Layered Security Model: Security Groups and Calico Policy

Layered Security Model: Security Groups and Calico Policy An architecture diagram generated by Archify. Internet · External traffic · Architecture component Internet External traffic Network ACL · Subnet level · Layer 1: AWS level Network ACL Subnet level Security Group · ENI level · Layer 1: AWS level Security Group ENI level Calico NetworkPolicy · Pod level · Layer 2: Kubernetes level Calico NetworkPolicy Pod level GlobalNetworkPolicy · Cluster level · Layer 2: Kubernetes level GlobalNetworkPolicy Cluster level mTLS · Service-to-service · Layer 3: Application level mTLS Service-to-service Authorization · Application · Layer 3: Application level Authorization Application Application · Final destination · Architecture component Application Final destination inbound Layer 1: AWS level Layer 2: Kubernetes level Layer 3: Application level Legend App AWS layer Security Internet

Security Group

  • • Instance / ENI scope, IP and port rules (L3-L4)
  • • Preferred for traffic from outside the VPC and between subnets
  • • Audit: CloudTrail

Calico Policy

  • • Pod / namespace / cluster scope, label selectors
  • • Preferred for pod-to-pod traffic, namespace isolation, and label-based policy
  • • Audit: Flow Logs