Firewalls, and where to put them
summary
Compares concrete options: AWS WAF for HTTP Layer‑7 allow/block, rate limits, bot control and CloudFront edge deployment; AWS Network Firewall for L3–L7 DPI, Suricata rules and recent TLS inspection with one dedicated cluster per VPC (higher cost) versus Gateway Load Balancer sending traffic to shared third‑party appliances (GENEVE, shared cluster). Notes DNS filtering via Route 53 Resolver DNS Firewall, Firewall Manager for org‑wide policy, Workday migration path (cutover testing), ~140 firewalls on policy and only ~40–45% early adoption before shifting to distributed per‑VPC deployment.
AI-written summary · about
chapters (26)
- 0:00Intro
- 3:35Gateway Load Balancer (GWLB)
- 4:56AWS WAF provides L3 and L7 controls
- 10:01Network protection use cases
- 13:14Distributed vs. centralized deployments
- 14:44Should I centralize inbound?
- 16:30Distributed model - AWS WAF
- 19:21Sample web ACL - Simple inbound controls
- 21:13Blocking unwanted traffic at the edge
- 23:38Distributed models - Network Firewall & GWLB
- 26:41Gateway Load Balancer vs. Network Firewall
- 27:40Centralized models - Network Firewall & GWLB
- 29:03Ingress routing vs. more specific routing
- 31:07DNS is an additional outbound path in the default VPC config
- 31:53Amazon Route 53 DNS Firewall
- 32:50AWS Network Firewall & DNS Firewall deployment
- 35:04A leading provider of cloud-based enterprise applications for financial management, human resources, and analytics
- 35:29Workday infrastructure security engineering W
- 36:40Lessons from initial landing
- 37:29How do we want to improve?
- 39:33Option 1 - Amazon VPC traffic mirroring
- 40:38Option 2-Gateway Load Balancer
- 42:33New option -AWS Network Firewall
- 44:06Route table example- Centralized inspection VPC
- 45:44Changing to a distributed model
- 46:44Team-B use case
related talks
51mNetwork inspection design patterns that scale
44mElevando la postura de seguridad con AWS Network Firewall
50mAWS Well-Architected for network security
33mNetwork and application protection on AWS
29mWeb application protection on AWS
17mStrengthening security with DNS Firewall
51mProtect your internet-facing web applications hosted on AWS
31mProtecting Networks and Applications on AWS