Design Secure Workloads and Applications (Task 1.2)

Design Secure Workloads and Applications

Source: https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/design_secure_workloads.html

Workload security is layered: network placement (subnets), network rules (SG chains), the edge stack (Route 53 + CloudFront + WAF + Shield), application identity (Cognito), and secrets handling. The exam gives you a leaked-credential or breached-app scenario and asks which layer was missing.

VPC Security Architecture

Brief: Segment by tier — public (ALB/NAT only), private (compute), isolated (data) — and chain security groups tier-to-tier.

How it works: The SG-referencing chain (alb-sg → web-sg → db-sg) makes membership the credential: an instance in the app tier can reach the database BECAUSE it carries app-sg, not because its IP was allowlisted. Scaling from 4 to 40 instances needs zero rule changes — the chain enforces least privilege at network level, automatically. NACLs add a stateless, subnet-wide layer for explicitly blocking known-bad ranges.

Real use-case: An attacker discovers a private app instance's IP through a misconfigured DNS record and tries to reach it directly from the internet — no route exists (private subnet), and even from inside the VPC, only ALB-originating traffic passes the SG chain. Defense held at two independent layers.

Gotchas & interview notes: SSH to instances is the classic anti-pattern — Systems Manager Session Manager gives shell access over the SSM agent with CloudTrail logging and NO open port 22. Every 0.0.0.0/0 rule should be questioned; the only defensible ones are 80/443 on the public ALB.

Threat Vectors External to AWS

How the edge stack works together: Route 53 answers DNS with health-checked endpoints (surviving control-plane DDoS); CloudFront absorbs volumetric floods at 400+ PoPs (attack traffic hits edge capacity, not your origin); WAF filters layer-7 attacks (rate rules, managed rule groups); Shield Standard handles L3/L4 automatically, and Advanced adds the DDoS Response Team writing custom mitigations during live attacks. The layers are complementary — no single service "stops DDoS."

Real use-case: A launch-day app gets a 500 Gbps UDP flood plus a layer-7 flood of expensive search requests. The UDP flood dies at CloudFront/Shield edge; the search flood trips a WAF rate-based rule (3,000 req/5 min per IP) and gets blocked. Origin servers never exceed 30% CPU — the attack cost the attacker more than the victim.

Gotchas & interview notes: exam wording "most cost-effective mitigation against application-layer attacks" → WAF; "24/7 DDoS response team" → Shield Advanced; "absorb attacks closer to users" → CloudFront. SQL injection inside HTTPS bodies requires WAF (L7) — SGs/NACLs cannot see it.

Application-Level Security

Amazon Cognito — identity for YOUR users

Brief: Cognito manages your application's END USERS (customers), who are not IAM users: user pools handle sign-up/sign-in (MFA, social/OIDC federation, adaptive auth) and issue JWTs; identity pools exchange those JWTs for temporary, scoped STS credentials to call AWS services directly.

How it works: The user pool is a managed directory + token service: sign-in returns ID/access/refresh tokens (JWTs) your API Gateway or ALB validates. The identity pool maps authenticated users to an IAM role (scoped, e.g., "write only to s3://uploads/userid/"). Users get temporary credentials — no permanent keys shipped to browsers or phones.

Real use-case: A mobile app lets users upload profile photos straight to S3: the user signs in via the user pool, the identity pool mints credentials allowing s3:PutObject ONLY to s3://uploads/${cognito-identity.amazonaws.com:sub}/*. Uploads bypass your servers entirely, and one user physically cannot write into another user's prefix.

Gotchas & interview notes: "application users, not IAM users" → Cognito, always. User pool = authentication (who); identity pool = AWS credentials (what they may touch). JWT validation happens at API Gateway/ALB — your Lambda runs after authentication.

Secrets management

• AWS Secrets Manager for DB credentials/API keys with automatic rotation (Lambda-driven, RDS-native support) — the answer to "hardcoded password in Lambda environment variable" scenarios
• AWS Systems Manager Parameter Store (SecureString) for cheaper config secrets when rotation is not needed
• Workloads FETCH secrets at boot with roles — the secret never lives in code, images, or env files in git
• Amazon GuardDuty = continuous threat detection on CloudTrail/DNS/VPC Flow Logs (compromised EC2, crypto-mining, unusual console logins)
• Amazon Macie = ML discovery of sensitive data (PII) in S3
• AWS Security Hub aggregates findings; Amazon Detective builds the investigation graph (who did what, from where, over what resources)
• Site-to-Site VPN — encrypted over internet; Direct Connect — private circuit; commonly combined (DX primary + VPN failover)
• VPC endpoints (Gateway for S3/DynamoDB — free; Interface/PrivateLink for other services) keep traffic to AWS services ON the AWS network — never traversing the internet
• TLS everywhere in transit: ACM certificates on ALB/CloudFront; enforce HTTPS redirects
• Edge: Route 53 (latency routing) → CloudFront with ACM cert → WAF (Common Rule Set + rate-based rule 2,000 req/5 min per IP) → Shield Standard; Shield Advanced during product launches
• Compute: ALB in public subnets of 3 AZs; ECS Fargate tasks in private subnets; SG chains (alb-sg → tasks-sg)
• Users: Cognito user pool (MFA optional, social sign-in) issues JWTs; API Gateway authorizes per-route
• Data: Aurora in isolated subnets; master password in Secrets Manager with 30-day rotation; task role grants only secretsmanager:GetSecretValue on that one ARN
• Detection: GuardDuty on; Security Hub CIS checks; Macie scans uploads bucket for accidental PII
• Hybrid: partner traffic arrives over a Direct Connect with a VPN failover

Real use-case: A leaked application repo contains no usable credentials: the DB password was in Secrets Manager (rotated 4 days ago), the API keys in Parameter Store SecureString, and the app authenticated as a task role. The breach was embarrassing, not expensive.

Detection layer

• AWS Secrets Manager for DB credentials/API keys with automatic rotation (Lambda-driven, RDS-native support) — the answer to "hardcoded password in Lambda environment variable" scenarios
• AWS Systems Manager Parameter Store (SecureString) for cheaper config secrets when rotation is not needed
• Workloads FETCH secrets at boot with roles — the secret never lives in code, images, or env files in git
• Amazon GuardDuty = continuous threat detection on CloudTrail/DNS/VPC Flow Logs (compromised EC2, crypto-mining, unusual console logins)
• Amazon Macie = ML discovery of sensitive data (PII) in S3
• AWS Security Hub aggregates findings; Amazon Detective builds the investigation graph (who did what, from where, over what resources)
• Site-to-Site VPN — encrypted over internet; Direct Connect — private circuit; commonly combined (DX primary + VPN failover)
• VPC endpoints (Gateway for S3/DynamoDB — free; Interface/PrivateLink for other services) keep traffic to AWS services ON the AWS network — never traversing the internet
• TLS everywhere in transit: ACM certificates on ALB/CloudFront; enforce HTTPS redirects
• Edge: Route 53 (latency routing) → CloudFront with ACM cert → WAF (Common Rule Set + rate-based rule 2,000 req/5 min per IP) → Shield Standard; Shield Advanced during product launches
• Compute: ALB in public subnets of 3 AZs; ECS Fargate tasks in private subnets; SG chains (alb-sg → tasks-sg)
• Users: Cognito user pool (MFA optional, social sign-in) issues JWTs; API Gateway authorizes per-route
• Data: Aurora in isolated subnets; master password in Secrets Manager with 30-day rotation; task role grants only secretsmanager:GetSecretValue on that one ARN
• Detection: GuardDuty on; Security Hub CIS checks; Macie scans uploads bucket for accidental PII
• Hybrid: partner traffic arrives over a Direct Connect with a VPN failover

Securing Connections To/From AWS

• AWS Secrets Manager for DB credentials/API keys with automatic rotation (Lambda-driven, RDS-native support) — the answer to "hardcoded password in Lambda environment variable" scenarios
• AWS Systems Manager Parameter Store (SecureString) for cheaper config secrets when rotation is not needed
• Workloads FETCH secrets at boot with roles — the secret never lives in code, images, or env files in git
• Amazon GuardDuty = continuous threat detection on CloudTrail/DNS/VPC Flow Logs (compromised EC2, crypto-mining, unusual console logins)
• Amazon Macie = ML discovery of sensitive data (PII) in S3
• AWS Security Hub aggregates findings; Amazon Detective builds the investigation graph (who did what, from where, over what resources)
• Site-to-Site VPN — encrypted over internet; Direct Connect — private circuit; commonly combined (DX primary + VPN failover)
• VPC endpoints (Gateway for S3/DynamoDB — free; Interface/PrivateLink for other services) keep traffic to AWS services ON the AWS network — never traversing the internet
• TLS everywhere in transit: ACM certificates on ALB/CloudFront; enforce HTTPS redirects
• Edge: Route 53 (latency routing) → CloudFront with ACM cert → WAF (Common Rule Set + rate-based rule 2,000 req/5 min per IP) → Shield Standard; Shield Advanced during product launches
• Compute: ALB in public subnets of 3 AZs; ECS Fargate tasks in private subnets; SG chains (alb-sg → tasks-sg)
• Users: Cognito user pool (MFA optional, social sign-in) issues JWTs; API Gateway authorizes per-route
• Data: Aurora in isolated subnets; master password in Secrets Manager with 30-day rotation; task role grants only secretsmanager:GetSecretValue on that one ARN
• Detection: GuardDuty on; Security Hub CIS checks; Macie scans uploads bucket for accidental PII
• Hybrid: partner traffic arrives over a Direct Connect with a VPN failover

Gotchas & interview notes: "traffic to S3 must not traverse the internet" → gateway endpoint (free, route-table based); "connect to a SaaS partner service privately" → PrivateLink interface endpoint. Direct Connect is private but not encrypted by default — add MACsec/IPsec for regulated traffic.

Worked Example: Public SaaS Application

• AWS Secrets Manager for DB credentials/API keys with automatic rotation (Lambda-driven, RDS-native support) — the answer to "hardcoded password in Lambda environment variable" scenarios
• AWS Systems Manager Parameter Store (SecureString) for cheaper config secrets when rotation is not needed
• Workloads FETCH secrets at boot with roles — the secret never lives in code, images, or env files in git
• Amazon GuardDuty = continuous threat detection on CloudTrail/DNS/VPC Flow Logs (compromised EC2, crypto-mining, unusual console logins)
• Amazon Macie = ML discovery of sensitive data (PII) in S3
• AWS Security Hub aggregates findings; Amazon Detective builds the investigation graph (who did what, from where, over what resources)
• Site-to-Site VPN — encrypted over internet; Direct Connect — private circuit; commonly combined (DX primary + VPN failover)
• VPC endpoints (Gateway for S3/DynamoDB — free; Interface/PrivateLink for other services) keep traffic to AWS services ON the AWS network — never traversing the internet
• TLS everywhere in transit: ACM certificates on ALB/CloudFront; enforce HTTPS redirects
• Edge: Route 53 (latency routing) → CloudFront with ACM cert → WAF (Common Rule Set + rate-based rule 2,000 req/5 min per IP) → Shield Standard; Shield Advanced during product launches
• Compute: ALB in public subnets of 3 AZs; ECS Fargate tasks in private subnets; SG chains (alb-sg → tasks-sg)
• Users: Cognito user pool (MFA optional, social sign-in) issues JWTs; API Gateway authorizes per-route
• Data: Aurora in isolated subnets; master password in Secrets Manager with 30-day rotation; task role grants only secretsmanager:GetSecretValue on that one ARN
• Detection: GuardDuty on; Security Hub CIS checks; Macie scans uploads bucket for accidental PII
• Hybrid: partner traffic arrives over a Direct Connect with a VPN failover

Every layer answers a different attack: the edge stack absorbs floods, the SG chain contains lateral movement, Cognito gates application access, secrets rotation limits credential replay, and detection closes the loop when something still slips through.