Project Title AWS Cloud Security Architect:

Project Title

AWS Cloud Security Architect: EC2 & RDS Isolation

Project Description

Architected a zero-trust network topology isolating an AWS RDS database cluster within a private data tier. Engineered layered network controls and granular security groups to completely eliminate public exposure vectors.

Technical Breakdown (The Details)

Layered Defense-in-Depth: Designed a production-grade VPC partitioned into three distinct network tiers across multiple availability zones: a Public Presentation Subnet, a Private Application Subnet, and an Isolated Private Data Subnet.

Stateful Micro-Segmentation: Engineered fine-grained, stateful Security Groups enforcing the principle of least privilege:

SG-Web: Restricts inbound public internet traffic strictly to HTTPS (443) and HTTP (80).

SG-App: Isolates application servers by explicitly limiting inbound traffic to Port 8080, sourced solely from SG-Web.

SG-DB: Impregnates the data tier by allowing inbound MySQL traffic on Port 3306 strictly if sourced from SG-App, rejecting all other lateral network requests.

Stateless Network ACLs: Implemented network-level Access Control Lists (NACLs) as an orthogonal, stateless security firewall layer to restrict traffic at the subnet boundaries.

Total Data Tier Isolation: Stripped the Private Data Subnet of any Internet Gateway routing tables or public IP assignments, verifying that the database cluster has zero route access to or from the internet.