Network security

Key points

• Public subnet: has a direct route to an internet gateway.
• Private subnet: no direct route to an internet gateway. It reaches the internet only through a NAT device.
• Isolated subnet: no route outside the VPC at all. A VPN-only subnet routes to a Site-to-Site VPN through a virtual private gateway.
• Zonal NAT gateway: lets private resources start outbound connections, never inbound. It sits in a public subnet with an Elastic IP, so create one per AZ. 5 Gbps that scales to 100 Gbps.
• Regional NAT gateway: expands across AZs automatically and needs no public subnet, but does not support private NAT.
• IPv6: an egress-only internet gateway gives outbound-only IPv6 access.

Key points

• Security groups: allow rules only, all rules evaluated, return traffic allowed automatically. Rules can reference other security groups, ideal for tier-to-tier access.
• Outbound default: a security group comes with a default outbound rule that allows all traffic.
• Network ACLs: allow and deny rules numbered 1 to 32766, evaluated from the lowest number and stopped at the first match.
• Stateless: return traffic must be allowed explicitly, usually the ephemeral ports 1024-65535.
• Defaults: the default NACL allows all traffic. A new custom NACL denies everything through its final * rule until you add rules.
• Block an IP: only a NACL can deny a specific address range, because security groups have no deny rules.

Key points

• Gateway endpoint: only for S3 and DynamoDB. A route table entry that targets the service prefix list, with no additional charge.
• Interface endpoint: AWS PrivateLink network interfaces with private IPs in your subnets, protected by security groups and billed.
• Reachability: only interface endpoints serve on premises over Direct Connect or VPN, and other Regions through peering or Transit Gateway.
• Endpoint policy: a resource policy on the endpoint that limits the principals and resources reachable through it. The default allows everything.
• Bucket lock-down: an S3 bucket policy with the aws:sourceVpce condition denies requests that do not come through your endpoint.
• Gateway Load Balancer endpoint: sends traffic to a fleet of inspection appliances.

Key points

• Protected resources: CloudFront distributions, Application Load Balancers, API Gateway REST APIs, AppSync GraphQL APIs, Cognito user pools, App Runner services, Verified Access instances and Amplify.
• Threat vectors: SQL injection and cross-site scripting (XSS) match statements, plus AWS Managed Rules rule groups.
• Rate-based rules: count requests per aggregation key and rate limit those that arrive too fast, a defense against HTTP floods.
• Geo and IP: geographic match and IP set match statements allow or block by country or address range.
• Responses: a matched request can be blocked with HTTP 403 or receive a custom response.

Key points

• Shield Standard: automatic and free, it defends against the most common network and transport layer (3 and 4) attacks such as SYN floods and UDP reflection.
• Shield Advanced: protects Elastic IPs, Elastic Load Balancing, CloudFront, Global Accelerator and Route 53, and adds layer 7 mitigation through AWS WAF.
• Shield Response Team: 24/7 access for customers on Business or Enterprise support plans.
• Cost protection: service credits for scaling charges caused by a DDoS attack.
• Pricing: $3,000 per month with a 1-year commitment, billed per payer account, including AWS WAF usage for protected resources up to a limit.
• Health-based detection: Route 53 health checks associated with protected resources detect attacks sooner.

Key points

• Rules: stateless and stateful rule groups, Suricata compatible IPS rules, 5-tuple rules and domain filtering.
• Deployment: firewall endpoints in a dedicated firewall subnet in each AZ, with route tables steering traffic through them.
• Use cases: allow egress only to approved domains, deep packet inspection, north-south and east-west inspection.
• TLS inspection: decrypts and re-encrypts traffic with a certificate from ACM.
• At scale: Firewall Manager deploys firewalls across accounts, and firewall policies can be shared through AWS RAM.

Key points

• Policy types: AWS WAF, Shield Advanced, VPC security groups, network ACLs, Network Firewall and Route 53 Resolver DNS Firewall.
• Automatic coverage: new in-scope accounts and resources receive the protection as soon as they appear.
• Scope: all resources of a type, resources with specific tags, or chosen accounts.
• Requirements: works across an AWS Organizations organization. Charges come from the underlying services, such as AWS WAF and AWS Config.
• Administrator: a Firewall Manager administrator account, which can be a delegated member account.

Key points

• Site-to-Site VPN: IPsec tunnels to a virtual private gateway or a transit gateway. Each connection has 2 tunnels for high availability.
• Tunnel bandwidth: 1.25 Gbps per tunnel, or up to 5 Gbps with large bandwidth tunnels on Transit Gateway or Cloud WAN.
• Direct Connect: dedicated private connectivity, but traffic in transit is not encrypted by default.
• MACsec: layer 2 encryption between your router and the Direct Connect location, on 10, 100 and 400 Gbps dedicated connections.
• VPN over Direct Connect: an IPsec VPN across the Direct Connect link adds encryption while keeping consistent network performance.