UXDL Docs
Security

Private Networking

Isolate workloads in private subnets with NAT Gateway egress.

Deploying applications and databases in public subnets exposes them directly to the internet and increases the attack surface. Production workloads are isolated within private subnets where they are inaccessible from external networks, while a NAT Gateway provides controlled outbound connectivity.

Objective

  • Prevent direct internet access to applications and databases.
  • Reduce the attack surface of production workloads.
  • Allow secure outbound internet connectivity from private resources.
  • Isolate critical workloads within private subnets.
  • Improve compliance with security and regulatory standards.

Security risk of public subnets

Deploying workloads in public subnets can result in:

  • Direct exposure to internet-based attacks.
  • Increased risk of unauthorized access.
  • Higher likelihood of exploitation through open ports.
  • Greater vulnerability to denial-of-service and scanning attacks.

Solution

The recommended architecture separates internet-facing components from workloads:

  • Public subnets host only internet-facing components — the Application Load Balancer (ALB) and NAT Gateway.
  • Private subnets host application servers (Amazon ECS, EC2, or EKS).
  • Private subnets host databases such as Amazon RDS or Aurora.
  • Internet access for private workloads is routed through the NAT Gateway.
  • Security Groups and Network ACLs restrict network access.

Application and database servers have no public IP addresses and cannot be reached directly from the internet.

Architecture

NAT Gateway traffic flow

  1. An application in a private subnet initiates a request to the internet or an AWS service.
  2. The route table directs the traffic to the NAT Gateway in a public subnet.
  3. The NAT Gateway replaces the source private IP with its Elastic IP (public IP).
  4. The request is sent to the destination.
  5. The response returns to the NAT Gateway.
  6. The NAT Gateway translates the destination back to the original private IP and forwards the response.

This enables outbound connectivity while preventing unsolicited inbound traffic.