Cloud Networking & Security Essentials

Cloud Networking Fundamentals

1. Virtual Private Cloud (VPC) Architecture

What is a VPC?

A Virtual Private Cloud (VPC) is an isolated virtual network dedicated to your cloud account. It's logically isolated from other virtual networks and provides control over IP addressing, routing, security, and network configuration.

Core VPC Components:

yaml

CIDR Blocks:
  - Primary CIDR: The main IP range for your VPC (e.g., 10.0.0.0/16)
  - Secondary CIDRs: Additional IP ranges for expansion

Subnets:
  - Public Subnets: Routes to Internet Gateway
  - Private Subnets: No direct internet access
  - Database Subnets: Isolated for databases

Route Tables:
  - Define how traffic is routed within the VPC

Internet Gateway (IGW):
  - Provides internet access for public subnets

NAT Gateway:
  - Provides outbound internet for private subnets

2. VPC Design Patterns

Single VPC Pattern (Simple):

text

VPC: 10.0.0.0/16
├── Public Subnet: 10.0.1.0/24 (Web tier)
├── Private Subnet: 10.0.2.0/24 (App tier)
└── Database Subnet: 10.0.3.0/24 (DB tier)

Multi-VPC Pattern (Enterprise):

text

Network VPC (10.0.0.0/16)
├── Shared services (DNS, monitoring)
└── Transit Gateway attachment

Development VPC (10.1.0.0/16)
├── Dev workloads
└── Staging environments

Production VPC (10.2.0.0/16)
├── Production workloads
└── DR environment

VPC Implementation Deep Dive

1. AWS VPC Configuration

Terraform VPC Module:

hcl

# modules/vpc/main.tf
resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr
  enable_dns_hostnames = true
  enable_dns_support   = true
  tags = {
    Name = "${var.environment}-vpc"
  }
}

# Internet Gateway
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags = {
    Name = "${var.environment}-igw"
  }
}

# Public Subnets
resource "aws_subnet" "public" {
  count                   = length(var.availability_zones)
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(var.vpc_cidr, 8, count.index)
  availability_zone       = var.availability_zones[count.index]
  map_public_ip_on_launch = true
  
  tags = {
    Name = "${var.environment}-public-${count.index}"
    Type = "public"
  }
}

# Private Subnets
resource "aws_subnet" "private" {
  count             = length(var.availability_zones)
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 8, count.index + length(var.availability_zones))
  availability_zone = var.availability_zones[count.index]
  
  tags = {
    Name = "${var.environment}-private-${count.index}"
    Type = "private"
  }
}

# NAT Gateway for private subnets
resource "aws_eip" "nat" {
  count = length(var.availability_zones)
  domain = "vpc"
}

resource "aws_nat_gateway" "main" {
  count         = length(var.availability_zones)
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
  
  tags = {
    Name = "${var.environment}-nat-${count.index}"
  }
}

# Route Tables
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
  
  tags = {
    Name = "${var.environment}-public-rt"
  }
}

resource "aws_route_table" "private" {
  count  = length(var.availability_zones)
  vpc_id = aws_vpc.main.id
  
  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.main[count.index].id
  }
  
  tags = {
    Name = "${var.environment}-private-rt-${count.index}"
  }
}

2. Multi-Cloud VPC Equivalents

AWS vs Azure vs GCP Networking:

yaml

# Virtual Network Concepts
AWS:
  VPC: Virtual Private Cloud
  Subnet: Subnet within VPC
  Route Table: Route table for subnets
  IGW: Internet Gateway
  NAT: NAT Gateway

Azure:
  VNet: Virtual Network
  Subnet: Subnet within VNet
  Route Table: User Defined Routes (UDR)
  IGW: Internet-facing Load Balancer
  NAT: NAT Gateway or Azure Firewall

GCP:
  VPC: Virtual Private Cloud
  Subnet: Regional subnet
  Route Table: Routes (automatically created)
  IGW: Internet access via default routes
  NAT: Cloud NAT

Azure Virtual Network Example:

bicep

// Azure Bicep template
resource vnet 'Microsoft.Network/virtualNetworks@2021-05-01' = {
  name: '${environment}-vnet'
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: [
        '10.0.0.0/16'
      ]
    }
    subnets: [
      {
        name: 'public-subnet'
        properties: {
          addressPrefix: '10.0.1.0/24'
        }
      }
      {
        name: 'private-subnet'
        properties: {
          addressPrefix: '10.0.2.0/24'
        }
      }
    ]
  }
}

Security Groups & Network ACLs

1. Security Groups (Stateful Firewalls)

Security Group Concepts:

yaml

Stateful: Return traffic is automatically allowed
Instance Level: Applied to individual instances
Rules: Allow rules only (default deny all)
Evaluation: All rules are evaluated

Terraform Security Group Configuration:

hcl

# Web Security Group
resource "aws_security_group" "web" {
  name_prefix = "${var.environment}-web-"
  vpc_id      = aws_vpc.main.id
  
  tags = {
    Name = "${var.environment}-web-sg"
  }
}

resource "aws_security_group_rule" "web_ingress_http" {
  type              = "ingress"
  from_port         = 80
  to_port           = 80
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.web.id
}

resource "aws_security_group_rule" "web_ingress_https" {
  type              = "ingress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.web.id
}

resource "aws_security_group_rule" "web_egress_all" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.web.id
}

# Application Security Group
resource "aws_security_group" "app" {
  name_prefix = "${var.environment}-app-"
  vpc_id      = aws_vpc.main.id
  
  tags = {
    Name = "${var.environment}-app-sg"
  }
}

resource "aws_security_group_rule" "app_ingress_from_web" {
  type                     = "ingress"
  from_port                = 8080
  to_port                  = 8080
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.web.id
  security_group_id        = aws_security_group.app.id
}

2. Network ACLs (Stateless Firewalls)

NACL Concepts:

yaml

Stateless: Return traffic must be explicitly allowed
Subnet Level: Applied to entire subnets
Rules: Both allow and deny rules
Evaluation: Rules evaluated in order (lowest number first)

NACL Configuration:

hcl

# Public NACL
resource "aws_network_acl" "public" {
  vpc_id     = aws_vpc.main.id
  subnet_ids = aws_subnet.public[*].id
  
  tags = {
    Name = "${var.environment}-public-nacl"
  }
}

# NACL Rules (evaluate in order)
resource "aws_network_acl_rule" "public_ingress_http" {
  network_acl_id = aws_network_acl.public.id
  rule_number    = 100
  egress         = false
  protocol       = "tcp"
  rule_action    = "allow"
  cidr_block     = "0.0.0.0/0"
  from_port      = 80
  to_port        = 80
}

resource "aws_network_acl_rule" "public_ingress_https" {
  network_acl_id = aws_network_acl.public.id
  rule_number    = 110
  egress         = false
  protocol       = "tcp"
  rule_action    = "allow"
  cidr_block     = "0.0.0.0/0"
  from_port      = 443
  to_port        = 443
}

resource "aws_network_acl_rule" "public_ingress_ephemeral" {
  network_acl_id = aws_network_acl.public.id
  rule_number    = 120
  egress         = false
  protocol       = "tcp"
  rule_action    = "allow"
  cidr_block     = "0.0.0.0/0"
  from_port      = 1024
  to_port        = 65535
}

Load Balancers & Traffic Management

1. Load Balancer Types

AWS Load Balancer Comparison:

yaml

Application Load Balancer (ALB):
  - Layer 7 (HTTP/HTTPS)
  - Content-based routing
  - WebSocket support
  - Best for web applications

Network Load Balancer (NLB):
  - Layer 4 (TCP/UDP)
  - Ultra-high performance
  - Static IP addresses
  - Best for extreme performance

Classic Load Balancer (CLB):
  - Legacy (avoid for new projects)
  - Both Layer 4 and Layer 7

ALB Configuration with Terraform:

hcl

# Application Load Balancer
resource "aws_lb" "web" {
  name               = "${var.environment}-web-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.web.id]
  subnets            = aws_subnet.public[*].id
  
  enable_deletion_protection = false
  
  tags = {
    Name = "${var.environment}-web-alb"
  }
}

# Target Group
resource "aws_lb_target_group" "web" {
  name     = "${var.environment}-web-tg"
  port     = 80
  protocol = "HTTP"
  vpc_id   = aws_vpc.main.id
  
  health_check {
    enabled             = true
    interval            = 30
    path                = "/health"
    port                = "traffic-port"
    healthy_threshold   = 3
    unhealthy_threshold = 3
    timeout             = 5
    protocol            = "HTTP"
    matcher             = "200"
  }
  
  tags = {
    Name = "${var.environment}-web-tg"
  }
}

# Listener
resource "aws_lb_listener" "web_http" {
  load_balancer_arn = aws_lb.web.arn
  port              = 80
  protocol          = "HTTP"
  
  default_action {
    type = "redirect"
    
    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

resource "aws_lb_listener" "web_https" {
  load_balancer_arn = aws_lb.web.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-2016-08"
  certificate_arn   = aws_acm_certificate.web.arn
  
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.web.arn
  }
}

2. Advanced Routing Patterns

Path-Based Routing:

hcl

# API-specific target group
resource "aws_lb_target_group" "api" {
  name     = "${var.environment}-api-tg"
  port     = 8080
  protocol = "HTTP"
  vpc_id   = aws_vpc.main.id
}

# Path-based routing rule
resource "aws_lb_listener_rule" "api" {
  listener_arn = aws_lb_listener.web_https.arn
  priority     = 100
  
  action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.api.arn
  }
  
  condition {
    path_pattern {
      values = ["/api/*"]
    }
  }
}

Zero Trust Security Principles

1. Core Zero Trust Concepts

Traditional vs Zero Trust:

text

Traditional Security (Perimeter-based):
  Trust inside network → "Trust but verify"
  Hard external shell, soft internal core

Zero Trust Architecture:
  Never trust, always verify → "Verify explicitly"
  Assume breach, enforce least privilege

Zero Trust Pillars:

yaml

Identity:
  - Multi-factor authentication (MFA)
  - Strong authentication
  - Identity-aware proxies

Devices:
  - Device health validation
  - Compliance checking
  - Mobile device management

Networks:
  - Micro-segmentation
  - Encrypted traffic
  - Least privilege access

Applications:
  - Application-level controls
  - API security
  - Data protection

Data:
  - Classification
  - Encryption
  - Rights management

2. Implementing Zero Trust in Cloud

Network Micro-segmentation:

hcl

# Micro-segmented security groups
resource "aws_security_group" "frontend" {
  name_prefix = "frontend-"
  vpc_id      = aws_vpc.main.id
  
  # Only allow HTTP/HTTPS from ALB
  ingress {
    from_port       = 80
    to_port         = 80
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]
  }
}

resource "aws_security_group" "backend" {
  name_prefix = "backend-"
  vpc_id      = aws_vpc.main.id
  
  # Only allow from frontend on specific port
  ingress {
    from_port       = 9000
    to_port         = 9000
    protocol        = "tcp"
    security_groups = [aws_security_group.frontend.id]
  }
}

resource "aws_security_group" "database" {
  name_prefix = "database-"
  vpc_id      = aws_vpc.main.id
  
  # Only allow from backend on database port
  ingress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.backend.id]
  }
}

Identity-Aware Proxy Pattern:

hcl

# AWS WAF for application protection
resource "aws_wafv2_web_acl" "main" {
  name  = "${var.environment}-web-acl"
  scope = "REGIONAL"
  
  default_action {
    allow {}
  }
  
  rule {
    name     = "AWSManagedRulesCommonRuleSet"
    priority = 1
    
    override_action {
      none {}
    }
    
    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }
    
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "AWSManagedRulesCommonRuleSet"
      sampled_requests_enabled   = true
    }
  }
  
  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "${var.environment}-web-acl"
    sampled_requests_enabled   = true
  }
}

Secrets Management

1. AWS Secrets Manager

Secrets Manager Basics:

yaml

Features:
  - Automatic rotation
  - Fine-grained access control
  - Cross-account access
  - Encryption with KMS

Use Cases:
  - Database credentials
  - API keys
  - Application secrets
  - SSL/TLS certificates

Terraform Configuration:

hcl

# KMS Key for encryption
resource "aws_kms_key" "secrets" {
  description             = "KMS key for secrets encryption"
  deletion_window_in_days = 7
  enable_key_rotation     = true
  
  tags = {
    Name = "${var.environment}-secrets-key"
  }
}

# Database secret
resource "aws_secretsmanager_secret" "database" {
  name = "${var.environment}/database/credentials"
  kms_key_id = aws_kms_key.secrets.key_id
  
  tags = {
    Environment = var.environment
    Type        = "database"
  }
}

# Secret version with initial value
resource "aws_secretsmanager_secret_version" "database" {
  secret_id = aws_secretsmanager_secret.database.id
  secret_string = jsonencode({
    username = "app_user"
    password = random_password.database.result
    engine   = "postgres"
    host     = aws_db_instance.main.address
    port     = 5432
    dbname   = "application"
  })
}

# IAM policy for application access
resource "aws_iam_policy" "secrets_access" {
  name_prefix = "secrets-access-"
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "secretsmanager:GetSecretValue",
          "secretsmanager:DescribeSecret"
        ]
        Resource = aws_secretsmanager_secret.database.arn
      },
      {
        Effect = "Allow"
        Action = [
          "kms:Decrypt"
        ]
        Resource = aws_kms_key.secrets.arn
      }
    ]
  })
}

Rotation Configuration:

hcl

# Rotation Lambda function (simplified)
resource "aws_lambda_function" "secret_rotation" {
  filename      = "rotation.zip"
  function_name = "${var.environment}-secret-rotation"
  role          = aws_iam_role.rotation_lambda.arn
  handler       = "index.handler"
  runtime       = "python3.8"
}

resource "aws_secretsmanager_secret_rotation" "database" {
  secret_id           = aws_secretsmanager_secret.database.id
  rotation_lambda_arn = aws_lambda_function.secret_rotation.arn
  
  rotation_rules {
    automatically_after_days = 30
  }
}

2. HashiCorp Vault

Vault Architecture:

text

Vault Server:
  - API server
  - Storage backend (consul, etcd, S3)
  - Seal/unlock mechanism

Storage Backend:
  - Persistent storage for encrypted data

Secrets Engines:
  - KV (key-value)
  - AWS, Azure, GCP
  - Database
  - PKI

Authentication Methods:
  - AppRole, Kubernetes, AWS IAM
  - Tokens, Username/Password

Terraform Vault Configuration:

hcl

# Vault provider configuration
terraform {
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "~> 3.0"
    }
  }
}

provider "vault" {
  address = "https://vault.example.com:8200"
  token   = var.vault_token
}

# KV secrets engine
resource "vault_mount" "kv" {
  path        = "secret"
  type        = "kv-v2"
  description = "KV version 2 secrets engine"
}

# Database secrets engine
resource "vault_mount" "database" {
  path = "database"
  type = "database"
}

# Configure database secrets engine
resource "vault_database_secret_backend_connection" "postgres" {
  backend       = vault_mount.database.path
  name          = "postgres"
  allowed_roles = ["readonly", "admin"]
  
  postgresql {
    connection_url = "postgres://{{username}}:{{password}}@${aws_db_instance.main.endpoint}/postgres?sslmode=disable"
    username       = "vault_admin"
    password       = var.vault_db_password
  }
}

# Dynamic database role
resource "vault_database_secret_backend_role" "readonly" {
  backend             = vault_mount.database.path
  name                = "readonly"
  db_name             = vault_database_secret_backend_connection.postgres.name
  creation_statements = [
    "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';",
    "GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";"
  ]
  default_ttl     = 3600  # 1 hour
  max_ttl         = 86400 # 24 hours
}

# AppRole authentication
resource "vault_auth_backend" "approle" {
  type = "approle"
}

resource "vault_approle_auth_backend_role" "web_app" {
  backend        = vault_auth_backend.approle.path
  role_name      = "web-app"
  token_policies = ["web-app-policy"]
}

resource "vault_approle_auth_backend_role_secret_id" "web_app" {
  backend   = vault_auth_backend.approle.path
  role_name = vault_approle_auth_backend_role.web_app.role_name
}

# Policy for web application
resource "vault_policy" "web_app" {
  name = "web-app-policy"
  
  policy = <<EOT
# Read database credentials
path "database/creds/readonly" {
  capabilities = ["read"]
}

# Read application configuration
path "secret/data/web-app/*" {
  capabilities = ["read"]
}
EOT
}

3. Kubernetes Secrets Integration

External Secrets Operator:

yaml

# ExternalSecret for AWS Secrets Manager
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-credentials
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secret-store
    kind: SecretStore
  target:
    name: database-secret
    creationPolicy: Owner
  data:
  - secretKey: username
    remoteRef:
      key: production/database/credentials
      property: username
  - secretKey: password
    remoteRef:
      key: production/database/credentials
      property: password
---
# SecretStore configuration
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: aws-secret-store
spec:
  provider:
    aws:
      service: SecretsManager
      region: us-east-1
      auth:
        jwt:
          serviceAccountRef:
            name: external-secrets-sa

Advanced Security Patterns

1. Network Security Monitoring

VPC Flow Logs:

hcl

# VPC Flow Logs to CloudWatch
resource "aws_flow_log" "vpc" {
  iam_role_arn    = aws_iam_role.vpc_flow_log.arn
  log_destination = aws_cloudwatch_log_group.vpc_flow_log.arn
  traffic_type    = "ALL"
  vpc_id          = aws_vpc.main.id
}

resource "aws_cloudwatch_log_group" "vpc_flow_log" {
  name              = "/aws/vpc/flow-logs/${var.environment}"
  retention_in_days = 30
}

# IAM role for VPC Flow Logs
resource "aws_iam_role" "vpc_flow_log" {
  name_prefix = "vpc-flow-log-"
  
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "vpc-flow-logs.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })
}

2. Web Application Firewall (WAF)

WAF with Geographic Restrictions:

hcl

resource "aws_wafv2_web_acl" "global" {
  name  = "${var.environment}-global-waf"
  scope = "CLOUDFRONT"
  
  default_action {
    allow {}
  }
  
  rule {
    name     = "GeoRestrict"
    priority = 1
    
    action {
      block {}
    }
    
    statement {
      not_statement {
        statement {
          geo_match_statement {
            country_codes = ["US", "CA", "GB", "DE"]
          }
        }
      }
    }
    
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "GeoRestrict"
      sampled_requests_enabled   = true
    }
  }
  
  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "${var.environment}-global-waf"
    sampled_requests_enabled   = true
  }
}

Best Practices & Compliance

1. Security Hardening Checklist

yaml

Network Security:
  - [ ] Use security groups as primary defense
  - [ ] Implement network ACLs for additional layer
  - [ ] Enable VPC Flow Logs
  - [ ] Use private subnets for internal resources
  - [ ] Implement NAT gateways for outbound traffic

Identity & Access:
  - [ ] Enforce MFA for all users
  - [ ] Use IAM roles instead of access keys
  - [ ] Implement least privilege principles
  - [ ] Regular access reviews

Data Protection:
  - [ ] Encrypt data at rest and in transit
  - [ ] Use KMS for key management
  - [ ] Implement secrets rotation
  - [ ] Regular backups with encryption

Monitoring & Compliance:
  - [ ] Enable AWS Config
  - [ ] Use AWS GuardDuty for threat detection
  - [ ] Implement CloudTrail for API logging
  - [ ] Regular security assessments

2. Compliance Frameworks

Common Compliance Requirements:

yaml

SOC 2:
  - Security, availability, processing integrity
  - Confidentiality, privacy

HIPAA:
  - Protected Health Information (PHI)
  - Encryption, access controls, audit trails

PCI DSS:
  - Payment card data protection
  - Network segmentation, encryption

GDPR:
  - Personal data protection
  - Data subject rights, breach notification

This comprehensive networking and security foundation will enable you to design, implement, and maintain secure, scalable cloud infrastructure following industry best practices and zero trust principles.