Networking

Our approach

The production network applies Zero Trust principles: communication across every boundary is identity-based, encrypted, and inspected. Traffic is never implicitly trusted — it is always routed through a hardened, auditable enforcement point. This page traces the path a request takes from the public Internet to a workload, and the controls applied at each hop.

The traffic path

A request crosses three enforcement layers before it reaches a pod: Cloudflare at the edge, the AWS Network Firewall, then an AWS load balancer fronting the private Kubernetes nodes.

Boundary protection and access control — traffic flows from Cloudflare through the AWS Network Firewall to the AWS Application Load Balancer, which routes to private Kubernetes nodes

flowchart TD
  subgraph Edge["Edge"]
    Internet(["Public Internet"])
    CF["Cloudflare WAF + CDN + DDoS"]
  end
  subgraph AWS["AWS"]
    NFW["Network Firewall — multi-AZ inspection"]
    ALB["Application Load Balancer — TLS termination"]
    EKS["Private Kubernetes nodes — EKS"]
  end
  Internet -->|"443 / TLS 1.2+"| CF
  CF -->|"443 / TLS Strict"| NFW
  NFW -->|"443 / TLS"| ALB
  ALB -->|443| EKS
  style EKS fill:#eff6ff,stroke:#2563eb,color:#172554

The full production network, including the multi-AZ inspection subnets and route tables, looks like this:

Platform Engineering AWS production network architecture — Cloudflare edge, AWS Network Firewall inspection subnets across two availability zones, application load balancers, and EC2/EKS instances in private subnets, with per-zone route tables

Boundary enforcement

Edge (Cloudflare)

All ingress is routed through Cloudflare, which provides the WAF, CDN, and DDoS mitigation. Only Cloudflare’s published IP ranges are allowed through the AWS Network Firewall, so there is no direct path from the public Internet to the platform. Cloudflare runs in “Full (Strict)” TLS mode, maintaining end-to-end encryption. This prevents attackers from bypassing WAF and DDoS protections by targeting the AWS origin directly.

Inspection (AWS Network Firewall)

The AWS Network Firewall runs in dedicated, multi-AZ inspection subnets for both inbound and outbound traffic. Network segmentation enforces distinct public, private, and firewall zones to minimize blast radius. This prevents a compromised resource in one zone from reaching workloads or data in another zone without crossing an explicit inspection point.

Internal routing

Private subnets have no direct Internet routes. Outbound traffic from workloads flows through NAT gateways and the firewall for inspection, and no implicit or transitive routing is permitted. This prevents a compromised workload from exfiltrating data or reaching a command-and-control server through an unmonitored path.

Encryption in transit

TLS 1.2+ is enforced end-to-end, from client → Cloudflare → ALB → EKS workloads. TLS termination occurs only at the ALB, inside the AWS trust boundary.
HSTS is configured at Cloudflare to prevent protocol downgrade or plaintext connections.

Identity and access enforcement

AWS IAM policies and Security Groups enforce least-privilege access across all layers.
The AWS Network Firewall and Security Groups permit only ports 80 and 443/TLS from Cloudflare’s egress IP ranges.

Boundary & ports summary

Each row is one boundary in the traffic path: read left-to-right to see what connects, which direction traffic flows, which port is open, how it is encrypted, and what enforces the rule.

Boundary	Direction	Port(s)	Encryption	Enforcement
Internet ↔ Cloudflare	Inbound	443	TLS 1.2+	Cloudflare WAF
Cloudflare ↔ AWS Network Firewall	Inbound	443	TLS Strict Mode	AWS Network Firewall
ALB ↔ EKS Ingress	Inbound	443	TLS	IAM + Security Groups
EKS ↔ Aurora/S3	East–West	443	TLS / KMS at rest	Private VPC Endpoint (AWS PrivateLink — traffic stays inside the VPC, never traversing the public Internet)
GitHub ↔ EKS Runners	Outbound	443	TLS OIDC	Self-hosted runner agent
Workloads ↔ Internet	Outbound	443	TLS	NAT + Firewall
Monitoring ↔ AWS Logs	Internal	443	TLS	AWS CloudWatch

Observability of the network

All boundary and flow logs are collected within the AWS accounts where they reside. VPC Flow Logs, CloudTrail, Network Firewall logs, and GuardDuty findings feed into AWS Security Hub for continuous monitoring and alerting — see Monitoring.

Where it’s enforced

Cloudflare WAF filters and rate-limits all ingress at the edge, with DDoS mitigation and “Full (Strict)” TLS.
AWS Network Firewall and Security Groups allow only ports 80/443 from Cloudflare’s published egress ranges, blocking any direct path from the public Internet; mesh/segmentation policies enforce the public/private/firewall zones.
Drift detection. Terraform and ArgoCD continuously reconcile the declared network configuration; any drift between declared and live state triggers a Drift Detection alert (see Monitoring), keeping the enforced topology in lockstep with Git.