Zero-trust network segmentation

expert

Scenario & brief

This estate is a security nightmare: no WAF, every tier in a public subnet, each security group trusting the whole VPC, public SSH on the hosts, and the database unencrypted. There's no perimeter and no segmentation.

Rebuild it as zero-trust:

a WAF at the edge; the ALB accepts only from the WAF,
web, app, and data tiers all private, each accepting only from the tier directly in front (web ← ALB, app ← web, data ← app),
no public SSH anywhere (use SSM),
the database not internet-reachable and encrypted at rest and in transit, and
NAT for private egress. Every control has to be right — this is the full boss fight.

4,000 rps peakp99 ≤ 200ms99.95% availdurability: criticalbudget $250/mo

WAF

Security

Enable WAF

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $250/mo · within budget

Metrics

Security posture11

Connectivity20

Requirements met14

Requirements

WAF enabled at the edge — disabled (need enabled)
ALB accepts only from the WAF — from internet (need only from waf)
Web tier private — public subnet (need private subnet)
App tier private — public subnet (need private subnet)
Data tier private — public subnet (need private subnet)
Web accepts only from the ALB — from vpc (need only from alb)
App accepts only from the web tier — from vpc (need only from web)
Data accepts only from the app tier — from vpc (need only from app)
No public SSH on web tier — public SSH open (need no public SSH)
No public SSH on app tier — public SSH open (need no public SSH)
Database not internet-reachable — isolated (need not internet-reachable)
Database encrypted at rest — plaintext (need encrypted at rest)
Database encrypted in transit — cleartext (need encrypted in transit)
Private subnets egress via NAT — no NAT (need private egress via NAT)

Advisor

WAF enabled at the edge: Turn this protection on.
ALB accepts only from the WAF: Restrict the security group to accept traffic only from waf.
Web tier private: Move it to the private subnet.
App tier private: Move it to the private subnet.
Data tier private: Move it to the private subnet.
Web accepts only from the ALB: Restrict the security group to accept traffic only from alb.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.