Design Secure Workloads and Applications

Core Idea

This task is about securing the network and application tiers themselves — VPC design, segmentation, and the managed security services that sit in front of or inside your workloads.

VPC Fundamentals Checkpoints

• VPC is a regional service — created in one Region, one account.
• Two VPC types: default (pre-configured, permissive) vs. custom (you build the security from scratch) — know how default security differs between them.
• Subnets are AZ-resilient, not regional — a subnet lives in exactly one Availability Zone.

Layered Network Security

• Security groups, NACLs, route tables, and NAT gateways together provide the traffic-control layer for multi-tier apps.
• Study each individually and how they interact (e.g., a NACL deny can block traffic a security group would otherwise allow).
• Know default configurations for both default and custom VPCs — a common exam trap is assuming custom VPC security groups start open (they don't; they start closed except for outbound).

Segmentation Pattern

• Public subnets: resources that need direct internet reachability (e.g., load balancers, bastion/NAT).
• Private subnets: application servers/databases — no direct route to the internet.
• Classic scenario: on-prem traffic reaches private-subnet app servers over a Site-to-Site VPN, without any public internet exposure — requires correctly threading VPC/subnet/instance-level rules to allow the VPN-sourced traffic while keeping the subnet otherwise private.

Connectivity Toolkit

• VPC endpoints are gateway objects (like an internet/NAT gateway) that let a VPC reach AWS public services without internet/NAT gateways.
• PrivateLink (interface endpoint service): the scalable way to expose an app/service to many VPCs/accounts without VPC peering, an internet gateway, or a NAT gateway — avoids peering's management overhead and its side effect of exposing everything else in the peered VPCs.
• Other connectivity primitives to know cold: VPC peering, Transit Gateway, Site-to-Site VPN, Client VPN, Direct Connect — know the capacity/security/resilience trade-offs of each.

Data-Protection-Adjacent Services (still under "secure workloads")

• Amazon Macie: ML-based discovery/classification/protection of PII stored in S3 — this is the answer whenever a question asks "which service finds sensitive data in S3?"
• Amazon Cognito: user pools (authentication) vs. identity pools (authorization/temp AWS credentials), plus its role brokering SSO/identity federation.
• Amazon GuardDuty: threat detection.

Firewalls, Proxies, and Secrets

• AWS Shield Standard (free, always-on) vs. Shield Advanced (paid, enhanced DDoS protection + response team).
• AWS WAF: web-layer protection (e.g., SQL injection) — but only deployable on specific services: ALB, API Gateway, CloudFront. Know this restriction; it's a common distractor-eliminator.
• Secrets Manager vs. Systems Manager Parameter Store: choose Secrets Manager when you need automatic rotation at a defined interval and high-volume secret access; Parameter Store is the lighter/cheaper option for general config/secrets without built-in rotation.
• IAM Identity Center for centralized workforce access across accounts.

Exam Angle

Expect: "which service can only be attached to X" (WAF), "least-overhead way to expose a service to many VPCs" (PrivateLink over peering), "rotate this secret automatically" (Secrets Manager), "find PII in S3" (Macie), and NACL-vs-security-group traffic-flow tracing questions.

Practical Examples

Security group vs. NACL, worked through: Your web app runs on EC2 in a private subnet. You want to block one malicious IP range (203.0.113.0/24) that's hammering your app, while still allowing everyone else on port 443. A security group can't do this — it only allows, it never explicitly denies a specific source. You need a NACL rule on the subnet: rule #100 deny inbound 203.0.113.0/24, rule #200 allow inbound 0.0.0.0/0 on 443 (NACLs evaluate rules in number order, lowest first, and stop at the first match).

[!note] NACL rule numbers — the actual mechanic There's no fixed "rule book" of numbers to memorize — a NACL rule number is just a priority label you assign, anywhere from 1 to 32766.

• AWS evaluates a NACL's rules in ascending numeric order (lowest first) and stops at the first rule that matches the traffic — later rules are never consulted for that packet.
• This is why order matters, not just presence: in the example above, #100 (deny) must be numbered lower than #200 (allow) so the deny is checked first. Numbered the other way, the allow would match first for everyone — including the malicious range — and the deny rule would never get a chance to fire.
• The "100, 200, 300…" spacing convention (also what the AWS console defaults to) exists purely so you can insert a new rule later (e.g. #150) without renumbering everything else — it's a maintainability habit, not an AWS requirement.
• Every NACL also has an implicit final rule, numbered *, evaluated last, that denies all traffic not matched by any explicit rule — this is why unmatched traffic is denied by default, not allowed.

Stateful vs. stateless in action: A security group allows inbound HTTP (80) to your EC2 instance. A client's response traffic on a random ephemeral port (e.g., 54321) automatically flows back out — you never had to write an outbound rule for it, because security groups are stateful. Do the same thing with only a NACL, and you must explicitly add an outbound rule allowing traffic on the ephemeral port range (1024–65535), because NACLs are stateless and track nothing.

3-tier app subnet layout: A typical exam-style design — public subnet holds the ALB; private subnet (app tier) holds EC2/ECS app servers that reach the internet only via a NAT Gateway (e.g., for OS patching); a second private subnet (data tier) holds RDS with no route to the internet at all, only reachable from the app tier's security group.

PrivateLink over peering: A SaaS company (Account A) built an API that 200 different customer VPCs (each their own AWS account) need to call privately. VPC peering would mean 200 peering connections to manage, plus each peered VPC could theoretically route to anything else in Account A's VPC. Instead, Account A creates a Network Load Balancer + VPC endpoint service (PrivateLink); each customer creates an interface VPC endpoint pointing at that service. Traffic never touches the public internet, and customers only see the specific service, not the whole VPC.

On-prem to private subnet via VPN: A hospital's on-prem EHR system needs to call an app running on EC2 in a private subnet — no public IP, no internet exposure allowed (compliance). Solution: Site-to-Site VPN from the on-prem VPN device to a Virtual Private Gateway on the VPC; the route table in the private subnet routes on-prem CIDR ranges over the VPN; the security group on the EC2 instance allows inbound traffic only from the on-prem CIDR block.

WAF vs. Shield vs. GuardDuty, three different jobs: An e-commerce site is (1) getting hit with SQL injection attempts on its login form, (2) targeted by a volumetric DDoS attack during a flash sale, and (3) has an EC2 instance quietly making unusual API calls that look like it's been compromised. Fix for (1): AWS WAF rule blocking SQLi patterns on the ALB. Fix for (2): AWS Shield Advanced (Standard alone may not be enough for large L3/L4 attacks, and Advanced gives you the DRT and cost protection). Fix for (3): Amazon GuardDuty is what would have flagged the anomalous API activity in the first place.

Macie in one line: You inherited an S3 bucket with millions of unlabeled CSV files and need to find out if any contain customer social security numbers before a compliance audit. Turn on Amazon Macie and let it scan and classify the bucket — don't write a custom regex-scanning Lambda from scratch.

Secrets Manager vs. Parameter Store: Your RDS database password needs to rotate automatically every 30 days and be usable by Lambda functions without code changes — use Secrets Manager (native RDS rotation integration). Your app just needs a static, non-sensitive config value like an API endpoint URL or a feature flag — use Systems Manager Parameter Store (free tier, no rotation needed, cheaper for high-volume simple config).