Skip to content
sec/atlas
back to the map
technique
stage: proteger
4 min read

Network - segmentation and zero-trust

The cloud network is programmable: VPCs, subnets, security groups and application firewalls draw the perimeter application by application, instead of waiting for the datacenter edge.

AWS VPCCloudflarePalo Alto NetworksCalico

What it is

In the cloud, a network is not cabling: it is configuration. VPCs, subnets, route tables, security groups and network ACLs are objects you create and version like any other resource. The topology becomes code, and the becomes a file you can read in a PR.

This changes the game. Instead of one big firewall at the entrance, control spreads out: each subnet decides who talks to it, each instance defines who reaches it, and traffic leaving the cluster goes through a gateway that inspects and logs.

VPC and subnets: public versus private

Inside a , the classic design has two subnet layers. The public one has a direct route to an Internet Gateway and hosts things that need a reachable IP (NAT gateway, bastion, public load balancer). The private one has no outbound route to the internet, only receives internal traffic and, when it needs to go out, talks to the NAT.

The most common mistake is putting the database in the public subnet out of laziness about configuring routes. The result is a Postgres with an elastic IP answering on 5432 to the world, waiting for the first scanner to pass by.

Security groups: stateful, at the ENI level

A is the first line in the cloud. It is stateful: the response to an authorized request comes back without needing an inbound rule. Attached to the network interface (ENI), it works as a per-instance firewall, and several instances can share the same group when they play the same role.

The classic anti-pattern is opening 0.0.0.0/0 on administration ports. It appears in every postmortem:

security-group.json - permissive (DO NOT use)json
{
  "GroupName": "web-sg",
  "Description": "Open to the internet (DO NOT use in prod)",
  "IpPermissions": [
    {
      "IpProtocol": "tcp",
      "FromPort": 22,
      "ToPort": 22,
      "IpRanges": [ { "CidrIp": "0.0.0.0/0", "Description": "SSH open" } ]
    },
    {
      "IpProtocol": "tcp",
      "FromPort": 3389,
      "ToPort": 3389,
      "IpRanges": [ { "CidrIp": "0.0.0.0/0", "Description": "RDP open" } ]
    }
  ]
}

The rule that should exist

Close the administration ports to the internet and force entry through a bastion or Systems Manager Session Manager. For what needs human access, restrict by corporate IP or by VPN:

security-group.json - fixedjson
{
  "GroupName": "web-sg",
  "Description": "Administrative access via corporate bastion",
  "IpPermissions": [
    {
      "IpProtocol": "tcp",
      "FromPort": 22,
      "ToPort": 22,
      "IpRanges": [ { "CidrIp": "203.0.113.0/24", "Description": "corporate VPN range" } ]
    },
    {
      "IpProtocol": "tcp",
      "FromPort": 443,
      "ToPort": 443,
      "IpRanges": [ { "CidrIp": "0.0.0.0/0", "Description": "public HTTPS" } ]
    }
  ]
}

Network ACLs and VPC Flow Logs

A NACL is the stateless complement at the subnet level. It acts before the security group and serves for broad rules (blocking an entire range known to be malicious, for example). It is stateless, so the response needs a specific inbound rule, and it rarely needs to be touched once the topology is mature.

VPC Flow Logs captures all accepted or rejected traffic on the VPC's ENIs and dumps it into CloudWatch or S3. Without flow logs, you are investigating an incident in the dark. With a minimal path: default block + active logging + learned endpoints, and the security team can answer what came in, through where and when.

Microsegmentation and zero-trust

Security groups solve the perimeter per workload. As the environment grows, the key is to start talking about workload identity instead of IP: a policy that says 'service A talks to service B on port 8080 via mTLS' is more durable than opening a /24 between subnets because someone once asked for access.

Tools like Calico, Cilium or VPC lattice abstract the IP and let the policy travel with the workload. Even if the pod moves to another node, the rule still applies.

Where it fits in day-to-day work

  • initial VPC design: topology of public and private subnets, NAT, routes and bastion defined as code in Terraform/Pulumi
  • application deploy: the manifest declares the security group, and the pipeline creates/reconciles it with the existing VPC
  • incident response: VPC flow logs + CloudTrail show the origin of the attack in minutes, not hours
  • continuous auditing: a detector for SGs with 0.0.0.0/0 on sensitive ports breaks the build before the merge

Strengths

  • network as code: reviewing topology in a PR catches subnet errors before traffic does
  • native logs: VPC Flow Logs records source, destination, port and decision with no agent on the host
  • per-workload isolation: each service has the smallest possible network path

Limitations

  • topology complexity: 5 accounts, 12 subnets and 200 SGs need visualization and lint tooling
  • SGs do not inspect payload: the port may be right and the request content may still be an attack
  • real zero-trust depends on workload identity (mTLS, SPIFFE), which is still early in many stacks
Attack surfaceEverything exposed to untrusted input: endpoints, forms, dependencies, ports, pipelines. A minimal surface is a defense strategy.see in glossary →VPCvirtual private cloudA logically isolated private network inside the public cloud: you choose the IP range, split it into public and private subnets, and control traffic with route tables and NAT. The VPC is your virtual datacenter; everything running inside it talks as if it were in the same rack.see in glossary →Security groupsecurity groupA stateful list of rules attached to an instance or network interface in the cloud: who can come in on which port, from which source. It works as a host firewall at the cloud level, and it fails open by default: if you forget to close a port, it stays open to 0.0.0.0/0.see in glossary →

connections on the map

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Unlocks

test what you learned

Loading questions…