Infrastructure & Networking
Design the virtual network first
Cloud networks are software-defined. The objects to know: VPC or VNet, subnets (public versus private), route tables, internet and NAT gateways, security groups, network ACLs, load balancers, DNS, and private connectivity options such as site-to-site VPN, AWS Direct Connect, Azure ExpressRoute, Google Cloud Interconnect, and private endpoints. Hybrid designs commonly use hub-and-spoke or transit-gateway topologies, and segmentation or microsegmentation for lateral movement control.
Security mechanics
Default-deny ingress, allow-listed egress where feasible, no default VPCs, and no management ports open to the internet. Keep management planes on private paths or behind bastion or zero-trust access. Web application firewalls filter HTTP-layer attacks; DDoS protection operates at the provider edge; TLS protects data in transit. Remember that provider APIs are internet-reachable, so protect them with identity and policy as well as network controls.
Traps
- Security groups are stateful and support allow rules only; NACLs are stateless and support both allow and deny.
- A private subnet needs a NAT gateway for outbound traffic, and that NAT is an egress path for your data.
- VPC peering is non-transitive; transit gateways exist to solve scale.
- Firewall, WAF, and DDoS protection cover different layers and are not interchangeable.
Rule of thumb
If a resource does not need to be reachable from the internet, it should have no public address and its route table should make that impossible rather than merely unlikely.