Is AWS subnets enough for segregation of networks with the all security groups? or do we need VPC to really issolate two application from each other?
2 Answers
By default subnets inside the same VPC have no segregation. As Joe M's answer says you can use ACLs (subnet level firewalls) to enforce separation and security groups for a more fine grained instance level control.
Using multiple VPCs adds quite a bit of overhead but is a good option if you're looking for an extra layer of "accident-proof" separation e.g. if you want to be certain a misconfigured ACL cant cause damage.
The strategy you take probably depends on how much segregation you need:
Different VPCs (or even different Accounts):
- Different customers (assuming you have a low number of high value customers e.g. not for users of an app) especially if you are peering/VPN to your customers,
- Different environments e.g. Development or Prod,
- Different applications with very different audiences e.g. CompanyWebsite and Company Payroll Processor.
Different Subnets:
- Different services inside the same environment, e.g. webserver, appserver, database,
- Linked applications in the same environment, e.g. public webserver and internal-webserver that both use the same database.
Possible worth noting you can link VPCs together however this is a relatively advanced feature and should only be used for larger, complex networks.
Subnets if they are configured with security groups and ACLs can be just fine for segregation. However you need to be sure you create the appropriate ACL for the isolation required for each subnet.
From: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html
By design, each subnet must be associated with a network ACL. Every subnet that you create is automatically associated with the VPC's default network ACL. You can change the association, and you can change the contents of the default network ACL. For more information, see Network ACLs.
