There’s an old principle in strategy that applies as cleanly to cloud architecture as it does to combat: “The battle is often decided before the first move is made.”
In AWS, that decision is infrastructure security. Not firewalls alone. Not encryption alone. Not identity alone.
Infrastructure security is about where you place systems, how they connect, and what paths are intentionally left open, or closed, long before an attacker arrives.
If Detection is awareness, and Incident Response is discipline, then Infrastructure Security is terrain. And AWS cares deeply about terrain.
1. AWS’s Philosophy of Infrastructure Security
AWS assumes three things that shape every exam question in this domain:
- Networks are software-defined, not physical perimeters
- Segmentation beats fortification
- Blast radius matters more than absolute prevention
This is why AWS infrastructure security is built around:
- isolation
- segmentation
- least connectivity
- explicit network paths
- and controlled exposure
If an answer choice tries to “lock everything down globally,” it’s usually wrong. AWS prefers intentional exposure over accidental openness.
2. The Core Infrastructure Security Pillars
Infrastructure security questions almost always reduce to one (or more) of these pillars:
- Network isolation
- Traffic control
- Private connectivity
- Service exposure boundaries
- DDoS resilience
If you can identify which pillar is being tested, the correct answer becomes obvious.
3. VPC Design: Isolation Is the Default
At the heart of AWS infrastructure security is the VPC.
Exam truth: If a resource doesn’t need to be public, it shouldn’t be.
High-yield concepts:
- Private subnets for most workloads
- Public subnets only for controlled ingress/egress
- NAT Gateways for outbound-only access
- No direct internet exposure—ever—unless required
Exam mental model: Public access is a deliberate exception, not the baseline.
4. Security Groups vs. NACLs – This Still Trips People Up
AWS loves testing this distinction.
Security Groups
- Stateful
- Instance-level
- Allow rules only
- Primary enforcement point
Network ACLs
- Stateless
- Subnet-level
- Allow and deny rules
- Coarse-grained control
Exam shortcut: If the question is about precise control, use Security Groups. If it’s about broad subnet filtering, use NACLs. If both appear as options, AWS usually wants Security Groups.
5. Controlling Traffic Paths, Not Just Blocking Traffic
Infrastructure security isn’t just about denial; it’s about routing intentionally.
Key services:
- VPC Route Tables
- Internet Gateways
- NAT Gateways
- VPC Endpoints (Gateway & Interface)
High-yield exam concept:
If AWS services should be accessed without traversing the internet, the answer is almost always: VPC Endpoints
This shows up constantly for:
- S3
- DynamoDB
- KMS
- Secrets Manager
- Systems Manager
Mental model: Private traffic beats filtered public traffic every time.
6. Load Balancing and Exposure Control
AWS does not expect you to expose instances directly.
Instead:
- ALB for HTTP/HTTPS
- NLB for high-performance TCP/UDP
- Internal load balancers for private services
Exam rule:
If traffic needs inspection or TLS termination → ALB
If performance and static IPs matter → NLB
Direct instance exposure is almost always a wrong answer.
7. DDoS Protection: Built-In, Not Bolted On
AWS assumes you will be targeted.
Infrastructure security includes:
- AWS Shield Standard (always on)
- AWS Shield Advanced (for high-risk workloads)
- CloudFront + WAF for edge protection
Exam pattern: If the question involves:
- volumetric attacks
- Layer 7 threats
- global availability
The answer usually includes:
CloudFront
AWS WAF
Shield
Defense through scale is a core AWS advantage.
8. The Exam Patterns That Matter
Pattern #1 Reduce Blast Radius
Choose:
- smaller subnets
- separate VPCs
- multiple accounts
Over:
- one massive flat network
Pattern #2 Prefer Private Connectivity
VPC endpoints beat:
- public endpoints
- IP whitelisting
- internet gateways
Pattern #3 Use Managed Services When Possible
AWS prefers:
- managed load balancers
- managed DDoS protection
- managed routing
Less custom = less risk.
9. The Martial Parallel: Choosing the Ground
In strategy, you don’t fight everywhere.
You choose:
- narrow paths
- defensible positions
- terrain that limits your opponent’s options
Infrastructure security does the same thing. A flat network invites chaos. A segmented network channels behavior. Attackers aren’t always stopped; they’re contained. And containment wins.
For example, a major breach in 2019 exploited a flat network without segmentation, allowing attackers to move laterally across dozens of workloads. Had strict subnetting and NACLs been in place, the impact would have been far smaller.
10. Closing: Architecture Is the First Defense
Infrastructure security is quiet.
When it’s done right:
- nothing dramatic happens
- nothing breaks
- nothing escalates
But when it’s wrong, no amount of detection or response can save you.
AWS rewards architects who:
- think in boundaries
- design for failure
- assume compromise
- and limit consequences
CIS Control 13 and NIST CSF both emphasize network segmentation and limiting exposure as foundational security practices.
A frequent pitfall is relying solely on Security Groups for segmentation, especially in environments with compliance or subnet-level boundary requirements, and overlooking the value of NACLs for coarse-grained, subnet-level protection. In layered security, redundancy is a strength. And with the VPC Reachability Analyzer, AWS now makes it easier than ever to verify and audit your network paths.
As AWS’s Well-Architected Framework advises: “Apply security at all layers.” These principles echo patterns are seen in AWS re:Invent security keynotes and in major cloud breach postmortems.
Security without pessimism continues here.
Not by building walls everywhere but by choosing the right ground and holding it calmly.
In AWS, as in strategy, victory belongs to those who shape the ground before the battle begins.
Remember, cloud security evolves quickly; architects who regularly review new AWS features and industry breach lessons maintain the sharpest edge. But for the exam, stay focused on what’s covered in the content outline provided by AWS for the exam. After you pass, you can ad lib. Until then, stay focused on the material that AWS expressly states is covered on the exam.
Matt Shannon, Security Pro 