Executive Overview
Modern cloud engineering requires more than deploying virtual machines: it demands zero-trust network boundaries, automated provisioning via Infrastructure as Code (IaC), and strict vulnerability management. During my tenure architecting cloud solutions for German tech organizations (including Humatects GmbH and private client platforms), I established end-to-end secure AWS foundations that balance high availability with defense-in-depth security.
In this case study, I outline the technical blueprint used to deploy containerized web services, IAM RBAC controls, VPN tunnels, and continuous deployment pipelines.
1. Network Topology & VPC Segmentation
To ensure maximum isolation between external user traffic and sensitive data tiers, we structured our AWS VPC across dual Availability Zones (AZs):
- Public Subnets: Host AWS CloudFront CDN distribution endpoints, Application Load Balancers (ALB), and Bastion hosts with strictly restricted ingress.
- Private Subnets: Contain web application backend containers (ASP.NET Core / Node.js) operating inside Docker orchestration.
- Database Subnets: Completely isolated, non-routable subnets hosting MongoDB / PostgreSQL clusters with automated snapshot backup regimes.
+-------------------------------------------------------+
| AWS CloudFront |
+-------------------------------------------------------+
|
v
+-------------------------------------------------------+
| Application Load Balancer |
+-------------------------------------------------------+
/ \
v v
+-----------------------+ +-----------------------+
| Public Subnet (AZ-1) | | Public Subnet (AZ-2) |
+-----------------------+ +-----------------------+
| |
v v
+-----------------------+ +-----------------------+
| Private Subnet (App) | | Private Subnet (App) |
| - Docker Containers | | - Docker Containers |
| - Keycloak JWT Auth | | - Keycloak JWT Auth |
+-----------------------+ +-----------------------+
| |
+----------------------+----------------------+
|
v
+-------------------------+
| Database Subnet (Data) |
| - MongoDB / PostgreSQL |
+-------------------------+
2. Identity & Access Management with Keycloak & JWT
Security token issuance and user identity federations were centralized using Keycloak running inside hardened Docker containers. Key technical highlights include:
- Short-lived Access Tokens: JWT tokens signed with RS256 algorithm with 15-minute expiration window.
- Refresh Token Rotation: Automatic token invalidation upon reuse detection to prevent replay attacks.
- Role-Based Access Control (RBAC): Fine-grained user claims mapping directly to API endpoints in ASP.NET Core services.
3. Infrastructure as Code (Terraform & Ansible)
All resources (from S3 bucket encryption policies to Route 53 DNS routing and Security Group rules) are provisioned strictly via Terraform.
# Security Group definition for App Instances
resource "aws_security_group" "app_sg" {
name = "production-app-sg"
description = "Restrict ingress strictly to ALB traffic"
vpc_id = aws_vpc.main.id
ingress {
description = "HTTPS from ALB"
from_port = 443
to_port = 443
protocol = "tcp"
security_groups = [aws_security_group.alb_sg.id]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
4. Security Hardening & VAPT Results
Prior to production launch, we executed full Vulnerability Assessment and Penetration Testing (VAPT):
- Network Layer: pfSense firewall rules and WireGuard/OpenVPN site-to-site tunnels were verified against brute-force and port scanning attacks.
- Application Layer: Container images were scanned continuously using Trivy in CI/CD pipelines to prevent zero-day package vulnerability deployment.
- Transport Layer: Enforced TLS 1.3 encryption across all public and inter-service HTTP communications.
Key Results
- 99.9% Uptime across 12 consecutive months.
- Zero high or critical severity vulnerabilities in final audit reports.
- Reduced environment spin-up time from 3 days to under 15 minutes via Terraform pipelines.