Woori Financial Group AWS security architecture.
Moved network separation requirements across multiple AWS accounts into subnet and firewall structure, and standardized security settings as one set of Terraform code.
Problem
Group companies were adopting public cloud for the first time, with no Terraform in place, and security settings varied by account and by person. Network separation rules were hard to hold in documents alone.
Approach
Network separation (a Korean financial regulation) became three design principles: separate DMZ and Private subnets, no public IP on backends, and outbound only to allowed destinations. WAF, Network Firewall, and Shield Standard are defined in Terraform and applied through the same code to every account, with GuardDuty and Security Hub connected to Splunk SIEM/SOAR.
Implementation
- Terraform
- AWS Network Firewall
- AWS WAF
- AWS Shield Standard
- GuardDuty
- Security Hub
- Splunk
- Python
Scale · Multiple AWS accounts
The path of incoming traffic is split into layers.
AWS Shield Standard provides baseline DDoS protection.
CloudFront and WAF filter web attacks.
The internet-facing ALB sits in a DMZ subnet.
AWS Network Firewall inspects traffic on the VPC path.
Backends sit in Private subnets with no public IP, and outbound goes only to allowed destinations.
One set of Terraform code applies this design the same way across multiple AWS accounts.
Read every step
- The path of incoming traffic is split into layers.
- AWS Shield Standard provides baseline DDoS protection.
- CloudFront and WAF filter web attacks.
- The internet-facing ALB sits in a DMZ subnet.
- AWS Network Firewall inspects traffic on the VPC path.
- Backends sit in Private subnets with no public IP, and outbound goes only to allowed destinations.
- One set of Terraform code applies this design the same way across multiple AWS accounts.
Result
The same security standard repeats through code as accounts grow, and per-person differences are gone. A Python pipeline now collects and analyzes network configuration across multiple AWS accounts, so review is repeatable. IAM permissions are defined in Terraform as well, which structurally blocks excessive grants.
- 5
- Security services connected to Splunk SIEM/SOAR
- 3
- Design principles from network separation
- 1
- Set of Terraform code across multiple AWS accounts
What I learned
The biggest lesson was that once security settings become code, differences between accounts show up as differences in code. When each person configured accounts in the console, finding which account differed meant comparing settings one by one; applying the same Terraform code to every account made any difference visible right in the code. Rules that existed only on paper, such as network separation, could be enforced by structure only after they were turned into three principles: separate subnets, no public IPs on the backend, and outbound only to allowed destinations. I also learned that a standard defined in code is complete only when it is confirmed to hold in each account, and the pipeline that collects and analyzes network configuration was built to make that confirmation a repeatable check rather than something people remember.
IaC 0 → Terraform — Network Firewall and WAF standardized in code