AdvancedTechnical
5 min
Designing Secure Egress in Cloud VPCs
Cloud NetworkingSecurityVPC
Advertisement
Interview Question
How do you design outbound (egress) controls for workloads in private subnets without public IPs while maintaining least privilege?
Key Points to Cover
- Use NAT gateways or egress proxies with allowlists
- Restrict destinations by FQDN/IP and ports; enforce TLS inspection if required
- Centralize egress through firewall appliances or service endpoints
- Audit with flow logs; detect anomalies and shadow IT
Evaluation Rubric
Chooses appropriate egress patterns35% weight
Imposes least-privilege outbound access25% weight
Adds logging/alerting for egress20% weight
Avoids single points and scales throughput20% weight
Hints
- 💡Prefer private service endpoints for cloud APIs.
Potential Follow-up Questions
- ❓How to rotate proxy certificates?
- ❓How do you handle package mirrors securely?
Advertisement