One public entry point
The Application Load Balancer sits in public subnets.
CloudSec-Lab
Define the boundary. Codify the control.
An AWS lab built around private networking, scoped identity and reviewable infrastructure.
Public entry / ALBPrivate compute
ARCHITECTURE STUDY · ILLUSTRATIVE
Public entry. Private compute.
Reconstructed architecture decision from the repository documentation; not a deployed environment.
Reference the source
Application security groups accept traffic from the ALB security group, rather than a broad public range.
Remove direct entry
Optional EC2 instances use private subnets, no public IP and no inbound SSH. Compute and NAT are disabled by default.
The boundary is expressed in infrastructure code, so a reviewer can inspect who can reach the application before deployment.
Read the source ↗01 / The question
Cloud security depends on how networking, identity and visibility fit together. How can those decisions be made explicit, reproducible and easy to review?
02 / Project contribution
A portfolio lab combining modular Terraform infrastructure with a small FastAPI application, hardened Docker configuration and automated security validation workflows.
03 / Inside the implementation01 02 03
Separate public and private
A public ALB fronts optional application instances in private subnets. Security-group references restrict backend access; there is no public instance IP or SSH ingress.
Scope identity and preserve evidence
IAM roles, IMDSv2 and branch-bound OIDC trust are paired with CloudTrail, an encrypted private S3 audit bucket, CloudWatch and configurable GuardDuty.
Validate before deployment
Terraform validation, IaC and secret scanning, application checks and container scanning are documented as separate CI gates. Compute and NAT are disabled by default.
04 / Scope & lessons
An educational lab, with no verified production deployment. HTTPS, VPC endpoints and a deliberately scoped deployment policy remain future work. AWS resources incur costs; CI validation does not deploy them. Private compute also needs a controlled software-delivery path.