Design cloud-native access boundaries
Combine named application access, segmentation, workload identity, Kubernetes authorization, and multi-cloud trust.
Topic index
Network and Infrastructure
Learn the network boundaries, traffic paths, and infrastructure patterns behind private access.
Topic index
Understand this domain
Pomerium coverage
Pomerium operates at the application access path. It accepts a named user-facing route, evaluates identity-aware policy, and connects approved traffic to a reachable private upstream. The deployment still needs correct DNS, TLS, load balancing, and private network reachability.
Limits
- Application access policy does not replace firewalls, private routing, segmentation, or endpoint controls.
- An HTTP proxy in front of a TCP tunnel must support CONNECT. UDP needs CONNECT-UDP support.
- Network location does not prove user identity or permission to use an application resource.
Primary sources
2 learning paths
Paths for this topic
Secure Platforms and Trusted Components
Build justified trust from small enforcement components, hardened runtimes, boot evidence, isolation, and controlled information flow.
22 related guides
Guides in this topic
Apply zero trust to cloud-native systems
Apply user and workload identity across APIs, gateways, meshes, sidecars, clusters, clouds, and application resources.
Build SPIFFE workload identity
Trace SPIFFE IDs, SVIDs, trust domains, bundles, Workload API delivery, attestation, rotation, and federation.
Choose layer 4 or layer 7 access control
Place transport and application enforcement where the required identity, destination, protocol, resource, and action are visible.
Choose the access enforcement layer
Place access enforcement across identity-aware proxies, API gateways, service meshes, load balancers, and network tunnels.
Combine segmentation with identity policy
Use network segmentation to limit reachability and identity policy to decide access to named services, resources, and actions.
Compare process, container, and VM isolation
Compare shared kernel, virtual machine, host, node, runtime, credential, and control-plane trust boundaries.
Defend outbound requests from SSRF
Design a webhook, import, preview, or fetch service with strict destination, redirect, credential, egress, and resource policy.
Design identity-aware TCP and UDP access
Map user identity and policy to non-HTTP connections while controlling clients, ports, names, lifetime, and protocol limits.
Distinguish proxy types before placing access control
Distinguish reverse, forward, transparent, and identity-aware proxies by client, destination, trust, and enforcement role.
Federate workload identity without static keys
Exchange attested platform identity for short-lived target credentials without copying long-lived cloud keys into workloads.
Place access control in a service mesh
Place identity, transport, route, and application policy across mesh gateways, sidecars, ambient proxies, and workloads.
Protect private SSH and RDP administration
Design named administrative access with strong identity, narrow routes, native server controls, session limits, and evidence.
Replace stored secrets with workload credentials
Separate stored secrets from projected, rotated credentials and reduce exposure through identity-bound delivery and use.
Separate DNS from service identity
Trace resolution, routing, certificate names, endpoint authentication, and failover without treating DNS as identity.
Separate zero trust from ZTNA
Distinguish a resource-centered security architecture from a product pattern that brokers selected remote access.
Threat-model a multi-cloud access path
Trace human and workload identity across clouds and find direct, federation, routing, control-plane, and recovery bypass paths.
Trace Kubernetes control-plane access
Trace Kubernetes API transport, authentication, authorization, admission, persistence, and audit for human and workload requests.
Trace network reachability for access systems
Trace addresses, prefixes, routes, ports, translation, names, and firewalls without confusing reachability with identity.
Trace TLS 1.3 through an access system
Trace TLS 1.3 authentication, key establishment, record protection, termination, and early-data risk across an access path.
Use east-west and north-south traffic as topology
Use traffic direction to describe topology, then make identity and resource decisions independently.
Use network controls in zero trust
Keep routing, segmentation, firewalls, naming, transport protection, and availability controls without using location as trust.
Validate an X.509 certificate path
Validate X.509 paths, service names, key usage, constraints, time, and revocation without expanding the trust boundary.
37 related terms
Concepts in this topic
Bastion Host
A bastion host is a hardened system that provides controlled administrative access to a more protected network or resource.
Clientless Zero Trust Access
Distinguish browser or native-client access from broad network tunnels and state which protocols still require a local connector.
Cloud Access Security Broker (CASB)
A Cloud Access Security Broker is a policy enforcement point that mediates use of cloud services.
Cloud Metadata Service Risk
Cloud metadata services can deliver workload credentials, so network and identity boundaries must stop unintended callers.
Cloud Network Security
Cloud network security protects data, workloads, identities, and communication paths in cloud environments. It follows a shared responsibility model.
Context-Aware Proxy
A context-aware proxy is a policy enforcement point placed between a requester and a protected service.
Control Plane and Data Plane
Separate the systems that define and distribute access policy from the request path that enforces it on live traffic.
Denial of Service
Model how traffic, expensive valid work, state, queues, dependencies, identity, and recovery controls can make a service unavailable.
East-West Traffic
East-west traffic is traffic between workloads, services, or systems within or across internal, cloud, or data-center environments.
Execution Isolation and Sandboxing
Bound untrusted code with explicit memory, process, file, network, device, syscall, identity, and resource controls.
Firewall
A firewall is a device or program that controls network traffic between networks or hosts according to a firewall policy.
Gateway Bypass Path
Find every route that reaches a protected origin without the intended identity, policy, and evidence controls.
HTTPS and TLS
Explain HTTPS as HTTP over an authenticated, encrypted TLS channel with explicit names, endpoints, and termination boundaries.
Implicit Trust Zone
An implicit trust zone grants authority from location, membership, or prior access without a resource-specific decision.
Ingress and Egress
Place controls on traffic entering and leaving a workload boundary without treating direction or network location as identity.
IPsec: Tunnel Mode and Transport Mode
IPsec is a suite of protocols that protects IP traffic under a security policy.
Kubernetes Gateway API
Gateway API models infrastructure, listeners, routes, backends, and policy attachment through role-oriented resources.
Kubernetes Namespace and Tenancy
A namespace scopes names and policy objects, but tenant isolation depends on many cluster and workload controls.
Kubernetes NetworkPolicy
Kubernetes NetworkPolicy controls selected Pod ingress and egress reachability through a supporting network plugin.
Kubernetes RBAC
Grant Kubernetes API verbs on exact resources and namespaces without broad roles, aggregation, bind, or escalation paths.
Kubernetes Service Account
Use bounded, short-lived Kubernetes service-account tokens for a workload and avoid static namespace-wide credentials.
Load Balancer and Gateway
A load balancer selects a backend, while a gateway terminates or mediates a protocol boundary and can apply policy.
Micro-segmentation
The primary security goal of micro-segmentation is to limit which workloads can communicate and reduce lateral movement after compromise.
Network Segmentation
Network segmentation divides a network into logical or physical zones and controls traffic between them.
North-South Traffic
North-south traffic crosses an environment or trust boundary, such as traffic between a user and an application or between a private service and the internet.
OSI Layers
The OSI model is a seven-layer reference model, not a guarantee that each protocol provides reliability.
Perimeter
A security perimeter is a boundary where controls inspect or restrict communication. NIST zero trust does not remove firewalls or all network boundaries.
Secure Access Service Edge (SASE)
SASE is an architecture that converges wide-area networking and security functions and delivers them as a distributed cloud service.
Secure Web Gateway (SWG)
An SWG applies policy to user access to internet web services.
Software Defined Perimeter (SDP)
A software-defined perimeter hides protected services from unauthorized requesters and establishes identity-controlled connectivity.
Software-Defined Networking (SDN)
Software-defined networking separates programmable control functions from the packet-forwarding plane through defined abstractions and interfaces.
Software-Defined Wide Area Network (SD-WAN)
SD-WAN uses a software-controlled policy layer to steer WAN traffic across one or more underlays such as broadband, cellular, and MPLS.
Traffic Analysis
Infer participants, relationships, activity, protocol, content class, and events from communication timing, direction, size, frequency, and routes.
Upstream and Downstream
Upstream and downstream describe direction relative to one intermediary, so the reference point must be explicit.
Virtual Private Network (VPN)
A VPN creates an encrypted tunnel over another network. Remote-access VPNs connect an endpoint to a private network. Site-to-site VPNs connect networks.
Workload Attestation
Use platform evidence to select a workload identity without treating mutable labels or network location as proof.
Zero Trust Network Access (ZTNA)
ZTNA is an access approach that applies zero trust principles to connections between subjects and specific private resources.
