Skip to content
FR

Design Secure Workloads and Applications

Step 3 of 28

AWS VPC Security, Application Protection, and Private Connectivity

AWS VPC security combines subnet routing, network controls, application protection, and secure service connectivity. This SAA-C03 lesson covers Task 1.2, Design secure workloads and applications, in Domain 1, Design Secure Architectures (30% of scored content). You will separate reachability from authorization, select the correct firewall layer, and design private access without unnecessary NAT processing.

Learning objectives

After this lesson you will be able to:

  • Design a segmented Amazon VPC with public, private and isolated subnets.
  • Choose correctly between security groups and network ACLs and predict how each behaves.
  • Protect web applications and APIs with AWS WAF, AWS Shield and Amazon CloudFront.
  • Store and rotate credentials with AWS Secrets Manager and AWS Systems Manager Parameter Store.
  • Select the right private connectivity option: VPC endpoints, AWS PrivateLink, Site-to-Site VPN, Direct Connect, or a combination.
  • Answer the SAA-C03 questions for Domain 1, Task 1.2 (secure workloads and applications).

Architecture map

Only the ALB accepts public requests. Application and database security groups reference the preceding tier; database failover may cause brief errors.

1. Layered security: defense in depth

A secure AWS workload does not rely on one control. It stacks layers, and the exam expects you to match each threat to the right layer.

Layer Controls Typical threat addressed
Edge Amazon CloudFront, AWS WAF, AWS Shield, Route 53 DDoS, SQL injection, bots, geographic restrictions
Network VPC design, subnets, route tables, network ACLs, security groups Unwanted inbound or lateral traffic
Host / compute Instance roles, patching with Systems Manager, no SSH exposure Compromised instances, stolen credentials
Application Secrets Manager, Cognito, input validation, API Gateway authorizers Credential leakage, unauthorized API access
Data Encryption, bucket policies, and backups; see AWS KMS and data protection Data exposure
Monitoring VPC Flow Logs, CloudTrail, GuardDuty, Security Hub Detection and response

2. Amazon VPC design

A VPC is a logically isolated virtual network in one Region. You choose its IPv4 CIDR block (between /16 and /28) and may add IPv6. A VPC spans all Availability Zones (AZs) in the Region, but each subnet lives in exactly one AZ.

2.1 Subnet types

Subnet type Route to the internet Typical contents
Public Route table has an internet route to an internet gateway (IGW); direct IPv4 internet access also needs a public IPv4 address Load balancers, NAT gateways, bastion hosts (although Systems Manager Session Manager is preferred)
Private (with egress) 0.0.0.0/0 to a zonal public NAT gateway in a public subnet, or a supported regional NAT configuration Application servers that need outbound updates or API calls
Isolated (private without egress) No default route to the internet Databases, internal services; reach AWS services through VPC endpoints

What makes a subnet "public" is its route table, not its name or automatic address assignment. A route does not by itself make every resource reachable: addresses, security controls, and application listeners still matter. The IGW is horizontally scaled and highly available. A zonal NAT gateway belongs to one AZ: deploy one per AZ and route private subnets locally for resilient egress. A regional NAT gateway is an alternative that manages multi-AZ expansion; compare its regional availability, routing and charges. For IPv6-to-IPv6 outbound access, use an egress-only internet gateway. IPv6-only clients reaching IPv4 destinations can use DNS64 and NAT64 through a NAT gateway.

2.2 A classic three-tier layout

For a web application across two AZs:

  • Public subnets (one per AZ): Application Load Balancer and NAT gateways.
  • Private application subnets (one per AZ): EC2 Auto Scaling group or ECS tasks.
  • Isolated data subnets (one per AZ): Amazon RDS Multi-AZ.

Traffic flows from the internet to the ALB, from the ALB to the application tier, and from the application tier to the database. Each hop is permitted by a security group rule that references the previous tier's security group.

3. Security groups versus network ACLs

This comparison is among the most tested topics in the exam.

Feature Security group Network ACL
Level Elastic network interface (instance, ENI, load balancer, RDS) Subnet
State Stateful: return traffic is automatically allowed Stateless: return traffic must be explicitly allowed; the required ephemeral range depends on the client or managed component
Rule types Allow only Allow and Deny
Evaluation All rules evaluated together Rules evaluated in number order; first match wins
Default (new custom) Denies all inbound, allows all outbound Custom NACL denies all inbound and outbound until you add rules; the default NACL allows all
References Can reference other security groups, prefix lists CIDR blocks only
Typical use Primary instance-level firewall Extra subnet-level layer; block specific IP addresses

3.1 Practical rules of thumb

  • To allow a tier to talk to another, use security group references: "the database SG allows port 3306 from the application SG". No IP addresses to maintain, and it keeps working as Auto Scaling adds or removes instances.
  • To block a malicious IP range, you need a NACL deny rule (a security group cannot deny).
  • Security groups are the primary control; NACLs are the coarse backup.
  • If inbound packets arrive but replies fail, inspect NACL return rules, routes, and the actual client ephemeral range. NACLs filter traffic crossing subnet boundaries, not traffic routed inside the same subnet.

4. Protecting applications at the edge

4.1 AWS WAF

AWS WAF is a web application firewall (layer 7) that you attach to Amazon CloudFront, an Application Load Balancer, Amazon API Gateway (REST), AWS AppSync, Amazon Cognito user pools and other supported resources. It inspects HTTP(S) requests with rules you define or managed rule groups:

  • AWS Managed Rules for common threats (SQL injection, cross-site scripting, known bad inputs, IP reputation).
  • Rate-based rules that aggregate requests by configured keys, often source IP, over an evaluation window and apply the selected action above the threshold. They are not an exact per-client application quota.
  • Geo-match rules that allow or block countries.
  • Bot Control and account-takeover protections as paid options.

A Network Load Balancer or a raw EC2 instance cannot have WAF attached directly. If a question asks to block SQL injection on a web app behind an ALB, the answer is WAF on the ALB (or on CloudFront in front of it).

4.2 AWS Shield

Tier What it provides Cost
Shield Standard Automatic protection against common layer 3 and 4 DDoS attacks for all AWS customers Included
Shield Advanced Enhanced detection, DDoS response team (SRT) support, cost protection for scaling during an attack, protection for Elastic IPs, ALB, NLB, CloudFront, Route 53 and Global Accelerator, integration with WAF Paid subscription

For exam scenarios: “common DDoS protection with no additional Shield subscription” points to Shield Standard. Shield Advanced provides additional response and eligible cost protection, but you must protect the resources before an attack and meet the applicable requirements. Cost protection involves a credit request and eligible charges; it is not automatic reimbursement of every scaling expense.

4.3 CloudFront as a security boundary

Putting CloudFront in front of an origin gives you a global edge network that absorbs spikes, supports HTTPS with custom certificates from AWS Certificate Manager, geo-restriction, signed URLs and signed cookies for private content, and origin access control (OAC) with an appropriate bucket policy to restrict an S3 REST origin to the intended distribution. An S3 website endpoint is a custom origin and does not use OAC. Keep S3 Block Public Access enabled and verify any required KMS permissions. Combined with WAF and Shield, it is the standard answer for "protect a global web application".

4.4 Additional services

  • AWS Firewall Manager applies WAF, Shield Advanced, security group and Network Firewall policies centrally across accounts in an organization.
  • AWS Network Firewall is a managed, stateful network firewall and intrusion prevention service for VPCs, for deep inspection that security groups and NACLs cannot do.
  • Amazon GuardDuty detects threats by analyzing CloudTrail, VPC Flow Logs and DNS logs; Amazon Inspector scans EC2, containers and Lambda for vulnerabilities; Amazon Macie discovers sensitive data in S3.

5. Managing secrets and configuration

Hard-coded passwords in code or AMIs are always wrong on the exam.

Service Best for Rotation Cost
AWS Secrets Manager Database credentials, API keys, OAuth tokens Automatic rotation through a supported managed-service integration or a Lambda rotation function, depending on secret type Per secret per month plus API calls
SSM Parameter Store Configuration values and simple secrets (SecureString encrypted with KMS) No built-in rotation (you build it) Standard parameters free

Rule: "automatic rotation of database credentials" → Secrets Manager, with rotation configured and tested. “Store application configuration” often points to Parameter Store; compare throughput, parameter tier, and API charges for the workload. Both are accessed with IAM roles and can be encrypted with AWS KMS keys. Secrets Manager secrets can be replicated to other Regions for disaster recovery.

6. Private access to AWS services: VPC endpoints and PrivateLink

Without endpoints, a private instance can reach S3 through NAT and the public service endpoint, incurring NAT processing charges. AWS-to-AWS traffic on that route still stays on the AWS network. A gateway endpoint removes the NAT dependency and supports endpoint policies; "public endpoint" does not mean the packets must traverse an external internet provider.

Endpoint type Services How it works Cost
Gateway endpoint Amazon S3 and DynamoDB only Adds a route to the VPC route table that targets a prefix list Free
Interface endpoint (AWS PrivateLink) Most other services ( SQS, SNS, Kinesis, Secrets Manager, KMS, API Gateway, and many more), plus your own services and AWS Marketplace partners Creates elastic network interfaces with private IPs in your subnets, protected by security groups Hourly charge per AZ plus data processing

Endpoint policies can restrict supported actions and resources, but do not grant permissions by themselves. IAM, resource, and KMS policies still apply. A bucket policy can deny requests outside approved aws:SourceVpce values; test service integrations and operational access before enforcing it because normal console access may also be denied. Gateway endpoints use a service prefix-list route, not private endpoint ENIs.

AWS PrivateLink also lets a provider expose a service behind a Network Load Balancer to consumer VPCs without VPC peering, route tables or overlapping CIDR concerns, and only in one direction (consumers reach the service, not the other way around).

7. Connecting to on premises

Option Medium Setup time Bandwidth Encrypted by default Typical use
Site-to-Site VPN IPsec over the public internet Minutes Standard tunnels: up to 1.25 Gbps; large tunnels: up to 5 Gbps with eligible Transit Gateway or Cloud WAN configurations Yes Quick, low-cost connectivity; backup for Direct Connect
AWS Direct Connect Dedicated private fiber at a Direct Connect location Weeks 1, 10, 100 or 400 Gbps dedicated where offered; partner-hosted speeds vary No (add a VPN over Direct Connect or MACsec where supported) Consistent latency, large steady transfers, lower egress cost
Client VPN OpenVPN-based managed service Minutes Per-user Yes Individual remote users
Transit Gateway with VPN or DX Regional hub Minutes Scales n/a Connect many VPCs and on-premises networks

Key points:

  • A virtual private gateway (VGW) is the AWS side of a VPN for one VPC; a transit gateway is the hub for many VPCs. A customer gateway represents your on-premises device.
  • Direct Connect is not encrypted by default. If a question requires both a private dedicated link and encryption, combine Direct Connect with an IPsec VPN.
  • For high availability, the exam wants redundancy: two Direct Connect connections at different locations, or Direct Connect plus a VPN as backup.
  • VPC peering connects two VPCs privately but is non-transitive and requires non-overlapping CIDRs; at scale prefer Transit Gateway.

8. Worked example, step by step

Problem. A retailer is deploying a customer-facing web application. Requirements: block SQL injection and a list of abusive IP addresses, keep servers and database off the internet, let the servers fetch OS updates, store database credentials securely with rotation, and allow private data uploads to Amazon S3 from the servers without paying NAT data charges.

Step 1: network layout. Create a VPC with three tiers across two AZs: public subnets (ALB, NAT gateways), private subnets (application servers), isolated subnets (RDS). Servers have no public IPs.

Step 2: security groups by reference. The ALB SG allows 443 from 0.0.0.0/0. The app SG allows 8080 only from the ALB SG. The database SG allows 3306 only from the app SG.

Step 3: outbound updates. In this zonal design, add one NAT gateway per AZ in the public subnets and route each private subnet to its local NAT gateway. This removes dependence on a different AZ’s NAT for normal egress. A regional NAT design is another option where supported; compare its expansion behavior and failure model.

Step 4: S3 without NAT charges. Add an S3 gateway endpoint and associate it with the private route tables. Uploads travel over the AWS network at no endpoint cost, and the NAT gateway is no longer billed for that traffic.

Step 5: edge protection. Associate AWS WAF with the ALB, using the AWS Managed Rules SQL database rule group and a rate-based rule. Block the abusive IPs with an IP set rule in WAF (or a NACL deny entry if blocking must happen at the subnet level).

Step 6: secrets. Configure a supported rotation method and schedule in Secrets Manager. Give the application role secretsmanager:GetSecretValue for the secret and any required customer-managed KMS key permission. Verify the rotation identity can reach both the secret service and database, and that the application refreshes cached credentials. Use the IAM and role-based access lesson to scope these permissions.

Step 7: monitoring. Enable VPC Flow Logs and GuardDuty.

Why it works. Each requirement maps to one purpose-built control: WAF for SQL injection, SG references for tier isolation, NAT for egress, a gateway endpoint for S3, Secrets Manager for rotation.

9. Common pitfalls

  • Expecting a security group to block an IP. It only allows. Use WAF or a NACL deny.
  • Forgetting NACL statelessness and breaking return traffic.
  • Using one zonal NAT gateway for all AZs. If its AZ fails, private subnets in the other AZ lose egress; and cross-AZ traffic adds cost.
  • Using an interface endpoint for S3 when a gateway endpoint is enough (gateway endpoints are free, though interface endpoints for S3 exist for on-premises access via Direct Connect or VPN).
  • Assuming Direct Connect is encrypted.
  • Attaching WAF to a Network Load Balancer. Not supported; use ALB, CloudFront, API Gateway or AppSync.
  • Equating a subnet name with database exposure. For this isolated-data requirement, use isolated subnets and restrictive database settings; verify routes, public-access configuration, and security groups together.
  • Hard-coding plaintext secrets in user data, AMIs, or deployment configuration. Managed secret references are different from embedding a literal password; check how the runtime refreshes a rotated value.
  • Assuming VPC peering is transitive. It is not.
  • Believing Shield Standard needs to be enabled. It is automatic.

10. Exam tips

  • "Block specific IP addresses" at subnet level → network ACL deny. At the web layer → WAF IP set.
  • "Stateful" → security group. "Stateless" → network ACL.
  • "Reduce NAT gateway costs for S3 or DynamoDB traffic" → gateway endpoint.
  • "Access an AWS service privately from on premises" → interface endpoint over Direct Connect or VPN.
  • "Rotate credentials automatically" → Secrets Manager.
  • "Consistent, private, high-throughput connectivity" → Direct Connect; "quick and encrypted" → VPN.
  • "DDoS response team" or "cost protection" → Shield Advanced.
  • "Protect a global web app with the least operational overhead" → CloudFront + WAF + Shield.
  • When a question says "least administrative effort", choose the managed service over self-managed appliances on EC2.

11. Mini case study (with solution)

Scenario. Contoso Health runs an API on Amazon ECS ( Fargate) in private subnets behind an Application Load Balancer. The API reads patient documents from an S3 bucket and calls Amazon SQS. Auditors require that the bucket is reachable only from the VPC, that no data travels over the public internet, and that the database password rotates every 30 days. A recent incident showed a burst of requests from a handful of IP addresses causing slowdowns. The company has an office network connected through a Site-to-Site VPN and wants staff to browse the documents bucket for audits through the same private path.

Questions.

  1. How should S3 and SQS be reached privately from the VPC?
  2. How is the bucket restricted to the VPC?
  3. How is the request burst mitigated?
  4. How are credentials rotated?

Solution.

  1. Create an S3 gateway endpoint (free, route-table based) and an SQS interface endpoint (PrivateLink) with a security group allowing 443 from the task security group.
  2. Add a bucket policy denying requests outside the approved endpoint IDs, retaining explicit IAM and bucket permissions for authorized callers. Office staff need an S3 interface endpoint reachable over the VPN, suitable DNS resolution, and its ID in the allowed set. Validate SDK/CLI access to that endpoint; do not assume ordinary console browsing follows the same path.
  3. Attach AWS WAF to the ALB with a suitable rate-based action and an IP set rule for known abusive addresses. Confirm the source-IP interpretation when proxies are present and test legitimate shared-IP clients before enforcement.
  4. Configure Secrets Manager rotation every 30 days using the supported method, scope the task role and any required KMS access, and test reconnection after rotation.

Why alternatives fail. A NAT gateway keeps S3 traffic on the AWS network but still uses the public S3 endpoint and does not support the aws:SourceVpce restriction. A security group cannot express an explicit IP deny rule. Parameter Store does not provide the required database-secret rotation workflow. For the hybrid path, extend the design using AWS network topology and connectivity.

12. Glossary

  • VPC: a logically isolated virtual network in an AWS Region.
  • Subnet: a range of IP addresses in a VPC, located in one AZ.
  • Internet gateway: VPC component that enables internet access for public subnets.
  • NAT gateway: managed service that lets private resources initiate outbound IPv4 connections.
  • Security group: stateful, allow-only firewall at the network interface level.
  • Network ACL: stateless, allow-and-deny firewall at the subnet level.
  • AWS WAF: layer 7 web application firewall.
  • AWS Shield: DDoS protection service (Standard and Advanced).
  • Gateway endpoint: free route-based private access to S3 and DynamoDB.
  • Interface endpoint / PrivateLink: ENI-based private access to services.
  • Direct Connect: dedicated private network connection to AWS.
  • Site-to-Site VPN: IPsec tunnels between an on-premises network and AWS.
  • Secrets Manager: service to store and automatically rotate secrets.

13. Summary

  • Build VPCs in tiers: public, private with NAT egress, and isolated subnets, across at least two AZs.
  • Security groups are stateful and allow-only, and reference each other; network ACLs are stateless, ordered, and support deny.
  • WAF filters web requests (SQL injection, rate limiting, geo, IP sets); Shield Standard is automatic; Shield Advanced adds response team and cost protection.
  • CloudFront with WAF and Shield protects global applications and can keep S3 private with origin access control.
  • Secrets Manager rotates credentials automatically; Parameter Store is for configuration.
  • Gateway endpoints (S3, DynamoDB) are free; interface endpoints use PrivateLink for other services and for private on-premises access.
  • Site-to-Site VPN is fast to deploy and encrypted; Direct Connect is private and consistent but not encrypted by default; combine them for resilience and encryption.

Sources