The case
The store's database had a public address. Anyone on the internet could knock on its door.
Isaac built the store's web server and database the same way: each VM with a public address, to make access easier. The next day, the database log already showed hundreds of login attempts from countries he had never sold to.
Only the web server needed to be seen from the internet. The database only needed to talk to the web server.
This post builds on Regions and Zones, Virtual Machines and Security and Shared Responsibility in the Cloud: network configuration is part of the security that falls to you.
The problem
Everything exposed
A VM with a public address receives access attempts all the time, from bots that scan the internet for open ports. The more things are exposed, the larger the attack surface.
Most parts of a system don't need to be reached from outside: the database, the queues, the internal services. They only need to talk to other components.
The solution
A private network, just for you
The cloud lets you create a virtual network, a slice of the provider's network isolated from other customers, where you define the addresses, the rules and the routes. On AWS and Google Cloud it's called a VPC; on Azure, Virtual Network (VNet); on Oracle, VCN.
Inside it, you divide the space into subnets. The subnet decides who can see whom:
- Public subnet: has a route to the internet. This is where the components the world needs to reach live, like the web server.
- Private subnet: has no inbound route from the internet. This is where the database and the internal services live.
Virtual network (virtual private cloud, VPC)
Your isolated space in the cloud. You choose the range of private addresses and what goes into it.
In the store: one single network for the whole store.
Subnet
A division of the virtual network. Its routes define who talks to the internet and who doesn't.
In the store: a public subnet for the site and a private one for the database.
Internet gateway
The door connecting the virtual network to the internet, in both directions, for those with public addresses.
In the store: it's how customers reach the site.
NAT
Lets anyone in the private subnet go out to the internet, without letting anyone come in.
In the store: the database downloads updates, and no one outside can reach it.
The name in each cloud
The concepts apply to any provider. Only the products change:
| AWS | Azure | Google Cloud | Oracle Cloud | |
|---|---|---|---|---|
| Virtual network | VPC | Virtual Network | VPC | VCN |
| Outbound-only access (NAT) | NAT Gateway | NAT Gateway | Cloud NAT | NAT Gateway |
| VPN to the company (site-to-site VPN) | Site-to-Site VPN | VPN Gateway | Cloud VPN | Site-to-Site VPN |
| Dedicated link (dedicated connection) | Direct Connect | ExpressRoute | Cloud Interconnect | FastConnect |
Who can get in
Firewalls
The subnet says where traffic can pass. The firewall says what can pass. These are inbound and outbound rules: from which address, to which port, with which protocol.
As a rule, everything not explicitly allowed is blocked. You open only what is needed:
| Who | Inbound rule |
|---|---|
| Web server | Any address, ports 80 and 443 (the web) |
| Database | Only the web server, on the database port |
Each provider has its own: security groups on AWS, Network Security Groups on Azure, VPC firewall rules on Google Cloud and Network Security Groups on Oracle. The names and some details differ; the idea is the same.
Don't mix them up
Internet gateway × NAT
Both connect the network to the internet, and exams love to swap them. The question is who starts the conversation.
Internet gateway
“Do I want the internet to reach my server, and my server to reach the internet?”
- Example
- The store's web server, serving customers.
- Focus
- Inbound and outbound, for those with public addresses.
NAT
“Do I want the private server to reach the internet, without anyone outside reaching it?”
- Example
- The database downloading a security update.
- Focus
- Outbound only: whoever is inside starts the conversation, whoever is outside can't.
In practice
What goes where
| What you have | Where to put it |
|---|---|
| Site and API that customers access | Public subnet |
| Database and internal services | Private subnet |
| Private server that needs to download updates | Private subnet, with NAT |
| Office that accesses the cloud network securely | VPN over the internet, or a dedicated link |
The VPN creates an encrypted tunnel over the internet. The dedicated link is a reserved cable between the company and the provider, with more stability and a higher cost.
Key terms
Six terms to remember
Tap a card to see the definition.
Quick test
Three questions, exam style
01
A server in a private subnet needs to download updates from the internet, without receiving connections from outside. What should it use?
02
In which subnet should the database go, since only the web server needs to reach it?
03
A company wants to connect its office to the virtual network, with encrypted traffic, over the regular internet. What should it use?
The exam question about networks is usually the same: who needs to be reached from outside, and who doesn't? Those who need it go in a public subnet. The rest goes in a private subnet, protected by a firewall, and goes out through NAT when it needs to. That is what Isaac would do today, with the database far from the internet. The next step on the track is Cloud Costs.