Secure workloads and applications

Layer your defenses: segment the VPC into public and private subnets, filter traffic with security groups and network ACLs, keep service traffic private with endpoints, protect the edge with AWS WAF and AWS Shield, and keep secrets out of code.

VPC security components

• Security groups: Stateful firewalls on network interfaces. Allow rules only; return traffic is allowed automatically. A rule can reference another security group instead of IP ranges.
• Network ACLs: Stateless filters at the subnet boundary. Allow and deny rules, evaluated in number order. Because they are stateless, return traffic (ephemeral ports) must be allowed explicitly.
• Route tables: Decide where traffic from a subnet goes. A subnet is public only because its route table sends 0.0.0.0/0 to an internet gateway.
• NAT gateway: Lets resources in private subnets start outbound IPv4 connections to the internet while blocking inbound connections. Zonal NAT gateways sit in a public subnet in one AZ; since November 2025 a regional mode spans AZs automatically.
• Egress-only internet gateway: The IPv6 equivalent of NAT: outbound-only IPv6 access from the VPC.
• Use a network ACL deny rule to block a specific IP range quickly; security groups can't deny.

Network segmentation

• Classic three-tier layout: load balancers in public subnets, application servers in private subnets, databases in private subnets with no route to the internet at all.
• Chain security groups: the database group allows its port only from the application group, and the application group allows traffic only from the load balancer group.
• Reach private instances with AWS Systems Manager Session Manager instead of a bastion host: no inbound ports, no SSH keys to manage, and every session can be logged.
• AWS Network Firewall: Managed stateful firewall and intrusion prevention for a VPC, including domain-name filtering of outbound traffic.
• AWS Firewall Manager: Applies WAF rules, Shield Advanced protections, security group policies, and Network Firewall policies across every account in an organization.

Private access to AWS services

• Gateway endpoints: For Amazon S3 and DynamoDB only. A route table entry, no hourly charge, and traffic never leaves the AWS network.
• Interface endpoints (AWS PrivateLink): An elastic network interface with a private IP in your subnet for many AWS services and partner services. Charged per hour and per GB.
• Endpoint policies: Limit what can be done through an endpoint. Pair with a bucket policy condition (aws:SourceVpce) so a bucket accepts requests only through your endpoint.
• Endpoints let instances in private subnets reach AWS service endpoints without a NAT gateway or internet gateway.

Protecting the application edge

• AWS WAF: Layer 7 web application firewall for CloudFront, Application Load Balancer, API Gateway, AWS AppSync, and Cognito user pools. Managed rule groups block SQL injection and cross-site scripting; rate-based rules slow request floods; geo match blocks countries.
• AWS Shield Standard: Automatic protection against common network and transport layer DDoS attacks for all customers at no extra charge.
• AWS Shield Advanced: Paid protection with enhanced detection, access to the Shield Response Team, and cost protection for scaling charges caused by an attack.
• Putting CloudFront in front of an origin absorbs attacks at the edge and lets you lock the origin so it only accepts traffic from CloudFront (origin access control for S3).

Credentials and user identity for applications

• AWS Secrets Manager: Stores database passwords, API keys, and other secrets, encrypted with KMS, with built-in automatic rotation (native for Amazon RDS and other databases).
• Systems Manager Parameter Store: Stores configuration values and SecureString parameters encrypted with KMS. Low cost, but no built-in rotation.
• Never put access keys or passwords in code, AMIs, or environment files in a repository. Code on AWS gets credentials from its role.
• Amazon Cognito user pools: A user directory for your app's customers: sign-up, sign-in, MFA, social and SAML sign-in, and JWT tokens your API can verify.
• Amazon Cognito identity pools: Exchange a sign-in token for temporary, limited AWS credentials so a mobile or web app can call AWS services directly.

Threat detection and security services

• Amazon GuardDuty: Continuous threat detection that analyzes CloudTrail events, VPC Flow Logs, DNS logs, and more, for example an instance talking to a known command-and-control server.
• Amazon Macie: Discovers and reports sensitive data such as personal information in S3 buckets.
• Amazon Inspector: Scans EC2 instances, container images in ECR, and Lambda functions for software vulnerabilities and unintended network exposure.
• Amazon Detective: Builds a graph of activity to help you investigate the root cause of a security finding.
• AWS Security Hub: Collects findings from these services in one place and checks resources against security standards.
• External threats to plan for include DDoS floods (Shield, CloudFront, Auto Scaling) and injection attacks such as SQL injection (AWS WAF, input validation).

Securing connections to and from AWS

• AWS Site-to-Site VPN: Encrypted IPsec tunnels over the internet between your network and a VPC or Transit Gateway. Quick to set up, but performance follows the internet path.
• AWS Client VPN: Managed VPN for individual users' devices.
• AWS Direct Connect: A private, dedicated connection from your network to AWS with consistent performance. It is not encrypted by default: add MACsec on supported connections or run an IPsec VPN over it when traffic must be encrypted.