A reverse proxy receives internet requests and forwards them to backend services on the clients’ behalf. It acts as a controlled gateway between untrusted traffic and internal systems. section 9.2
Place reverse proxies in a hardened DMZ rather than exposing application services directly. Keep backend services in private subnets and restrict communication between network segments. section 9.2
Use this deployment pattern to reduce exposure:
- Channel inbound traffic through the DMZ and the reverse proxy. section 9.2
- Keep internal APIs and other services in private subnets. section 9.2
- Restrict traffic between services with firewalls, access control lists, or security groups. section 9.2
- Replicate the configuration accurately across environments and audit infrastructure code. section 1.2.3
DMZ-to-backend request path
A client reaches the reverse proxy in the DMZ. The proxy forwards an approved request to an API in a private subnet, while unrelated internal endpoints remain inaccessible from the internet. section 9.2
Figure 9.10 The DMZ is a region of our network that is exposed to the internet. It’s good practice to channel inbound traffic through the DMZ and keep all our services in private subnets. The DMZ can include elements such as an API gateway and bastion server.
Use the network diagram to see how a DMZ channels inbound traffic while keeping services in private subnets. section 9.2
