FIELD NOTE · E13 · Woori FIS · Feb 2026 – Oct 2026

Setting a security baseline for a financial cloud that had none

Network separation as structure, security settings as code

IaC 0 → Terraform standard

In one line: I moved network separation rules out of documents and into structure and code, so every new account gets the same security baseline.
Highlights: Financial network separation turned into design principles
Network Firewall and WAF standardized as code
The same baseline as accounts are added
Tech: AWS · Terraform · Network separation · Network Firewall · WAF · Finance

The same shield lights up on every box.

Problem: The group's companies were adopting public cloud for the first time, and there was no IaC (managing infrastructure as code) at all. Each account had different needs, but the common security baseline had to hold everywhere.
Judgment: I turned network separation (a Korean financial regulation that splits networks by sensitivity so outside threats cannot reach inside directly) into three design principles. Separate DMZ and Private subnets, no public IPs on backend resources, and outbound traffic to approved destinations only.
What I did: I introduced Terraform, defined Network Firewall and WAF as code, and applied the same code to every account.
Result: As accounts are added, the same security baseline repeats through code. Settings no longer vary by engineer.
What I learned: Put a rule in structure and code instead of a document, and every deployment meets the same bar.

Related cases