Cloud Networking and Security: A Simple Practical Guide

Your app can be healthy and still fail for users. A wrong network rule can block it. A wide rule can expose it. This guide follows a request from a browser to an app and explains the checks in plain language.

Follow one web request

1. You enter a name such as example.com. DNS finds the address for that name.
2. The browser makes an HTTPS connection. TLS protects data while it travels and helps the browser check the server's identity.
3. A load balancer accepts the request and sends it to a healthy app instance.
4. The app may read a database through a private connection.
5. The app sends a response. Logs and metrics help you check what happened.

DNS is like an address book. It does not serve your web page. A TLS certificate does not prove that the business is honest; it supports a secure connection to the name it covers.

Network words you need

A VPC in AWS is a private network area in your cloud account. A subnet is a smaller range of addresses inside it. Azure and Google Cloud have similar ideas, but their names, scope and rules differ.

A route says where to send traffic for a destination. An AWS public subnet has a route to an internet gateway. That route alone does not make every machine reachable: the machine also needs a suitable public address and rules that allow the traffic. A private subnet has no direct route to that gateway. A NAT gateway can give private machines an outbound path, and it has a cost.

A port identifies a service on a machine. HTTPS often uses 443. A database has a different port. Opening a port does not install a service, and a running service may listen only on a local address.

Put each part in the right place

For a small web app, put the public entry point at the edge. Keep the app and database behind it where practical. Allow the app to reach the database on the required port. Do not open the database to the whole internet just to make a connection work.

A layer 4 load balancer works mainly with network connections. A layer 7 load balancer understands HTTP details such as paths and host names. Choose from your app's needs, including TLS, timeouts and cost. More layers do not always make an app better.

Understand the main AWS rules

A security group filters traffic for attached resources. It is stateful: return traffic for an allowed connection is tracked. A network ACL filters traffic at subnet boundaries and is stateless: return traffic needs appropriate rules too. They are different controls, so copying the same rule into both may not solve a problem.

Start with the smallest access an app needs. For example, allow the load balancer to reach the app, and the app to reach the database. Review outbound access too. Use a managed access method for administration where possible instead of opening remote access to everyone.

Check the local teaching app

Start the app from the Docker lesson. It publishes port 8085 only on your computer's loopback address.

curl -i http://127.0.0.1:8085/health
curl -i http://127.0.0.1:8085/missing

The first request should return 200. The second should return 404. A 404 means you reached an HTTP server, but the path was not found. A connection refusal usually means nothing is listening at that address and port. A timeout may point to a blocked path or a slow service. These clues help narrow the search; none proves the cause by itself.

Inside Compose, a service reaches another service using its service name and container port. The address localhost means the current container, not your laptop and not another container. This is a common reason for failed database connections.

Keep identity and secrets safe

Network access and identity are separate checks. An open route should not let any caller read private data. Give people and apps only the permissions they need. Use short-lived credentials where supported. Keep passwords out of images, Git and logs. If a secret leaks, replace it; deleting the visible text is not enough.

In Kubernetes, a Secret is not secure just because its value is base64 text. You still need access controls and appropriate encryption. A NetworkPolicy needs a network plugin that enforces it. A policy file alone cannot protect the cluster.

A calm troubleshooting order

1. Check the name and address. Are you calling the right environment?
2. Check the listener and port. Is the process running?
3. Check routes and network rules along the path.
4. Check TLS host names and expiry.
5. Check application login, permissions and logs.
6. Change one thing, test again and record the result.

Practice: explain why a database can be private while its web app is public. Then draw the allowed connections. If a line has no clear purpose, question whether you need it.

Official references and further reading

Reviewed on 25 October 2026. Tools change, so check the official documentation for the version you use.

• AWS subnet routing
• AWS security groups
• AWS network ACLs
• Kubernetes NetworkPolicy

DevOps learning roadmap · All DevOps & Cloud tutorials