Cloud Security
Advanced 14 min read Cloud Security

Network & Edge Security

Wall every layer twice

Depth in network: VPC segmentation, security groups vs NACLs, WAF at the edge, DDoS shields, private endpoints, and egress control. The 'network' layer is the most fought-over strata in every cloud incident.

security groupNACLWAFshieldprivate endpointegressprofile
Prerequisites: Security Basics & Core Services
Before we start

What you will learn

  • Layer SG/NACL/WAF/privatelink/egress correctly
  • Lock internet-facing ingress and default-deny egress
  • Depoly edge protections (WAF, shield) against L3-7 attacks
In 60 seconds

SG (stateful, instance-level), NACL (stateless, subnet-level), WAF (L7 filtering), Shield/DDoS (L3/4), private endpoints (avoid public exposure), egress proxy (inspect outbound). Together they define the attackable surface instead of you discovering it.

Introduction

What is this?

Layers: SG allow-list ingress/egress (stateful), NACL subnet default+explicit (stateless), Route53/DNS routing, LB (public, WAF attached), WAF (managed rule groups OWASP/bots/rate), Shield Advanced (L3/L4 volumetric mitigation), private endpoints (Privatelink/SVC/VPC endpoint) for PaaS without public IPs, egress via NAT/proxy or N-SFW for inspection, flow logs for visibility. Edge placement: CDN+WAF for public web; ALU Application Gateway; Google Cloud Armor + load. Protocols: hsts, ALPN, HTTPS-only bucket policies. Default posture: public = forbidden except known LB/DNS; egress = allow-listed.

Motivation

Why do you need it?

  • Most breaches use a single open security hole; SG+NACL+WAF each act as independent fails-at-the-wrong-time.
  • WAF + Shield deflect popular attacks before they reach compute.
  • Private endpoints remove attack surface from PaaS (S3/DBs/LB) that would otherwise hang public.
  • Egress monitoring detects the exfil half of 'phish→code→expire' chains.
Think about it

Mental model

Imagine

A castle: outer wall (NACL), gate guards (SG), and shielded merlons for archers (WAF) plus a moat that sinks boats (DDoS shield)

Think of

Layered network defense

No single wall stops a determined army; the moat, wall, gates and guards each kill a different attack vector — and the spy (flow logs) watches who's coming and going.

Mechanics

How it works

  • Ingress: DNS → WAF/Shield at the edge filters → LB → SG targets instances → app.
  • NACLs at subnet edge give an extra stateless gate (rule order matters).
  • Private endpoints route PaaS calls over internal mesh instead of the internet.
  • Egress: NAT/proxy enforces allow-list + logs; unexpected DNS/conns flag via flow logs.
  • Default-deny ingress + greedy-side SG makes 'port exposed' the exception needing explicit reasoning.

Edge-to-app defense strata.

Internet
WAF + Shield
LB
SG (instance)
App
Flow logs
Hands-on

Examples

Egress allow-list via NAT + flow log alert

Egress allow-list via NAT + flow log alert
# resources: NAT GW + routing table for private subnets
# flow logs on all VPCs streamed to SIEM
resource "aws_flow_log" "vpc" { vpc_id = vpc.id; traffic_type = "ALL"; destination = "cloudwatch" }
# alert rule: any egress to geoblock'd ASN or unexpected port 9000+ from app tier  -> page

Public inbound is a controlled path; outbound is observed and allow-listed by surprising behavior alerting.

Real world

In production

  • Public-only LB + WAF managed rules; instances fully private (no public IPs).
  • Private endpoints to S3/DB/Search for compliance-laden workloads.
  • Egress watch: DNS-based or IP proxy; alert on first-time destinations from prod.
Guidelines

Best practices

  • Default-deny both directions; every rule states the business need.
  • TLS everywhere with current ciphers; HTTP → redirect then deny.
  • Put WAF on every public endpoint (not just 'prod web').
  • Flow logs + DNS logs to SIEM — the network's own audit layer.
  • Rehearse: kill LB/all ingress suddenly and confirm app can't be reached (blast-radius drill).
Watch out

Common mistakes

  • Opening 0.0.0.0/0 'for a port' and moving on (the eternal favorite).
  • Public-only SG config on instances while LB rules drift open.
  • WAF in CRS mode without testing → accidental SQLi/https false positives break prod.
  • Private endpoints billing surprises (hourly + data charges) undiscussed.
When things break

Debugging tips

  • Connection refused but SG allows → NACL stateless return-traffic rule missing or wrong order.
  • WAF blocking legit traffic → inspect managed-rule exceptions and the matched rule id in logs.
  • Private endpoint resolution to public IP in apps → DNS override missing (resolver config).
  • Egress anomalies → correlate flow logs with process-level (SSM agent) to find the exfil path.
Interviews

Interview checkpoint

Test yourself

Quick quiz

0/2
1

Which is stateless (rule order matters, return traffic must be explicit)?

2

Private endpoints buy you:

Go deeper

Official documentation

AWS WAF
docs
Azure Front Door WAF
docs
Cloud Armor
docs