AWS Architecture Guide

Network Security, Edge Protection, and Private Access

What This Chapter Is About

Explain AWS network security controls and edge protection as layered responsibilities, not as a list of security products.

Keep one durable idea in view:

Network security design decides where traffic is allowed, where it is inspected, where applications are protected, and which paths should never need the public internet.

Sections

  1. Network Security Mental Model

  2. Security Groups, Network ACLs, and Inspection Placement

  3. Edge Protection with AWS WAF and Shield

  4. Private Access with VPC Endpoints and PrivateLink

  5. Public API Platform Network Security Scenario

How the Chapter Develops

The chapter develops in this order:

  1. Establish defense in depth as a placement model: workload controls, subnet controls, inspection points, edge controls, and private paths.

  2. Separate security groups, network ACLs, and AWS Network Firewall by what each control can decide.

  3. Explain edge protection for public web and API entry points with AWS WAF and AWS Shield.

  4. Explain private access to AWS services and provider services through VPC endpoints and AWS PrivateLink.

  5. Apply the model to a public API platform that needs internet entry, private databases, controlled egress, and inspection for sensitive traffic.

What You Will Be Able to Do

By the end of this chapter, the reader should be able to:

  • Explain defense in depth for AWS networking without listing every security product.

  • Compare security groups, network ACLs, AWS Network Firewall, AWS WAF, AWS Shield, VPC endpoints, and AWS PrivateLink by responsibility.

  • Decide where inspection belongs in a VPC, account, or central networking design.

  • Keep sensitive service access private when public internet routing is unnecessary.

  • Describe a practical network security design for a public API platform.

Key Ideas

  • A security group is usually the main workload-level allow-list.

  • A network ACL is a subnet-level guardrail, not a replacement for security groups.

  • AWS Network Firewall is useful when traffic needs centralized, route-based inspection.

  • AWS WAF protects HTTP and HTTPS application entry points; AWS Shield protects against DDoS attacks.

  • VPC endpoints and AWS PrivateLink reduce the need for private workloads to reach services through public paths.