Build the three-tier network in code and prove what cannot reach what

applied · 70 min · Objective 1.3

Task

Define a complete virtual network -- public and private subnets across two zones, a gateway, a NAT path, and security groups that reference each other -- in infrastructure code, and then assert the NEGATIVE cases. Proving what must not connect is the half people skip, and it is where the misconfiguration hides.

Steps

  1. Write the network definition: one virtual network, public and private subnets in two availability zones, an internet gateway, a route table per subnet tier, and a NAT path for the private subnets.
  2. Define three security groups -- web, app and data -- where each references the one above it as its source rather than naming any address range.
  3. Run the tool in plan mode and save the output to lab/plan.txt. Confirm the route table associations are what you intended before creating anything.
  4. Write lab/assertions.md listing at least four POSITIVE reachability claims and at least four NEGATIVE ones -- for example that the data tier cannot be reached from the internet gateway path, and that the web tier cannot reach the data tier directly.
  5. If you deployed, test every claim with a reachability analyser or by attempting the connection, record the result beside each claim, then destroy the stack and confirm nothing tagged with your owner value remains.

Verify

grep -Ec 'cannot|must not|denied' lab/assertions.md
grep -Ec 'can reach|permitted|allowed' lab/assertions.md
grep -Eci 'route table' lab/plan.txt

At least four of each. A test plan containing only positive assertions cannot detect a security group that is too permissive, because everything it checks will pass.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.