Infrastructure Security
Layered network controls
Security groups are stateful, allow-only, attached to ENIs, and can reference other security groups as a source - the clean way to express "the app tier accepts 443 only from the web tier." Network ACLs are stateless, subnet-level, evaluate rules in ascending number order, and support explicit deny; because they are stateless you must allow ephemeral ports (1024–65535) in both directions.
AWS Network Firewall provides stateful inspection with Suricata-compatible rules, domain allow-listing via TLS SNI, and centralized egress control from a shared inspection VPC. AWS WAF handles layer 7 - managed rule groups, rate-based rules, bot control - in front of CloudFront, ALB, API Gateway, and AppSync. Shield Standard is automatic; Shield Advanced adds DDoS cost protection and the response team.
Private connectivity and admin access
Gateway endpoints (S3, DynamoDB) and interface endpoints (PrivateLink) keep traffic off the internet. Endpoint policies plus the aws:SourceVpce condition let you require that a bucket is reachable only through a specific endpoint. The bastion host is the wrong answer on modern exams: Systems Manager Session Manager gives shell access with no inbound ports, no SSH keys, IAM-based authorization, and session logging to S3 or CloudWatch.
Instance metadata
IMDS is a classic SSRF target. IMDSv2 requires a PUT to obtain a session token; enforcing HttpTokens: required with a hop limit of 1 blocks most SSRF paths. Enforce at scale through an SCP on ec2:RunInstances conditions rather than relying on AMI hardening.
Traps
A security group cannot deny. A NACL cannot reference another NACL or a security group. WAF does not protect non-HTTP protocols. Gateway endpoints are free; interface endpoints bill hourly plus per GB.
Worked example: prove no instance can reach the internet directly. Combine a route table with no 0.0.0.0/0 route, a Network Firewall egress policy, VPC Flow Logs with a REJECT filter, and a Config rule - preventive control first, detective evidence second.