Network Segmentation
Network SecurityNetwork Segmentation is the practice of dividing your network into smaller, isolated segments to limit an attacker's ability to move laterally after an initial compromise. In AWS, this is implemented through VPCs, subnets, security groups, and NACLs.
AWS Segmentation Strategies
- Multi-VPC: separate VPCs for production, staging, development
- Public/private subnets: internet-facing resources in public subnets, everything else in private
- Multi-account: separate AWS accounts per workload or environment (strongest isolation)
- Security groups: micro-segmentation at the instance level
- Transit Gateway: controlled routing between VPCs
Related AWS Services
Related Terms
An isolated virtual network within AWS where you launch resources, with full control over IP addressing, subnets, route tables, and network gateways.
A virtual firewall for EC2 instances and other resources that controls inbound and outbound traffic at the instance level using allow rules.
A security strategy using multiple layers of controls (network, identity, data, application) so that if one layer fails, others still protect the environment.
The scope of impact when a security incident occurs - how many resources, accounts, or users are affected. Smaller blast radius means better security posture.
Using multiple AWS accounts to isolate workloads, environments, and teams, providing the strongest security boundary available in AWS.
A security model where no user, device, or network is trusted by default - every access request is verified regardless of location, using identity-based policies and continuous validation.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.