HFCP: Networking and Security Automation

Domain 3 - Networking and Security Automation. This domain tests whether you can express network topology and security controls as code, and where policy enforcement actually sits. Expect questions on VPC constructs, stateful versus stateless filtering, least privilege, and policy-as-code gates.

Core rules

• Model networks declaratively: VPC/VNet, subnets, route tables, internet/NAT gateways, and firewall rules are resources with dependencies, so Terraform creates them in graph order.
• Security groups are stateful: return traffic for an allowed connection is automatically permitted. Network ACLs are stateless: you must allow both directions, and they evaluate in numbered order.
• Segment by function and trust: public subnets for load balancers, private subnets for workloads, restricted egress, and explicit peering or private endpoints.
• Policy as code enforces organizational rules before infrastructure exists. In HCP Terraform, Sentinel policies evaluate the plan and can be advisory, soft-mandatory, or hard-mandatory. The check happens between plan and apply, not at runtime.
• Automate credentials too: short-lived cloud credentials and Vault-issued dynamic secrets replace long-lived keys in pipelines.

Worked example

A policy must block any security group rule that exposes SSH to the internet. The Sentinel rule inspects planned aws_security_group_rule resources, selects those with type == 'ingress', and denies when cidr_blocks contains 0.0.0.0/0 and from_port <= 22 <= to_port. A developer's plan for port 22 from 10.0.0.0/8 passes; the same rule with 0.0.0.0/0 fails before apply. The reasoning: Sentinel evaluates the plan JSON, so it can stop the change centrally and consistently, but it cannot stop a console change made outside Terraform - that requires drift detection and runtime controls.

Traps

• Treating Sentinel or OPA as a runtime firewall. It is a pre-apply governance gate.
• Forgetting that NACLs are stateless and need ephemeral-port rules.
• Assuming a private subnet has outbound internet without a NAT gateway or egress-only gateway.
• Writing a policy that checks only cidr_blocks and misses ipv6_cidr_blocks or prefix_list_ids.
• Believing a passing plan proves the deployed network is compliant; manual changes create drift.