Network security

Network Security Patterns

AWS VPC Security Groups

# Terraform — minimal security groups
resource "aws_security_group" "alb" {
  name   = "alb-sg"
  vpc_id = var.vpc_id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]  # Redirect to HTTPS
  }
  egress {
    from_port       = 8080
    to_port         = 8080
    protocol        = "tcp"
    security_groups = [aws_security_group.app.id]
  }
}

resource "aws_security_group" "app" {
  name   = "app-sg"
  vpc_id = var.vpc_id

  ingress {
    from_port       = 8080
    to_port         = 8080
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]  # Only from ALB
  }
  egress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.db.id]
  }
}

resource "aws_security_group" "db" {
  name   = "db-sg"
  vpc_id = var.vpc_id

  ingress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.app.id]  # Only from app tier
  }
  # NO egress to internet
}

Network ACLs (Subnet-level)

resource "aws_network_acl" "private" {
  vpc_id     = var.vpc_id
  subnet_ids = var.private_subnet_ids

  # Allow established connections back
  ingress {
    rule_no    = 100
    protocol   = "tcp"
    action     = "allow"
    cidr_block = "10.0.0.0/8"
    from_port  = 1024
    to_port    = 65535
  }

  # Block all other inbound
  ingress {
    rule_no    = 32766
    protocol   = -1
    action     = "deny"
    cidr_block = "0.0.0.0/0"
    from_port  = 0
    to_port    = 0
  }
}

AWS WAF Rules

resource "aws_wafv2_web_acl" "main" {
  name  = "production-waf"
  scope = "REGIONAL"

  default_action { allow {} }

  # AWS Managed Rules
  rule {
    name     = "AWSManagedRulesCommonRuleSet"
    priority = 1
    override_action { none {} }
    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "CommonRuleSet"
      sampled_requests_enabled   = true
    }
  }

  # Rate limiting
  rule {
    name     = "RateLimitRule"
    priority = 2
    action { block {} }
    statement {
      rate_based_statement {
        limit              = 2000  # requests per 5 minutes per IP
        aggregate_key_type = "IP"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "RateLimit"
      sampled_requests_enabled   = true
    }
  }
}

DDoS Protection

# AWS Shield Standard — free, automatic L3/L4 protection
# AWS Shield Advanced — paid, L7 protection + 24/7 DRT

# Cloudflare DDoS protection
# - Automatic detection and mitigation
# - Rate limiting rules
# - Challenge pages for suspicious traffic

# nginx rate limiting + connection limits
limit_req_zone $binary_remote_addr zone=req_limit:10m rate=100r/m;
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;

server {
    limit_req zone=req_limit burst=200 nodelay;
    limit_conn conn_limit 20;          # Max 20 concurrent connections per IP
    limit_req_status 429;

    # Slow down brute force
    client_body_timeout 10s;
    client_header_timeout 10s;
    keepalive_timeout 65s;
    send_timeout 10s;
}

VPN & Bastion Patterns

# Tailscale (modern VPN, zero-config mTLS)
curl -fsSL https://tailscale.com/install.sh | sh
tailscale up --advertise-routes=10.0.0.0/8

# SSH via AWS Systems Manager (no open port 22)
aws ssm start-session --target i-0123456789abcdef0

# Bastion with time-limited access
resource "aws_security_group_rule" "bastion_ssh" {
  type        = "ingress"
  from_port   = 22
  to_port     = 22
  protocol    = "tcp"
  cidr_blocks = ["${var.office_ip}/32"]   # Only office IP
  security_group_id = aws_security_group.bastion.id
}

Network Segmentation Checklist

VPC Design:
  ✓ Public subnets: only ALB/NAT gateway
  ✓ Private subnets: application servers
  ✓ Isolated subnets: databases (no route to internet)
  ✓ VPC endpoints for AWS services (S3, DynamoDB)

Firewall Rules:
  ✓ Default deny all inbound/outbound
  ✓ Explicitly allow only required ports/protocols
  ✓ Security groups scoped to other security groups (not CIDRs) where possible
  ✓ No 0.0.0.0/0 on ports other than 80/443

Remote Access:
  ✓ No public SSH/RDP — use SSM/IAP
  ✓ VPN required for internal services
  ✓ MFA on VPN/bastion
  ✓ Session recording for privileged access

Monitoring:
  ✓ VPC Flow Logs enabled, shipped to SIEM
  ✓ Alert on unexpected inbound accepted traffic
  ✓ Alert on outbound to unusual ports/destinations