Infrastructure Security

Decision frame

Infrastructure security starts with a data-flow and trust-boundary diagram. Identify every entry point, identity transition, network hop, protocol, destination, return path, administrative path, and evidence source. Then apply controls at layers that can enforce the requirement. A secure design rarely depends on a single security group, firewall, or managed service.

Ask four questions for every path: Who initiates it? Where is identity evaluated? What network controls constrain it? What evidence proves the expected path and denied paths?

Objective map

Secure the edge

Choose the edge pattern from the protocol and requirement. Amazon CloudFront can reduce origin exposure and place caching, TLS, geographic, and AWS WAF controls near users. AWS WAF evaluates supported web requests; it is not a network firewall. AWS Shield provides DDoS protections, with Shield Advanced adding capabilities and response support for eligible resources. Route 53 controls authoritative DNS and health-based routing; Route 53 Resolver DNS Firewall addresses DNS queries in VPC resolution paths. API Gateway adds API authorization, throttling, validation, and stage controls. An Application Load Balancer understands HTTP characteristics, while a Network Load Balancer operates at the transport layer.

Protect the origin separately. Restrict an origin to the intended CloudFront or load-balancer path where supported, require appropriate TLS, remove unnecessary public addresses, and log both edge and origin behavior. A WAF rule should have an explicit threat or abuse case, scope, count-mode validation, false-positive review, version history, and rollback. Rate controls need a business-aware threshold and an understanding of shared client addresses.

Secure compute

Use workload roles instead of embedded credentials. EC2 instance profiles, ECS task roles, EKS workload identity mechanisms, and Lambda execution roles should be scoped to the workload rather than shared across an environment. Restrict access to instance metadata and prefer IMDSv2 for EC2. Keep secrets outside images and source control. Control who can pass roles as carefully as who can edit workload code.

Treat the artifact and deployment path as part of the runtime boundary. Build from approved base images, scan dependencies and images, sign or otherwise establish provenance where required, restrict registry mutation, separate build and deploy privileges, and retain deployment evidence. Amazon Inspector can identify supported vulnerability exposure, but findings still need ownership, prioritization, remediation, exceptions, and verification. Systems Manager can reduce inbound administration paths when configured with least privilege and appropriate logging.

Match isolation to the compute model. Security groups are stateful controls attached to supported resources; network ACLs are stateless subnet controls. Container boundaries do not automatically equal strong tenant boundaries. Lambda removes host administration but not identity, dependency, data, networking, or application risk. Managed services shift operational responsibility; they do not remove customer configuration and access decisions.

Secure networks and private access

Start with routes. A packet must have a valid forward and return path before a firewall rule matters. Draw route tables, transit attachments, gateway propagation, inspection insertion, NAT or egress paths, hybrid advertisements, and asymmetric-path risks. Use separate accounts and VPCs for strong ownership boundaries when the organization needs them; subnets alone are not an administrative boundary.

VPC peering is direct and non-transitive. Transit Gateway supplies hub-and-spoke routing at scale. Cloud WAN adds centrally managed global network policy. PrivateLink exposes a service through interface endpoints without general network reachability. Gateway endpoints provide private connectivity to supported regional services such as Amazon S3 and DynamoDB. Interface endpoints use AWS PrivateLink and need security groups, DNS decisions, endpoint policies where supported, and service-side authorization. Direct Connect provides dedicated connectivity but not automatic encryption; combine connectivity and cryptographic requirements deliberately. VPN provides encrypted tunnels and can serve as primary, backup, or interim connectivity depending on constraints.

AWS Network Firewall supports managed network inspection in designed traffic paths. Gateway Load Balancer can integrate virtual appliances. Centralized inspection can simplify governance but increases routing complexity and shared-fate impact. Distributed inspection can improve isolation but increases duplication and operations. Validate availability-zone behavior, symmetric routing, fail-open or fail-closed requirements, capacity, logging, and bypass paths.

Decision patterns

Scenario drill

A multi-account application must accept public HTTPS traffic, call a private service in another account, access Amazon S3 without internet egress, and send all outbound traffic through inspection.

1. Place CloudFront and AWS WAF at the supported public edge and restrict the load-balancer origin.
2. Publish the private service through PrivateLink rather than opening broad VPC routing.
3. Use an S3 gateway endpoint with bucket and endpoint policy controls.
4. Design transit and inspection routes with explicit forward and return paths across Availability Zones.
5. Use scoped workload roles; do not treat network reachability as authorization.
6. Validate allowed paths, bypass attempts, DNS behavior, failover, logs, and a controlled inspection failure.

Common traps

• Choosing a firewall before drawing routes and return paths.
• Treating a private IP address as proof of authorized access.
• Assuming Direct Connect encrypts traffic automatically.
• Using a shared instance role, node role, or task role for unrelated workloads.
• Adding a VPC endpoint but ignoring endpoint, identity, resource, and key policies.
• Centralizing inspection without analyzing availability-zone failure and asymmetric routing.
• Believing a managed compute service removes application, dependency, or IAM responsibility.

Self-check

1. Explain when WAF, Network Firewall, a security group, and a network ACL act.
2. Compare VPC peering, Transit Gateway, PrivateLink, and Cloud WAN for one scenario.
3. Trace a request through DNS, edge, load balancer, workload, private service, and return path.
4. Name the controls that prevent origin bypass.
5. Explain why network connectivity and service authorization must be evaluated separately.

Primary references

• AWS SCS-C03 exam guide
• AWS VPC security best practices
• AWS PrivateLink concepts
• AWS Network Firewall architectures