A private subnet is a cloud network segment without direct internet access. It is intended for services and other resources that should be reached internally rather than exposed to untrusted traffic. section 9.2 section 9.5
Use private subnets as the protected interior of a segmented network. Route inbound traffic through an internet-facing DMZ containing hardened components such as an API gateway, reverse proxy, load balancer, or WAF. Create explicit bridges between segments when communication is necessary. section 9.2
Public gateway, private services
Place a documented, tested API gateway in the DMZ and keep backend services in private subnets. A hardened bastion server can provide restricted access to internal APIs and databases, while internal or developing endpoints remain unavailable to ordinary internet traffic. section 9.2
Figure 9.10 The DMZ is a region of our network that is exposed to the internet. It’s good practice to channel inbound traffic through the DMZ and keep all our services in private subnets. The DMZ can include elements such as an API gateway and bastion server.
Use the topology diagram to trace internet traffic through the DMZ and toward services kept in private subnets. section 9.2
When reviewing a deployment, check that:
- Services that do not require internet exposure reside in private subnets without internet access. section 9.5
- Internet-facing traffic enters through hardened, controlled components in the DMZ. section 9.2
- Communication between isolated segments uses an intentional network bridge, and private access is restricted to approved origins. section 9.2
