Stop 09 · Cloud SecurityTopics · 4/9

Cloud Network Security (VPCs, Security Groups)

In short

Cloud networking brings your Phase 2 skills to a new place. A VPC walls off your resources, and security groups decide exactly which traffic may come and go.

Applying Phase 2's networking fundamentals in a cloud-specific context — VPCs isolate your resources, and security groups/network ACLs control traffic in and out at a granular level.

The blob gatekeeper checks a visitor at a gate on a fenced private lane.

Think of it like this

A private lane with a gatekeeper

A VPC is like a private lane inside a big city, fenced off from the public road. Each house on the lane has a gatekeeper who allows only expected visitors in. Security groups are those gatekeepers, deciding what traffic reaches each resource.

Watch it happen

How traffic reaches a server

Internet

VPC edge

Subnet

Sec group

Server

1/5A request arrives from the public internet aimed at your application.

The big ideas

What you need to know

VPC is your private space

A virtual private cloud isolates your resources into your own network, separate from everyone else's.

Public and private subnets

Put web servers in public subnets and databases in private ones with no direct internet route.

Security groups allow

They are default deny allow lists. Open only the exact ports and sources each resource truly needs.

Least exposure

Never open a database port to the whole internet. Allow only your app servers to reach it.

See it in code

Walk through the code

text

1# A security group rule set for a web server (concept)2# Inbound: allow only what the app needs3ALLOW tcp 443 from 0.0.0.0/0      # HTTPS from anyone4ALLOW tcp 22  from 203.0.113.10/32 # SSH only from office IP5DENY  all other inbound            # everything else blocked6 7# The database group allows 5432 only from the web group, never the internet8ALLOW tcp 5432 from sg-web

1/3HTTPS is open to all because the public needs the website.

Security groups are default deny. You list what to allow, and the database is reachable only from the app, not the open internet.

Save yourself the pain

Common mistakes

Oops

Opening SSH or database ports to 0.0.0.0/0 for convenience.

Do this instead

Restrict admin and database ports to specific sources. Open management ports are scanned and attacked within minutes.

Oops

Putting databases in a public subnet.

Do this instead

Keep data stores in private subnets with no internet route, reachable only from your app tier.

Your mission

Design a two tier network

~40 min

Quick check

Where should a database usually sit in a well designed VPC?

Go deeper

1Design a basic VPC with public and private subnets for a hypothetical application.
2Configure security groups to allow only necessary traffic to each resource.
3Learn why sensitive resources (like databases) belong in private subnets, not public-facing ones.