AWS Certified Advanced Networking - Specialty Exam Guide

Advanced network security patterns

To achieve complete security at all OSI layers, we would need to implement a third-party device such as a next-generation firewall, IDS/IPS, or deep packet inspection device with a specially designed network architecture approach. We would either implement a subnet or a special VPC where the device (or cluster of devices) would be running, and then we would redirect all the traffic to the device(s) in the specially designed network.

The subnet approach is shown in the following diagram:

Essentially, the public subnet in the preceding diagram only hosts our network security device or devices. All the traffic ...