Segmentation: north/south and east/west
Lesson 3 of 4 in Network Security Controls.
Segmentation questions on this exam almost always hinge on one vocabulary pair. North/south traffic crosses the boundary of your environment — a user reaching your application, your application reaching the internet. East/west traffic moves within it — web tier to application tier, one VPC to another, a compromised instance probing its neighbours.
The reason the distinction matters is that most environments are well defended north/south and wide open east/west. The edge has a WAF, a load balancer, TLS, a shield. Inside, everything is in the default security group and every subnet routes to every other. An attacker who lands on one host — through a vulnerable dependency, a stolen credential, an SSRF — then moves sideways with no control objecting.
So when a requirement says "prevent lateral movement", it is asking for east/west controls, and the exam expects you to reach for: per-tier security groups referencing each other (not CIDRs), isolated subnets with no route to an internet gateway, NAT for egress only where outbound access is genuinely needed, Transit Gateway route tables that deliberately do not connect spokes to each other, and Network Firewall in an inspection VPC when the traffic between segments must be inspected rather than merely permitted. When a requirement says "protect the application from internet attack", it is asking for north/south controls, and you are back at the edge module's answers.
| Tool | Separates | Reach for it when |
|---|---|---|
Per-tier security groups | ENI from ENI, by group membership | the requirement is "only the app tier may reach the database" — the default and best answer for east/west inside a VPC |
Isolated subnets | a subnet from the internet, by route table | "this data must have no path to the internet" — no internet-gateway route, no NAT route, VPC endpoints for the AWS APIs it needs |
NAT gateway | outbound from inbound | private resources need egress and must never be reachable from outside |
NACL deny rules | subnet from CIDR, regardless of security groups | you need a boundary an application team cannot edit away, or an explicit deny of one range |
Separate VPCs / accounts | blast radius, by construction | environments or tenants must not share a trust boundary — the strongest segmentation AWS offers |
VPC from VPC, by what you choose to propagate | a hub-and-spoke network where spokes must reach shared services but not each other — route-table isolation is the control | |
VPC peering | nothing, transitively | two VPCs genuinely need to talk. Peering is not transitive: A↔B and B↔C never gives A↔C, which is a segmentation property, not a limitation to work around |
segments from each other, with inspection | east/west traffic must be examined and logged, not merely permitted |
Two structural facts carry disproportionate exam weight.
Transit Gateway route tables are a segmentation tool, not just plumbing. A transit gateway can hold several route tables; each attachment is associated with one, and you choose which attachments propagate routes into which table. Give every spoke a route table containing only the shared-services and inspection attachments, and spokes cannot route to each other at all — no security group, no NACL, no firewall rule required, because there is no path. This is how a hub-and-spoke design expresses "every account reaches the shared logging VPC; no account reaches any other account".
VPC peering is not transitive, and that is useful. A peering connection joins exactly two VPCs. If A peers with B and B peers with C, traffic from A cannot reach C through B. People meet this as a frustration and reach for a transit gateway; a security engineer should also read it as a guarantee — a peered VPC cannot become a transit path by accident. (Also worth knowing: peering does not support edge-to-edge routing, so a peer cannot borrow your NAT gateway, VPN or Direct Connect connection either.)
Finally, design from the requirement. "PCI workloads must not share a network with anything else" is a separate VPC, probably a separate account. "The reporting service may read the database but must not be reachable from the internet" is a security group plus a private subnet. "Traffic between business units must be logged and inspected" is an inspection VPC. The exam rewards reading the requirement literally and choosing the narrowest control that satisfies it.
Key terms: East/west traffic (and north/south), Transit Gateway route table, Inspection VPC, VPC endpoint (PrivateLink)
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.