Networking and DNS

The network decides what can reach what. A database with a public address or one open port undoes every other rule. These rules set the defaults for cloud networks, firewalls and DNS. Certificates, HTTPS settings and DNS signing for a website live in the hosting and network chapter.

Required

• Keep databases in private subnets

  Required

  Put every database, cache and queue in a private subnet with no public address. Only the app's own security group may reach it.

• Deny all traffic unless a rule allows it

  Required

  Start every security group and firewall from deny. Allow only named ports from named sources, and open a port to the whole internet only on the load balancer.

• Close admin ports to the internet

  Required

  Never open SSH, RDP, database or admin ports to the internet. Reach machines through an identity-aware tunnel or a private network that needs single sign-on.

• Force encryption on every managed service

  Required

  Configure every database, cache and bucket to refuse plain connections. Make every client check the server's certificate.

• Require tokens for the metadata service

  Required

  Make every cloud server's metadata service answer only requests that carry a session token. Allow the token to travel one network hop, or two when containers on the host need it.

• Keep DNS records in code

  Required

  Manage every DNS record of every domain in code, changed by pull request. Never edit a record in the provider's web panel.

Recommended

• Limit where servers can send traffic

  Recommended

  Let servers send traffic only to the hosts they need. Databases send none to the internet at all.

• Shorten the TTL before you move a record

  Recommended

  Before you point a name at a new server, shorten its TTL and wait one full old TTL. Restore the longer TTL after the move.