Zero-trust network segmentation

expert

Scenario & brief

This estate is a security nightmare: no WAF at the edge, every tier in a public subnet, each security group trusting the whole VPC, public SSH on the hosts, an unencrypted database, and no NAT for egress.

Build a zero-trust posture. You'll need to add the edge and egress components yourself, then: a WAF gating the ALB; web/app/data all private and each trusting only the tier in front of it; no open inbound SSH; the database encrypted at rest and in transit; and NAT providing private egress. Every control has to hold.

4,000 rps peakp99 ≤ 200ms99.95% availdurability: criticalbudget $250/mo

Add components

Decide what this architecture actually needs — not every option belongs here.

Load Balancer

Networking

Subnet placement

Allowed ingress (security group)

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $250/mo · within budget

Metrics

Security posture11

Connectivity20

Requirements met14

Requirements

WAF enabled at the edge — disabled (need enabled)
ALB accepts only from the WAF — from internet (need only from waf)
Web tier private — public subnet (need private subnet)
App tier private — public subnet (need private subnet)
Data tier private — public subnet (need private subnet)
Web accepts only from the ALB — from vpc (need only from alb)
App accepts only from the web tier — from vpc (need only from web)
Data accepts only from the app tier — from vpc (need only from app)
No public SSH on web tier — public SSH open (need no public SSH)
No public SSH on app tier — public SSH open (need no public SSH)
Database not internet-reachable — isolated (need not internet-reachable)
Database encrypted at rest — plaintext (need encrypted at rest)
Database encrypted in transit — cleartext (need encrypted in transit)
Private subnets egress via NAT — no NAT (need private egress via NAT)

Advisor

WAF enabled at the edge: Add / turn this protection on.
ALB accepts only from the WAF: Restrict the security group to accept traffic only from waf.
Web tier private: Move it to the private subnet.
App tier private: Move it to the private subnet.
Data tier private: Move it to the private subnet.
Web accepts only from the ALB: Restrict the security group to accept traffic only from alb.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.