Zero Trust Network Architecture in Cloud

"Never trust, always verify." Zero Trust eliminates the traditional network perimeter, treating every request as potentially hostile. This guide covers implementing Zero Trust principles in cloud networking.

What is Zero Trust?

Traditional security assumed a trusted internal network and untrusted external network. Zero Trust recognizes this model fails in modern environments:

Traditional Model

                Internet (Untrusted)
                        │
                  [Firewall]
                        │
              Corporate Network (Trusted)
                        │
          ┌─────────┬───────────┐
          │         │           │
       Server    Server    Database
       
"Once you're inside, you're trusted"

Zero Trust Model

         Every connection requires:
         - Identity verification
         - Device posture check
         - Access policy evaluation
         - Continuous monitoring
         
                    │
          ┌─────────┼─────────┐
          │         │         │
       [Auth]    [Auth]   [Auth]
          │         │         │
       Server    Server   Database
       
"Trust nothing, verify everything"

Core Principles

• Verify explicitly: Always authenticate and authorize based on all available data
• Use least privilege: Limit access with Just-In-Time and Just-Enough-Access
• Assume breach: Minimize blast radius and segment access

Zero Trust Network Components

1. Identity as the Perimeter

• User identity: SSO, MFA, conditional access
• Service identity: Service accounts, workload identity
• Device identity: Managed devices, certificate-based auth

2. Micro-Segmentation

• Network segments: Isolate workloads by function
• Service mesh: mTLS between all services
• Per-workload policies: Security groups per application, not per subnet

3. Continuous Verification

• Real-time evaluation: Check policies on every request
• Context-aware: Consider location, device, behavior
• Adaptive access: Increase requirements for sensitive operations

4. Comprehensive Logging

• Network flows: VPC Flow Logs, NSG logs
• Authentication: All auth attempts, successes, failures
• Authorization: Policy decisions and denials

Implementation in Cloud

AWS Zero Trust

Identity Foundation

• IAM roles: All services use IAM roles, never hardcoded credentials
• IAM Identity Center: Centralized SSO for human access
• AWS Organizations: Multi-account strategy for blast radius limitation

Network Controls

• Security Groups: Per-workload, reference other SGs (not CIDRs)
• PrivateLink: Private connectivity to services without internet exposure
• Verified Access: Identity-based access to internal applications

Azure Zero Trust

• Azure AD Conditional Access: Risk-based access policies
• Private Link: Private endpoints for PaaS services
• Application Security Groups: Identity-based network rules
• Azure Firewall: Centralized policy enforcement

GCP Zero Trust

• BeyondCorp Enterprise: Context-aware access
• Identity-Aware Proxy: Access applications without VPN
• Workload Identity: Kubernetes pods get GCP identity
• VPC Service Controls: Perimeter around sensitive data

Service Mesh for Zero Trust

Service mesh provides Zero Trust between microservices:

mTLS (Mutual TLS)

• Every service has certificate-based identity
• All service-to-service traffic encrypted
• Both client and server authenticate

Service Mesh Options

• Istio: Full-featured, complex
• Linkerd: Lightweight, easy to adopt
• AWS App Mesh: Managed mesh for AWS
• Consul Connect: HashiCorp's service mesh

# Istio authorization policy
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: api-policy
spec:
  selector:
    matchLabels:
      app: api
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/frontend/sa/frontend-service"]
    to:
    - operation:
        methods: ["GET", "POST"]
        paths: ["/api/*"]

Network Segmentation Patterns

Account/Project Level Segmentation

Production AWS Account
├── VPC: Production
│   ├── Subnet: Frontend
│   ├── Subnet: API
│   └── Subnet: Database

Development AWS Account
├── VPC: Development
    ├── Subnet: Dev-All
    
Cross-account access requires explicit IAM roles

Workload-Level Segmentation

• Each application gets its own security group
• Allow only required ports between specific groups
• Deny all by default

Zero Trust for Remote Access

Traditional VPN vs. Zero Trust Network Access (ZTNA)

ZTNA Solutions

• Cloudflare Access: Identity-aware proxy
• Zscaler Private Access: Cloud-native ZTNA
• Google BeyondCorp: Context-aware access
• AWS Verified Access: Corporate application access

Implementation Roadmap

Phase 1: Foundation

• Implement strong identity (SSO, MFA)
• Inventory all applications and data flows
• Enable comprehensive logging

Phase 2: Segmentation

• Implement VPC/account segmentation
• Deploy per-workload security groups
• Enable PrivateLink/Private Endpoints

Phase 3: Advanced Controls

• Deploy service mesh for mTLS
• Implement ZTNA for user access
• Add context-aware access policies

Phase 4: Continuous Improvement

• Analyze logs for anomalies
• Automate policy enforcement
• Regular security reviews

Key Takeaways

• Zero Trust treats all networks as hostile—verify every request
• Identity becomes the perimeter, not the network
• Micro-segmentation limits lateral movement
• Service mesh enables Zero Trust between microservices
• ZTNA replaces VPN for application access