Implementing security between network boundaries

Can you describe the role of Network Access Control Lists (NACLs) in securing the boundaries between networks in AWS?

NACLs act as a stateless firewall at the subnet level to control inbound and outbound traffic. They provide an additional layer of security by allowing you to create rules that explicitly allow or deny traffic based on IP protocol, source IP address, destination IP address, and port numbers.

What is the difference between security groups and network ACLs in AWS, and how does each contribute to boundary security?

Security groups are stateful and operate at the instance level to control inbound and outbound traffic, while NACLs are stateless and work at the subnet level. Security groups track the state of connections and automatically allow return traffic for allowed inbound connections, whereas NACLs require explicit rules for both inbound and outbound traffic.

How can AWS VPC peering help in implementing network boundary security, and what are the limitations to consider?

AWS VPC Peering allows for secure communication between two VPCs by establishing a networking connection between them. Peering aids in boundary security by enabling resource isolation while still allowing necessary traffic. Limitations include no transitive peering (cannot route through another VPC to reach a third one) and no overlapping IP ranges.

Explain how a VPN connection can secure network boundaries and mention any two scenarios where it is ideal to use a VPN in AWS?

A VPN connection provides a secure, encrypted tunnel between an Amazon VPC and an on-premises network. This enables private, secure communications. VPNs are ideal when connecting a corporate network to AWS without using the public internet for privacy and security or when enabling remote workers secure access to AWS resources.

Can you explain the importance of implementing AWS Shield and AWS WAF in protecting the network boundaries against different types of attacks?

AWS Shield provides protection against Distributed Denial of Service (DDoS) attacks by filtering traffic and protecting AWS resources. AWS WAF allows you to monitor HTTP/HTTPS requests and create rules that block common web exploits. Used together, they can protect network boundaries from a wide variety of attacks, including SQL injection and XSS.

How does AWS Network Firewall contribute to network boundary security, and how is it different from NACLs and security groups?

AWS Network Firewall is a managed service that provides stateful, scalable network firewall protection for VPCs. Unlike NACLs and security groups, Network Firewall supports advanced features like stateful rule evaluation, intrusion prevention and detection, and the ability to use domain lists to block or allow traffic.

Describe the role of AWS Direct Connect in terms of enhancing network boundary security.

AWS Direct Connect provides a dedicated network connection between on-premises infrastructure and AWS, bypassing the public internet, which improves security and lowers the risk of interception or tampering. It’s useful for businesses with strict security requirements needing consistent and reliable connectivity.

Why is it important to implement subnet segmentation within an Amazon VPC, and how does it relate to network boundary security?

Subnet segmentation is the practice of dividing a network into smaller segments. In AWS, this can improve security by isolating different types of resources (e.g., applications, databases) and controlling access with security groups and NACLs, thus offering a more granular security approach.

What are AWS PrivateLink and its benefits related to securing network boundaries?

AWS PrivateLink allows private connectivity between VPCs and AWS services without data traveling over the public internet. It keeps the traffic within the AWS network, enhancing security and reducing the exposure to threats associated with internet-facing endpoints.

How does AWS Identity and Access Management (IAM) contribute to network boundary security, especially in regard to AWS networking resources?

IAM allows management of permissions for AWS resources. It helps in network boundary security by ensuring that only authorized users and services can make changes to networking resources, like VPCs, Security Groups, and Route Tables, enforcing the principle of least privilege.

In what way do AWS Route 53 health checks contribute to network boundary security?

Route 53 health checks can monitor the health and performance of endpoints. While not a security feature per se, they can indirectly contribute to security by early detection of unusual behaviors that might indicate a security issue (e.g., DDoS attack) and rerouting traffic to healthy endpoints.

Describe how you would use flow logs to monitor and implement network boundary security in AWS.

Flow logs capture information about IP traffic going to and from network interfaces in VPCs. They can be used to monitor and log traffic that traverses the network boundaries, allowing analysis for security reviews, incident response, and ensuring compliance with security policies by observing traffic patterns.