Lesson 04 — Enterprise Network Security Architecture
Learning Path
☁️ Phase 02 – AWS Cloud Security
📘 Module 08 – Network Protection
🎯 Lesson Objective
Section titled “🎯 Lesson Objective”By the end of this lesson, you will be able to:
- Design enterprise AWS network security architectures.
- Understand multi-account networking.
- Build secure hub-and-spoke network topologies.
- Deploy an Inspection VPC.
- Secure traffic using AWS Transit Gateway.
- Apply Zero Trust Architecture.
- Design highly available enterprise network security.
📚 Lesson Information
Estimated Time: 3.5 Hours
Difficulty: Advanced
Prerequisites: Lesson 03 – AWS Network Firewall & AWS Firewall Manager
Hands-on Lab: Enterprise Architecture Design
💼 Business Scenario
Section titled “💼 Business Scenario”CloudNova Technologies has grown into a global organisation.
The company now operates across:
- 35 AWS Accounts
- 8 AWS Regions
- 15 Production Applications
- Shared Services
- Security Services
- Development Teams worldwide
Current infrastructure consists of:
- Production VPCs
- Development VPCs
- Shared Services VPC
- Logging VPC
- Security VPC
- Management VPC
Business requirements include:
- Secure connectivity between all VPCs.
- Centralised firewall inspection.
- Zero Trust communication.
- Centralised logging.
- Disaster recovery.
- High availability.
- Simplified network management.
The Chief Information Security Officer (CISO) asks:
“Can we design a network architecture that remains secure, scalable and manageable as the company continues to grow?”
As the Cloud Security Engineer, your responsibility is to design an enterprise network that supports business growth without compromising security.
Enterprise Network Challenges
Section titled “Enterprise Network Challenges”As cloud environments grow, new challenges emerge.
Examples include:
- Hundreds of VPCs
- Thousands of EC2 instances
- Multiple AWS accounts
- Hybrid connectivity
- Shared services
- Remote workforce
- Internet-facing applications
- Regulatory compliance
A flat network quickly becomes difficult to manage and secure.
Enterprise Design Principles
Section titled “Enterprise Design Principles”CloudNova follows these principles:
- Defence in Depth
- Zero Trust
- Least Privilege
- High Availability
- Centralised Inspection
- Secure by Default
- Infrastructure as Code
- Continuous Monitoring
These principles guide every network design decision.
Multi-Account Architecture
Section titled “Multi-Account Architecture”Rather than placing everything inside one AWS account, workloads are separated.
Example:
AWS Organizations
│
├── Management Account
├── Security Account
├── Shared Services Account
├── Production Account
├── Development Account
└── Sandbox AccountBenefits include:
- Better isolation
- Easier auditing
- Reduced blast radius
- Improved compliance
- Centralised governance
Hub-and-Spoke Network Design
Section titled “Hub-and-Spoke Network Design”Enterprise AWS environments commonly use a hub-and-spoke architecture.
Transit Gateway │ ────────────────┼──────────────── │ │ │ Production VPC Development VPC Shared Services │ │ │ └───────────────┼──────────────┘ │ Inspection VPCAdvantages:
- Simplified routing
- Centralised inspection
- Easier expansion
- Reduced complexity
AWS Transit Gateway
Section titled “AWS Transit Gateway”AWS Transit Gateway acts as the central networking hub.
Instead of creating hundreds of VPC peering connections, each VPC connects to the Transit Gateway.
Before
VPC ↔ VPC ↔ VPC ↔ VPC
Many Peering Connections
↓
After
Transit Gateway
↓
All VPCsBenefits:
- Central routing
- Simplified management
- Better scalability
- Easier security enforcement
Inspection VPC
Section titled “Inspection VPC”CloudNova performs deep inspection inside a dedicated Inspection VPC.
Example:
Internet
↓
AWS Shield
↓
Route53
↓
AWS WAF
↓
AWS Network Firewall
↓
Inspection VPC
↓
Transit Gateway
↓
Production VPCsAll traffic passes through security controls before reaching applications.
Shared Services VPC
Section titled “Shared Services VPC”Instead of deploying shared infrastructure in every account, CloudNova centralises common services.
Examples:
- Active Directory
- DNS
- Bastion Hosts
- Patch Servers
- Monitoring
- Logging
- CI/CD Services
Shared Services VPC
↓
DNS
↓
Logging
↓
Monitoring
↓
Identity ServicesThis reduces operational overhead and improves consistency.
Logging & Monitoring Architecture
Section titled “Logging & Monitoring Architecture”Every network component sends logs to a central logging platform.
CloudTrail
↓
VPC Flow Logs
↓
AWS Network Firewall Logs
↓
AWS WAF Logs
↓
CloudWatch
↓
Amazon S3
↓
Security Hub
↓
SOC TeamCentralised logging supports:
- Incident response
- Compliance
- Threat hunting
- Forensics
Zero Trust Networking
Section titled “Zero Trust Networking”CloudNova follows the principle:
Never Trust. Always Verify.
Every connection must be authenticated and authorised.
Examples:
- EC2 → Database
- Lambda → API
- Developer → Bastion Host
- Administrator → Production
Trust is never assumed.
Zero Trust Components
Section titled “Zero Trust Components”CloudNova implements:
- IAM Authentication
- IAM Roles
- Security Groups
- Network Firewall
- TLS Encryption
- MFA
- Device Validation
- Continuous Monitoring
Together, these controls reduce lateral movement within the environment.
High Availability Design
Section titled “High Availability Design”Enterprise architectures must survive failures.
CloudNova deploys:
- Multiple Availability Zones
- Multiple NAT Gateways
- Multi-AZ Load Balancers
- Redundant Firewalls
- Route 53 Health Checks
- Multi-Region Disaster Recovery
Availability is a core part of security.
Enterprise Reference Architecture
Section titled “Enterprise Reference Architecture” Internet │ AWS Shield │ Route53 │ AWS WAF │ Application Load Balancer │ Inspection VPC │ AWS Network Firewall │ Transit Gateway │ ┌───────────────┬───────────────┬───────────────┐ │ │ │ │ Production VPC Development VPC Shared Services Logging VPC │ │ │ │ └───────────────┴───────────────┴───────────────┘ │ Security Account │ CloudTrail / Config │ Security Hub / GuardDuty │ SOC AnalystsEnterprise Security Layers
Section titled “Enterprise Security Layers”| Layer | AWS Service |
|---|---|
| Identity | IAM |
| DNS | Amazon Route 53 |
| DDoS Protection | AWS Shield |
| Web Protection | AWS WAF |
| Network Inspection | AWS Network Firewall |
| Routing | Transit Gateway |
| Instance Security | Security Groups |
| Subnet Protection | Network ACLs |
| Monitoring | CloudTrail |
| Threat Detection | GuardDuty |
| Security Dashboard | Security Hub |
Every layer contributes to the overall security posture.
Enterprise Best Practices
Section titled “Enterprise Best Practices”CloudNova standards include:
- Separate workloads into dedicated AWS accounts.
- Use AWS Organizations for governance.
- Centralise network inspection.
- Route traffic through an Inspection VPC.
- Use Transit Gateway instead of complex VPC peering.
- Enable Zero Trust communication.
- Centralise logging and monitoring.
- Automate infrastructure using Infrastructure as Code.
- Regularly review architecture for security improvements.
🛠 Lab 01 — Design a Multi-Account Architecture
Section titled “🛠 Lab 01 — Design a Multi-Account Architecture”Design an AWS Organizations structure including:
- Management Account
- Security Account
- Shared Services Account
- Production Account
- Development Account
- Sandbox Account
Explain why each account exists.
🛠 Lab 02 — Design a Transit Gateway Network
Section titled “🛠 Lab 02 — Design a Transit Gateway Network”Create a diagram connecting:
- Production VPC
- Development VPC
- Shared Services VPC
- Inspection VPC
Ensure every VPC communicates through AWS Transit Gateway.
Document the traffic flow.
🛠 Lab 03 — Build an Inspection VPC Architecture
Section titled “🛠 Lab 03 — Build an Inspection VPC Architecture”Create an architecture that includes:
- AWS Network Firewall
- Firewall Subnets
- Transit Gateway
- Route Tables
- Security Groups
Explain how traffic is inspected before reaching workloads.
🛠 Lab 04 — Zero Trust Review
Section titled “🛠 Lab 04 — Zero Trust Review”Review the architecture.
For every connection, identify:
- Authentication method
- Authorisation mechanism
- Encryption method
- Logging service
- Monitoring service
Document how Zero Trust principles are applied.
🛠 Lab 05 — Architecture Review Workshop
Section titled “🛠 Lab 05 — Architecture Review Workshop”Act as the Cloud Security Architect.
Review your completed architecture against the following checklist:
| Requirement | Complete |
|---|---|
| Multi-Account Design | ☐ |
| Transit Gateway | ☐ |
| Inspection VPC | ☐ |
| AWS Network Firewall | ☐ |
| Zero Trust | ☐ |
| High Availability | ☐ |
| Central Logging | ☐ |
| Disaster Recovery | ☐ |
Prepare recommendations for improvement.
💻 AWS CLI Lab
Section titled “💻 AWS CLI Lab”List Transit Gateways
Section titled “List Transit Gateways”aws ec2 describe-transit-gatewaysList Transit Gateway Attachments
Section titled “List Transit Gateway Attachments”aws ec2 describe-transit-gateway-attachmentsDescribe Route Tables
Section titled “Describe Route Tables”aws ec2 describe-route-tablesList VPC Flow Logs
Section titled “List VPC Flow Logs”aws ec2 describe-flow-logsDescribe VPCs
Section titled “Describe VPCs”aws ec2 describe-vpcs✅ Verification
Section titled “✅ Verification”Verify that you can:
✔ Design a multi-account AWS architecture.
✔ Explain Transit Gateway.
✔ Explain an Inspection VPC.
✔ Describe Zero Trust networking.
✔ Explain enterprise traffic flow.
✔ Design secure hub-and-spoke architectures.
🔍 Troubleshooting
Section titled “🔍 Troubleshooting”Problem
Section titled “Problem”Traffic bypasses the Inspection VPC.
Verify:
- Transit Gateway route tables.
- VPC route tables.
- Firewall subnet routing.
- Firewall endpoint associations.
Problem
Section titled “Problem”Applications cannot communicate.
Review:
- Security Groups.
- Network ACLs.
- Firewall rules.
- Transit Gateway attachments.
Problem
Section titled “Problem”Architecture becomes difficult to manage.
Review:
- AWS account structure.
- Centralised services.
- Naming standards.
- Network segmentation.
🚫 Common Mistakes
Section titled “🚫 Common Mistakes”❌ Creating a flat network across all workloads.
❌ Using VPC peering for large enterprise environments instead of Transit Gateway.
❌ Deploying production and development workloads in the same account.
❌ Allowing workloads to bypass network inspection.
❌ Ignoring east-west traffic security.
❌ Failing to centralise logging and monitoring.
🧪 DIY Challenge
Section titled “🧪 DIY Challenge”CloudNova plans to expand into 10 AWS Regions while supporting multiple business units.
Design an enterprise network architecture that:
- Uses AWS Organizations for governance.
- Implements a hub-and-spoke topology with AWS Transit Gateway.
- Includes a dedicated Inspection VPC for traffic inspection.
- Applies Zero Trust networking principles.
- Centralises logging and monitoring.
- Supports disaster recovery and high availability.
- Minimises lateral movement between workloads.
Create an architecture diagram and explain how each AWS service contributes to the overall security posture.
📊 Knowledge Check
Section titled “📊 Knowledge Check”- Why do enterprise organisations use multiple AWS accounts?
- What problem does AWS Transit Gateway solve?
- What is an Inspection VPC?
- Why is hub-and-spoke architecture preferred in large AWS environments?
- How does Zero Trust improve network security?
- Why should logging be centralised?
- What are the benefits of using AWS Organizations?
- Why is high availability important in network design?
- How does an Inspection VPC improve security?
- How do all components work together to create a secure enterprise architecture?
💡 Key Takeaways
Section titled “💡 Key Takeaways”After completing this lesson, you should understand:
- Enterprise AWS environments rely on multi-account architectures to improve isolation, governance and scalability.
- AWS Transit Gateway simplifies connectivity by acting as a central routing hub for VPCs, VPNs and Direct Connect attachments.
- An Inspection VPC provides a dedicated location for deep packet inspection and centralised network security controls.
- Zero Trust networking requires authentication, authorisation and continuous verification for every connection, regardless of its origin.
- Combining AWS Organizations, Transit Gateway, AWS Network Firewall, centralised logging and layered security controls creates a resilient and scalable enterprise network architecture.
🚀 Next Lesson
Section titled “🚀 Next Lesson”➡️ Lesson 05 — Enterprise Network Protection Project & Module Review