Microsegmentation After Lateral Movement in a PCI VPC
During an incident review, a compromised internet-facing EC2 instance in a PCI-scoped VPC used an overly permissive security group rule (0.0.0.0/0 on port 3306) to reach an RDS MySQL database in another subnet. The attacker then queried a shared IAM role attached to the instance and enumerated S3 buckets. The environment has three VPCs: PCI (10.10.0.0/16), corporate (10.20.0.0/16), and shared services (10.30.0.0/16), connected by a transit gateway. There are 120 EC2 instances, 40 Lambda functions, and 25 microservices. The security team wants zero-trust segmentation, but the application team says enforcing deny-by-default will break batch jobs that use dynamic source ports. The company must retain PCI DSS compliance and prove that PCI workloads cannot initiate connections to corporate or shared services except through an approved egress proxy. Existing VPC flow logs are enabled but only with 5-minute aggregation and 1-hour retention.
1. Design network and identity controls to prevent lateral movement from the PCI VPC to corporate and shared services.
Read the worked answer
At the network layer, replace CIDR-based security group rules with references to security group IDs, and add subnet NACLs as a secondary control. Use a central inspection VPC with AWS Network Firewall or a transit gateway appliance for east-west traffic. Create TGW route tables that isolate PCI: the PCI route table should contain only PCI subnets and the egress proxy, not corporate or shared services. At the identity layer, remove the shared IAM role and give each workload a dedicated role with least privilege. Use IAM permission boundaries and SCPs to block PCI roles from calling S3 buckets outside the PCI account. Require VPC endpoints for S3 and other services so traffic does not traverse the internet. For the database, allow only the application security group on 3306, not 0.0.0.0/0. Use AWS PrivateLink for approved shared services. This combines deny-by-default routing with least-privilege identity, so a compromised instance cannot reach corporate even if it obtains credentials.
2. How would you enforce and prove that PCI workloads cannot initiate connections to corporate or shared services except through the egress proxy?
Read the worked answer
Enforce with route tables first: the PCI TGW route table has no routes to corporate or shared services, only to the egress VPC. In the egress VPC, Network Firewall applies domain and IP allowlists and logs all allowed and denied flows. Security groups on PCI instances allow egress only to the proxy security group on the proxy port. Use VPC Flow Logs with 1-minute aggregation delivered to a central S3 bucket with at least 90 days retention, plus Network Firewall logs and DNS query logs. To prove it, run AWS Reachability Analyzer from PCI instances to corporate and shared services and show no path. Then run a test connection and show the firewall deny log. Review IAM CloudTrail events for cross-account access. Produce a monthly evidence report that maps each PCI workload to its allowed egress destinations and shows zero direct connections. This satisfies the PCI requirement for documented network segmentation.
3. The application team says deny-by-default will break batch jobs that use dynamic source ports. How would you migrate without an outage?
Read the worked answer
Clarify that security groups are stateful: an outbound rule to the destination security group on the service port allows the return traffic regardless of the client's dynamic source port. The breakage is likely from NACLs or from rules that tried to match the client port. Use security group referencing and leave NACLs permissive during migration. Start in audit mode: deploy the new rules in parallel, enable flow logs, and identify actual dependencies with Reachability Analyzer and VPC Flow Logs. Group batch jobs into a pilot security group. Apply the deny-by-default policy to the pilot after two weeks of clean logs. Use a rollback security group and a change window. Test in a staging VPC that mirrors the PCI layout. For legacy jobs that cannot use security group references, use a proxy or a dedicated egress subnet with static IPs. Monitor denies and iterate.