Lesson 4 of 4 ยท Build a Cloud Foundation

Access and security boundaries

A secure architecture lets only the required traffic and identities reach a resource. Use narrow network rules, least-privilege identity permissions, and private placement for workloads that do not need public access.

Example

resource "aws_security_group" "app" {
  name   = "app"
  vpc_id = aws_vpc.main.id

  ingress {
    from_port = 443
    to_port   = 443
    protocol  = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Step by step

  1. List who needs access before opening a rule.
  2. Allow only the required port and protocol.
  3. Use security groups or equivalent controls between tiers.
  4. Review public exposure regularly.

Common mistakes to avoid

  • Opening all ports to the internet during testing.
  • Granting broad permissions because an application error is hard to diagnose.