Network Security and Infrastructure Protection
VPC constructs
A VPC contains subnets bound to a zone. Security groups are stateful and allow-only, attached to interfaces; network ACLs are stateless, attached to subnets, and support deny rules, so return traffic must be explicitly permitted. Public gateways and floating IPs create inbound reachability; avoid them for back-end tiers.
Private connectivity
Virtual Private Endpoints place a private IP for an IBM service inside your subnet, keeping traffic off the public internet; DNS resolution must be enabled on the VPC. Transit Gateway connects VPCs and classic infrastructure; Direct Link provides dedicated on-premises connectivity; VPN gateways cover site-to-site and client-to-site. IBM Cloud Internet Services adds WAF, DDoS absorption, and TLS termination for public-facing names.
Visibility
VPC flow logs record accepted and rejected flows and can be delivered to Object Storage or Cloud Logs. Security groups and ACLs enforce; flow logs observe. Flow logs are not an intrusion prevention system.
Worked example
An application needs private access to Object Storage with no public egress. Create a virtual private endpoint gateway for Object Storage in the application subnet, enable DNS resolution for the VPC, allow outbound 443 to the endpoint's security group, and omit the public gateway. Confirm with flow logs that no traffic leaves via public addresses.
Traps that cost marks
Security groups cannot deny; ACLs can, but they are stateless, so forgetting the return rule silently breaks traffic. Default security groups typically allow all outbound, which quietly permits exfiltration. A virtual private endpoint is useless without DNS resolution enabled.