Security Upgrade for the Cloud: Successful Implementation of AWS Private Links

Challenge:

Our customer was faced with the challenge of providing access from the Internet at a central point within their production AWS account environments, analyzing incoming traffic through web application firewall rules, and then routing the access requests to the backend systems that are exclusively hosted in a private Virtual Private Cloud (VPC).

Solution & Architecture:

Working closely with our customer, we developed a solution to overcome these challenges. The implementation involved setting up dedicated firewall and Internet access VPCs to decouple incoming Internet access from the production backend systems.

Incoming requests are then routed through the external application load balancer to the processing backend systems in the private network environments via the implementation of AWS Private Links.

AWS Private Links are defined by two components. First, the AWS endpoint. This is a network interface on a defined subnet of the firewall VPC. AWS security groups are used to define which communication ports, in our case port 443, are accepted. The source is the web application firewall in the firewall VPC.

The second component is the associated VPC Endpoint Service. This provides a unique communication relationship to an AWS service within AWS accounts and/or across accounts.

In our scenario, we are addressing the AWS Network Loadbalancer in the private networks and across accounts. The big advantage of this solution is that the communication relationships are mapped on the application layer (layer 7) and not on the protocol transport layer (layer 4), which always requires a 1-to-1 routing connection.