Defense in depth

expert

Scenario & brief

A compliance-critical system needs every security layer switched on at once — not just one fix, but defense in depth:

a WAF at the edge; the ALB accepts only from the WAF,
app, database, cache, and S3 all private / not internet-reachable,
no public SSH on the app tier,
encryption at rest on the database, cache, and S3, and TLS in transit on the ALB, app, and database, and
NAT for private egress. Miss any single layer and the volcano stays hot.

3,000 rps peakp99 ≤ 200ms99.95% availdurability: criticalbudget $250/mo

WAF

Security

Enable WAF

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $250/mo · within budget

Metrics

Security posture0

Connectivity25

Requirements met7

Requirements

WAF enabled at the edge — disabled (need enabled)
ALB accepts only from the WAF — from internet (need only from waf)
ALB serves TLS — cleartext (need encrypted in transit)
App servers private — public subnet (need private subnet)
No public SSH on app servers — public SSH open (need no public SSH)
App traffic encrypted in transit — cleartext (need encrypted in transit)
Database private — public subnet (need private subnet)
Database not internet-reachable — internet-reachable (need not internet-reachable)
Database encrypted at rest — plaintext (need encrypted at rest)
Database encrypted in transit — cleartext (need encrypted in transit)
Cache encrypted at rest — plaintext (need encrypted at rest)
S3 bucket not public — internet-reachable (need not internet-reachable)
S3 encrypted at rest — plaintext (need encrypted at rest)
Private subnets egress via NAT — no NAT (need private egress via NAT)

Advisor

WAF enabled at the edge: Turn this protection on.
ALB accepts only from the WAF: Restrict the security group to accept traffic only from waf.
ALB serves TLS: Require TLS/HTTPS in transit.
App servers private: Move it to the private subnet.
No public SSH on app servers: Close public SSH — use SSM Session Manager or a bastion host instead.
App traffic encrypted in transit: Require TLS/HTTPS in transit.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.