Lesson 4 of 10

Network Security in the Cloud

Cloud networking is fundamentally different from on-premises networking, and attackers exploit those differences. This lesson covers Virtual Private Clouds, security groups, network ACLs, and how to design a defense-in-depth network architecture in the cloud. You will learn how to detect and prevent common cloud network attacks including SSRF, metadata service exploitation, and lateral movement through misconfigured VPC peering.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4
In plain English

In simple terms: Design a secure VPC architecture with public and private subnets. This means building enough understanding that you can apply this concept in a real scenario — not just answer a quiz question about it, but actually use it when it matters. Focus on the "why" behind the concept, not just the "what."

Why this matters

This objective builds a foundational skill that every security professional uses regularly. Mastering it gives you the vocabulary, mental models, and practical ability to tackle more advanced topics with confidence — and to communicate clearly with both technical and non-technical colleagues.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Network Security in the Cloud · Objective 1 of 4

VIDEO
Loading video…
1

Audit security group rules

Find security groups with unrestricted inbound access (0.0.0.0/0) on sensitive ports.

aws ec2 describe-security-groups --filters Name=ip-permission.cidr,Values=0.0.0.0/0 --query "SecurityGroups[*].[GroupId,GroupName]" --output table
2

Check for public subnets with instances

Identify EC2 instances in public subnets that should be in private subnets.

aws ec2 describe-instances --query "Reservations[*].Instances[*].[InstanceId,PublicIpAddress,SubnetId]" --output table
3

Enable VPC Flow Logs

Enable flow logs for your VPC to capture all accepted and rejected traffic.

aws ec2 create-flow-logs --resource-type VPC --resource-ids vpc-xxxxxxxx --traffic-type ALL --log-destination-type cloud-watch-logs --log-group-name /aws/vpc/flowlogs
4

Enforce IMDSv2 on EC2 instances

Require IMDSv2 to block SSRF attacks targeting the instance metadata service.

aws ec2 modify-instance-metadata-options --instance-id i-xxxxxxxx --http-tokens required --http-endpoint enabled