Module 16 Lesson 3: Network isolation in AI clouds

Even with perfect IAM, a public-facing API endpoint is an "Attack Surface." The gold standard for enterprise AI is Network Isolation.

1. VPC/VNET Endpoints

In AWS and Azure, you can create a VPC Endpoint (or Private Link) for your AI service.

• Traditional: Your server talks to bedrock.us-east-1.amazonaws.com (over the public internet).
• Isomerized: Your server talks to a local IP address (e.g., 10.0.0.50) inside your private network.
• Benefit: The traffic never crosses the public internet. This prevents Sniffing and Man-in-the-Middle attacks.

---

2. The "No-Outbound" Rule

If your AI server is hacked, the attacker will try to Exfiltrate your data to their own server.

• The Defense: Set your Network Security Group (NSG) or Firewall to allow Incoming traffic from your users, but Block all Outgoing traffic to the public internet.
• The Exception: You only allow outgoing traffic to the specific "Private Endpoint" of the AI provider.

---

Visualizing the Process

graph TD
    Start[Input] --> Process[Processing]
    Process --> Decision{Check}
    Decision -->|Success| End[Complete]
    Decision -->|Retry| Process

---

3. Data Transfer Security (mTLS)

Between your "Application Server" and your "Inference Server" (the AI), you should use Mutual TLS (mTLS).

• Normal TLS: The server proves who it is to the client.
• Mutual TLS: The Client also proves who it is to the server.
• This ensures that even if an attacker gets inside your network, they can't talk to the AI without a specific Client Certificate.

---

4. Securing the "Last Mile" (Edge)

If your AI is public-facing, use a WAF (Web Application Firewall) at the edge.

• A WAF can block "Known Attackers" (from bad IP addresses) before their prompt even reaches your network.
• It can also implement "Rate Limiting" to prevent the DoW attacks we discussed in Module 13.

---

Exercise: The Network Engineer

1. Why is a "Private Link" more secure than a "Whitelist of IP addresses"?
2. You have a "Multitenant" app (serving many customers). Why is it dangerous to have all customers share the same VPC endpoint?
3. How does "Micro-segmentation" help protect a RAG system?
4. Research: What is "AWS Transit Gateway" and how can it be used to share an AI model across multiple company VPCs?

---

Summary

Network isolation is the "Physical" layer of defense. By ensuring that your AI is logically "Air-gapped" from the public web, you eliminate an entire class of remote attacks.

Next Lesson: Managing the bill: Monitoring AI cloud costs and usage.