Network Security in the Cloud
Cloud networking is fundamentally different from on-premises networking, and attackers exploit those differences. This lesson covers Virtual Private Clouds, security groups, network ACLs, and how to design a defense-in-depth network architecture in the cloud. You will learn how to detect and prevent common cloud network attacks including SSRF, metadata service exploitation, and lateral movement through misconfigured VPC peering.
Learning Objectives — Deep Dive
Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.
Audit security group rules
Find security groups with unrestricted inbound access (0.0.0.0/0) on sensitive ports.
aws ec2 describe-security-groups --filters Name=ip-permission.cidr,Values=0.0.0.0/0 --query "SecurityGroups[*].[GroupId,GroupName]" --output tableCheck for public subnets with instances
Identify EC2 instances in public subnets that should be in private subnets.
aws ec2 describe-instances --query "Reservations[*].Instances[*].[InstanceId,PublicIpAddress,SubnetId]" --output tableEnable VPC Flow Logs
Enable flow logs for your VPC to capture all accepted and rejected traffic.
aws ec2 create-flow-logs --resource-type VPC --resource-ids vpc-xxxxxxxx --traffic-type ALL --log-destination-type cloud-watch-logs --log-group-name /aws/vpc/flowlogsEnforce IMDSv2 on EC2 instances
Require IMDSv2 to block SSRF attacks targeting the instance metadata service.
aws ec2 modify-instance-metadata-options --instance-id i-xxxxxxxx --http-tokens required --http-endpoint enabled