Beyond VPCs: The Hidden Layers of AWS Network Security

Muthuvelsanthakumar

4 min read

·

Nov 12, 2025

--

Listen

Share

Hands-On Defense — Terraform, CLI, and Best Practices

Now that we’ve explored the invisible walls, layered defenses, and packet pathways of AWS networking, let’s switch gears and build those protections like a security architect in the real world.

Because knowing what exists is knowledge — but knowing how to enforce it is mastery.

🧩 1. Building Network Firewalls in AWS

Let’s begin with AWS Network Firewall — the managed, stateful, scalable firewall service that integrates directly into your VPC’s routing layer.

🏗️ Terraform Example — Deploying AWS Network Firewall

resource "aws_networkfirewall_firewall_policy" "advanced_policy" {
  name = "advanced-policy"

  firewall_policy {
    stateless_default_actions  = ["aws:forward_to_sfe"]
    stateful_default_actions   = ["aws:drop_strict"]    stateful_rule_group_reference {
      resource_arn = aws_networkfirewall_rule_group.block_malicious.arn
    }
  }
}resource "aws_networkfirewall_rule_group" "block_malicious" {
  capacity = 100
  name     = "block-malicious"
  type     = "STATEFUL"  rule_group {
    rules_source {
      rules_string = <<EOF
alert tcp any any -> any 22 (msg:"SSH Access Detected"; sid:10001;)
drop tcp any any -> any 445 (msg:"Block SMB Traffic"; sid:10002;)
EOF
    }
  }
}resource "aws_networkfirewall_firewall" "main_firewall" {
  name                = "main-firewall"
  firewall_policy_arn = aws_networkfirewall_firewall_policy.advanced_policy.arn
  vpc_id              = aws_vpc.main.id
  subnet_mapping {
    subnet_id = aws_subnet.firewall_subnet.id
  }
}

🔹 What this does:

• Deploys a stateful inspection firewall into your VPC.
• Drops SMB traffic and alerts for SSH connections.
• Integrates with your subnet routing for inline filtering.

🧠 Why it matters:
Instead of relying solely on Security Groups (instance-level) or NACLs (subnet-level), this sits in-path at the VPC edge, ideal for east–west traffic inspection.

⚙️ 2. Enforcing Security Groups via AWS CLI

Let’s say you need to harden EC2 instances inside your private subnet with minimal allowed traffic.

Example — Security Group Commands

# Create a security group
aws ec2 create-security-group \
  --group-name web-tier-sg \
  --description "Web tier security group" \
  --vpc-id vpc-0abcd1234

# Allow inbound HTTPS and SSH from bastion only
aws ec2 authorize-security-group-ingress \
  --group-name web-tier-sg \
  --protocol tcp --port 443 \
  --cidr 0.0.0.0/0aws ec2 authorize-security-group-ingress \
  --group-name web-tier-sg \
  --protocol tcp --port 22 \
  --source-group sg-0bastion123

🔹 Best Practice:
Use bastion security groups or AWS SSM Session Manager to avoid exposing port 22 to the internet.
Never open SSH globally — it’s like keeping your front door open and trusting the neighborhood.

🛡️ 3. Combining GuardDuty + VPC Flow Logs + Firewall Logs

Here’s where visibility turns into power.
AWS Network Firewall logs + VPC Flow Logs + GuardDuty findings = 360° Network Threat Monitoring.

Architecture Diagram (for Medium)

(Insert diagram showing data flow: EC2 → VPC → Firewall → Flow Logs → CloudWatch → GuardDuty → Security Hub)

Pipeline Flow:

1. Traffic passes through the firewall and VPC.
2. Logs stream to CloudWatch Logs or S3.
3. GuardDuty analyses anomalies & malicious IPs.
4. Security Hub aggregates and prioritizes alerts.

🔍 Tamil analogy:
Think of it like Chennai traffic police (GuardDuty) monitoring CCTV feeds (VPC Flow Logs) from every junction (subnet) — instant alerts for suspicious vehicle movements (malicious packets).

🔐 4. Layered Hardening Checklist

Here’s your AWS Network Security Golden Rulebook as a Cloud Security Engineer:

LayerControlBest PracticeVPCCIDR DesignNon-overlapping, regional segmentationSubnetsPublic/Private separationRoute public only through NAT/ALBNACLsStateless filteringDeny by default, minimal allow listSecurity GroupsInstance-levelRestrict inbound/outbound preciselyNetwork FirewallStateful inspectionBlock SMB/RDP/FTP, allow HTTPSGuardDutyContinuous detectionEnable organization-wideSecurity HubCentral managementUnify all alerts + automate remediationIAMAccess controlPrinciple of least privilegeWAFLayer 7 defenseProtect APIs and CloudFront endpointsEncryptionAt rest & in transitUse KMS + TLS 1.2+

🧰 5. Terraform + Security Automation Blueprint

In production, you’ll integrate Terraform modules + AWS Config rules + Security Hub automation.

Example snippet for compliance automation:

resource "aws_config_config_rule" "restricted_ssh" {
  name = "restricted-ssh"
  source {
    owner             = "AWS"
    source_identifier = "INCOMING_SSH_DISABLED"
  }
}

Then connect this to AWS Security Hub → Lambda → Slack webhook for auto-notifications.

🚀 6. The Real-World Deployment Flow

Let’s tie it all together as an AWS Security Engineer would:

1. Design: Split VPCs per environment — Dev, Test, Prod.
2. Deploy: Use Terraform modules for SGs, Firewalls, and IAM roles.
3. Detect: Enable VPC Flow Logs + GuardDuty.
4. Defend: Tune firewall rules and apply WAF policies.
5. Document: Centralize compliance posture in Security Hub.
6. Drill: Run attack simulations (via GuardDuty test events or custom red team scripts).

🧠 Remember: AWS doesn’t secure your workloads — you do.
AWS provides the walls, but you decide how tall and how thick they are.

🏁 Conclusion — The Security Architect’s Lens

Modern AWS networking isn’t just about subnets and CIDRs anymore.
It’s about visibility, enforcement, and adaptability — your ability to design security that evolves with cloud threats.

“Security isn’t a destination; it’s a continuous negotiation between trust and verification.”

By combining:

• AWS Network Firewall
• VPC Flow Logs + GuardDuty
• Terraform-driven enforcement
• Principle of least privilege across all layers

You’ve built a resilient, auditable, and scalable network defense architecture — one that reflects true AWS community builder craftsmanship.

✍️ Suggested Medium Ending Block

🧠 About the Author:
Muthuvel A S is an AWS Community Builder specializing in Cloud and Cybersecurity. He focuses on designing secure, scalable architectures and educating the next generation of cloud defenders.
Follow for deep dives into AWS Security, Automation, and Cloud Defense Blueprints.