Zero Trust
Architecture & DesignZero Trust is a security model based on the principle "never trust, always verify." Unlike traditional perimeter-based security (inside the network = trusted), Zero Trust treats every access request as potentially hostile, regardless of where it comes from.
Zero Trust Principles
- Verify explicitly - authenticate and authorize based on all available data points
- Use least-privilege access - just-in-time and just-enough-access
- Assume breach - minimize blast radius and segment access
AWS Zero Trust Services
- AWS Verified Access: application-level access without VPN
- IAM: identity-based policies with conditions
- VPC Endpoints: private connectivity without internet
- PrivateLink: service-to-service without public exposure
Related Terms
The security principle of granting only the minimum permissions needed to perform a task - no more, no less.
A security strategy using multiple layers of controls (network, identity, data, application) so that if one layer fails, others still protect the environment.
Dividing a network into isolated segments (subnets, VPCs) to limit lateral movement and contain the blast radius of a security breach.
The process of allowing external identities (corporate directory, social providers) to access AWS resources without creating IAM users, using SAML, OIDC, or IAM Identity Center.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.