Cloud providers give every new account a default network that works immediately. It is a reasonable starting point and a poor finishing point, because its purpose is to let anything talk to anything so that nothing appears broken.
The layers, in plain terms
-
Virtual network
Your private address space. The outer boundary.
-
Subnets
Divisions within it, usually split public and private, spread across zones.
-
Routing
What can reach the internet, and by which path.
-
Security groups
Instance-level rules. Usually where you do the real work.
-
Network ACLs
Subnet-level rules. A coarse second layer.
A layout that covers most cases
- Public subnets for load balancers and nothing else.
- Private subnets for application instances and containers.
- Isolated subnets for databases, with no route to the internet.
- Outbound internet for private subnets through a managed gateway.
- Everything duplicated across at least two availability zones.
The principle is that anything holding data should not be directly reachable from the internet, in either direction, unless there is a specific reason.
Security group hygiene
| Practice | Why |
|---|---|
| Reference other groups, not addresses | Rules stay correct as instances change. |
| Open only the ports actually served | Every extra port is surface. |
| Never open SSH or RDP to the world | Use a bastion or the provider’s session tooling. |
| Restrict database ports to app groups | The database should not accept arbitrary traffic. |
| Review egress too | Outbound rules limit what a compromised host can reach. |
Keep it in code
Network changes made by hand during an incident are the ones nobody documents and nobody removes. Defining the network in infrastructure code means changes are reviewed, recorded and reversible, and the temporary rule from last March is visible in a diff.
Summary
Replace the permissive default, keep data tiers unreachable from the internet, write security group rules that reference groups rather than addresses, close remote access ports, and manage the whole thing as code.
