Networking on My AWS Rocks!

Network Security at all levels

Sat, 19 Jul 2025 00:00:00 +0000

In this, the second of a multi-part series on securing your workloads, I'll look more broadly and why, where, and how, you should be securing your network. I'll look at both the principles and AWS services that help you reduce the risk of network based breaches. The introduction to the Security at all levels gives an overview of what I believe security in depth means and why we should all follow the principles.

So I’ve previously talked about NACLs and Security Groups (Here) and (Here) and their role in securing your workload. This post will go in to further details of controls that should be considered when deploying AWS services to ensure security of solutions. There is a fine line between network and application security. I will not talk about what I deem application security such as IAM Roles for services of application level restrictions such as rate limiting on a service. However I doe believe services such as WAF and Load Balancers are a network level control so will touch on them.

Troubleshooting with VPC Flow Logs

Thu, 05 Jan 2023 00:00:00 +0000

So you built your secure VPC, but things are not working as expected.
Or maybe something changed on the infrastructure and now things are not working.

And as any network engineer knows, every application fault is always due to the network! So how do we prove traffic is getting to our systems and it’s not the network?

The answer is VPC Flow Logs.

There is great guidance on Flow Logs in the AWS VPC documentation so I will try not to cover that. What I will try and do is clarify some areas and explain how we can then use them to understand what is going on in our network. Specifically how we can use the AWS CloudWatch Logs console to find out what is happening in our VPC and give us some pointers on what might be wrong.

How to use NACLs and Security Groups

Tue, 06 Dec 2022 00:00:00 +0000

Following up from my last post here on what Network Access Control Lists (NACLs) and Security Groups (SGs) are, I will now take a look at where and how I think you should use them to ensure you have a secure network.

I’ll use a basic scenario of a VPC (10.0.0.0/16) split into two public subnets, with access to the internet (10.0.0.0/24 and 10.0.1.0/24), and two private subnets, with no route the the internet (10.0.10.0/24 and 10.0.1.0/24). The application is running on 2 EC2 behind an application load balancer to discuss the options.

Network Access Control Lists vs Security Groups

Sat, 22 Oct 2022 00:00:00 +0000

Both are used to protect networks and resources, but there is often confusion about the difference between Network Access Control Lists (NACLs) and Security Groups, and when each should be used.

This post, aims to demystify the two concepts.

The differences that we will cover are:

Stateful vs Stateless
Inbound vs Outbound
Allow vs Deny
Rule Order

Future post will then look at how to use this knowledge to apply both NACLs and Security Groups, and how to troubleshoot connectivity issues when NACLs and Security Groups are in place.

Why use a Transit Gateway

Tue, 05 Jul 2022 00:00:00 +0000

You may see in my designs and discussions that I always use an AWS Transit Gateway for connections outside of the VPC.

While there are use cases where this does not make sense, which I’ll describe, for the majority of organisations’ use cases I believe that using Transit Gateways is the preferable solution.

Cost 💰

Firstly lets address the cost implications of using an AWS Transit Gateway over VPC Peering, as many will use this to justify using peering because they see it directly on their bill.

Creating a Well-Architected VPC

Wed, 20 Apr 2022 00:00:00 +0000

So this is the first in my posts walking through how to deploy a solution in AWS. Hopefully you find it useful as VPCs are the foundation for private and secure networking in AWS and an area many struggle. This guide is designed to ensure that your VPC deployments can be Well-Architected and provide a base level of network security but is only one option for VPC layout. While it will meet a vast majority of workloads you might want to review the structure and reduce, or increase, the number of subnets as well as other components.

How to Well-Architect network connectivity to AWS services.

Sun, 05 Dec 2021 00:00:00 +0000

With so many possible paths which do you take?

So a few weeks ago I was asked what my strategy was for accessing internal AWS resources such as S3, DynamoDB etc. where it is possible to access over VPC endpoints as well as the internet.

My first point of reference for them was the great map by Corey Quinn, Chief Cloud Economist atThe Duckbill Group which looks at the costs for moving data around AWS.

AWS Community Builders

Fri, 01 Oct 2021 00:00:00 +0000

Over the summer I saw a few of my connections on LinkedIn announce that they were selected by AWS as a Community Builder. It was one of a few programs I have heard about from AWS that focus on building content and knowledge within the AWS community.

As you can guess by this blog, one of the things I’m keen on is sharing knowledge. I believe that we all benefit when people share knowledge. Looking into the program interested me for two reasons.