Cloud Network Security and Identity
Cloud network security questions test defense in depth and least privilege. You must know how security groups, network ACLs, WAF, private endpoints, and IAM policies interact, and where each control is enforced.
Core rules
- Security groups are stateful, allow-only, and attached to elastic network interfaces; return traffic is automatically allowed.
- Network ACLs are stateless, ordered, and attached to subnets; you must allow both request and ephemeral response ports.
- Reference security groups by ID rather than CIDR to avoid broad rules.
- WAF inspects HTTP/S at layer 7; security groups and NACLs operate at layers 3 and 4.
- IAM roles and policies authorize API actions; service control policies set the maximum permissions for accounts.
- Private endpoints keep traffic on the provider backbone.
Worked example
A web tier should accept 443 only from the load balancer, and the database tier should accept 3306 only from the web tier. Create sg-lb, sg-web, and sg-db. sg-web inbound: 443 from sg-lb. sg-db inbound: 3306 from sg-web. If a subnet NACL is added, allow inbound 443 and 3306 plus outbound ephemeral 1024-65535; otherwise responses are dropped.
Traps
- Opening 22 or 3389 to 0.0.0.0/0.
- Forgetting ephemeral ports on NACLs.
- Using long-lived IAM access keys instead of roles.
- Assuming a private subnet is secure without checking route tables and endpoints.