Project 7 of 100: Zero Trust Network on AWS

Stop thinking in terms of "trusted" and "untrusted" networks. The old castle-and-moat security model is broken. It's time for a new approach: Zero Trust. In this tutorial, we build a production-grade Zero Trust network on AWS from scratch, enforcing the principle of "never trust, always verify." This is Project SEC-007, a hands-on lab aligned with the AWS Certified Security – Specialty exam. We will inspect EVERY packet of traffic—inbound, outbound, and even between your own VPCs (East-West traffic)—using a central, intelligent firewall. 🚀 WHAT YOU WILL LEARN • Hub-and-Spoke Network Design: Implement a scalable, centralized network topology using AWS Transit Gateway as a cloud router. • Centralized Traffic Inspection: Deploy AWS Network Firewall to inspect and filter all network traffic from a single point of control. • Stateful & Stateless Rule Groups: Create granular firewall rules, including a stateless group to block high-risk ports (SMB/RDP) and a stateful, Suricata-compatible group for an egress domain allow-list. • East-West Traffic Control (Micro-segmentation): Go beyond perimeter security by inspecting traffic moving between your application tiers. 🕒 Timestamps: 0:00 - Introduction 2:21 - The Architecture Walk-through 5:56 - VPCs 6:49 - Subnets 9:37 - Internet Gateway 10:27 - Transit Gateway 18:1 5 - Network Firewall 26:19 - VPC Route Tables 34:16 - Security Groups 37:21 - Cloudwatch 38:52 - Test EC2 Instance 44:40 - Cleanup 44:52 - Outro 🔗 Resources: • CloudGuard Portfolio: https://cloudguardportfolio.com • GitHub: https://github.com/sulemoore 🤝 Connect with Me: • LinkedIn:   / mosuleiman   🔔 SUPPORT THE CHANNEL If you found this video helpful, please consider: • Liking the video • Subscribing for more cloud & security content • Commenting with your questions or feedback! #AWS #ZeroTrust #CloudSecurity #Terraform #NetworkFirewall #AWSSecurity