private subnet.
  • App tier in a private subnet: Move it to the private subnet.
  • Data tier in a private subnet: Move it to the private subnet.
  • Web tier accepts only from the ALB: Restrict the security group to accept traffic only from alb.
  • App tier accepts only from the web tier: Restrict the security group to accept traffic only from web.
  • Data tier accepts only from the app tier: Restrict the security group to accept traffic only from app.

Discussion

Sign in to join the discussion.

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.