🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Data Management / Database Administration › Cloud Storage for Database Administrators › Lesson 4
TEC-DATA86-08 · Lesson 4 · 12 clock hours · lab

Network Security: VPCs, Private Endpoints, and Firewall Rules

Objective. Students will design and implement a secure network topology that places a managed database in a private subnet accessible only through defined private endpoints and security groups.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Why Database Network Security Matters

A database is the most valuable asset in most organizations. Placing it on a network without careful controls is the single most common cause of large-scale data breaches. This lesson focuses on three tools that, used together, create a layered defense: Virtual Private Clouds (VPCs) / Virtual Networks (VNets), private endpoints, and security groups / firewall rules. These concepts apply directly to the Microsoft DP-300 exam, the DAMA CDMP Associate data-governance body of knowledge, and real-world DBA practice on AWS and Azure.

Virtual Private Clouds and Virtual Networks

A Virtual Private Cloud (VPC) in AWS—or a Virtual Network (VNet) in Azure—is a logically isolated section of a cloud provider's network that you define. You choose the IP address range (expressed as a CIDR block, such as `10.0.0.0/16`), divide it into subnets, and decide which subnets can reach the public internet and which cannot.

Keeping the database in a private subnet is the foundational control. Without it, all other security measures are far less effective.

Security Groups and Network ACLs

A security group is a stateful virtual firewall attached to a resource (such as an RDS instance or a virtual machine). Rules specify allowed traffic by protocol, port, and source. Because security groups are stateful, return traffic for an allowed connection is automatically permitted without a separate outbound rule.

Best practice: never open a database port (for example, PostgreSQL port 5432 or SQL Server port 1433) to `0.0.0.0/0` (all internet addresses). Instead, write the inbound rule so that the source is the security group ID of your application tier—not an IP address range. This means only resources attached to the application-tier security group can reach the database, even if IP addresses change.

Network ACLs (AWS) operate at the subnet level and are stateless—both inbound and outbound rules must be written explicitly. They add a second layer but are harder to manage precisely. For most DBA work, security groups provide the primary control.

Private Endpoints

Even within a private subnet, a managed cloud database service (like Azure SQL Database) may, by default, still have a public endpoint—a DNS name that resolves to a public IP. Private endpoints solve this. A private endpoint creates a network interface inside your VNet or VPC with a private IP address that maps directly to the managed service. Traffic between your application and the database never leaves the provider's backbone network.

In Azure, enabling a private endpoint also allows you to disable public access entirely on the Azure SQL Database resource. After that, connection attempts from any IP outside the VNet will be refused at the network layer, regardless of firewall rules.

In AWS, Amazon RDS placed in a private subnet without a public IP achieves a similar result. You can also use VPC endpoints (AWS PrivateLink) for supporting services such as Secrets Manager or S3.

Three Common Misconfigurations to Recognize

1. Publicly accessible database: The instance has a public IP or public endpoint enabled, and the security group allows inbound traffic on the database port from `0.0.0.0/0`. Any attacker can attempt to connect. Remediation: move to a private subnet, disable public access, and restrict source in security group rules.

2. Overly permissive inbound rules: The database is in a private subnet, but the inbound security group rule allows the entire VPC CIDR (for example, `10.0.0.0/16`) rather than only the application-tier security group. Any compromised resource anywhere in the VPC can reach the database. Remediation: replace the CIDR source with the specific application-tier security group ID.

3. Unencrypted transit: Traffic between the application and the database travels over the private network but without TLS/SSL. An attacker with access to the network path (or packet-capture tools such as Wireshark) can read queries and result sets in plaintext. Remediation: enforce TLS on the database listener and require encrypted connections in the application connection string. NIST SP 800-53 control SC-8 addresses transmission confidentiality and integrity.

Safety and Professional Practice Notes

Cloud network configuration changes can disrupt production services. Before changing any security group or firewall rule in a production environment, follow your organization's change-management process: document the change, obtain approval, schedule a maintenance window, and prepare a rollback plan. Treat credential files (such as AWS access keys or Azure service principal secrets) used in CLI labs as sensitive—never commit them to a source-code repository. When working with Wireshark or any packet-capture tool, capture traffic only on networks and systems you are authorized to inspect; unauthorized interception violates federal law (the Electronic Communications Privacy Act) and most acceptable-use policies.

Connecting to Credentials

The Microsoft DP-300 exam (Administering Relational Databases on Microsoft Azure) directly tests private endpoint configuration, VNet integration, and firewall rules for Azure SQL Database. The DAMA CDMP Associate exam covers data security principles including access control and network protection as part of the Data Security knowledge area. PostgreSQL CE (EDB) candidates should understand how `pg_hba.conf` host-based authentication interacts with network-layer controls—network controls stop unauthorized connections before PostgreSQL ever sees them.

Key terms8

Virtual Private Cloud (VPC)A logically isolated virtual network within a cloud provider's infrastructure, defined by the customer with its own IP address ranges, subnets, and routing rules.
Private SubnetA subnet with no direct route to the public internet, used to host backend resources such as database instances that should not be publicly reachable.
Security GroupA stateful virtual firewall attached to a cloud resource that controls inbound and outbound traffic by protocol, port, and source or destination.
Private EndpointA network interface with a private IP address that maps a managed cloud service (such as Azure SQL Database) into a customer's virtual network, eliminating the need for a public endpoint.
CIDR BlockClassless Inter-Domain Routing notation (for example, 10.0.0.0/16) used to define IP address ranges for VPCs, subnets, and firewall rules.
Network ACLA stateless, subnet-level access control list in AWS that evaluates inbound and outbound traffic independently; used as a secondary layer alongside security groups.
TLS (Transport Layer Security)A cryptographic protocol that encrypts data in transit between a client and a server, protecting against eavesdropping on network traffic.
Principle of Least Privilege (network)Granting only the minimum network access required—for example, allowing inbound database port traffic only from the specific application-tier security group rather than a broad IP range.
In class: Lab: in AWS, create a custom VPC with public and private subnets; place an RDS instance in the private subnet; configure a security group that allows inbound port 5432 only from an application-tier security group; verify no public internet access to the database. · Lab: in Azure, configure a virtual network (VNet) and enable the Azure SQL Database private endpoint; disable public access; confirm that connection attempts from outside the VNet are refused while a VM inside the VNet connects successfully. · Threat-modeling exercise: given a network diagram with three common misconfigurations (publicly accessible database, overly permissive inbound rules, unencrypted transit), students identify each flaw, explain the risk, and document the corrected configuration in writing.
Materials: AWS VPC console and AWS CLI; Azure VNet and private endpoint documentation; Wireshark (for transit inspection demo); network diagram templates; NIST SP 800-53 (network controls reference, publicly available); Microsoft DP-300 exam objective list
Check: Instructor tests connectivity from an external IP (expected: refused) and from a VM in the approved subnet (expected: successful); written threat-model document graded on identifying all three flaws with correct remediation; pass requires both network tests to pass and all three flaws identified.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Microsoft DP-300 – Secure the environment
1. A DBA places an RDS PostgreSQL instance in a private subnet and creates a security group. Which inbound rule BEST follows the principle of least privilege for allowing the application tier to connect on port 5432?
Microsoft DP-300 – Configure and manage Azure SQL Database
2. An Azure SQL Database has a private endpoint configured inside a VNet. Public access has been disabled. A developer attempts to connect from their home laptop over the internet. What is the expected result?
DAMA CDMP – Data Security
3. During a threat-modeling exercise, a student reviews a network diagram and finds that an RDS instance has 'Publicly Accessible: Yes' and its security group allows TCP 3306 from 0.0.0.0/0. Which risk does this configuration PRIMARILY create?
Microsoft DP-300 – Secure the environment
4. A security group rule allows inbound TCP 5432 from the entire VPC CIDR (10.0.0.0/16) instead of from the application-tier security group. What specific risk does this overly permissive rule introduce?
DAMA CDMP – Data Security
5. A DBA uses Wireshark and captures plaintext SQL queries traveling between the application server and a PostgreSQL database on a private subnet. Which NIST SP 800-53 control family addresses this transmission confidentiality risk?
Microsoft DP-300 – Configure networking
6. Which statement BEST describes why a security group is called 'stateful'?
Microsoft DP-300 – Secure the environment
7. A student wants to verify that an RDS instance in a private subnet has no public internet access. Which test result CORRECTLY confirms this configuration is working as intended?
PostgreSQL CE (EDB) – Server configuration and security
8. In the context of PostgreSQL CE (EDB) preparation, which file controls host-based authentication on a self-managed PostgreSQL server and works in conjunction with network-layer controls?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →