Attack surface reduction

Another important consideration when architecting an AWS solution is to limit the opportunities an attacker has to target your application. This concept is known as attack surface reduction. Resources that aren't exposed to the internet are more difficult to attack, which limits the options an attacker has to target your application's availability.

For example, if you don't expect users to directly interact with certain resources, make sure that those resources aren't accessible from the internet. Similarly, don't accept traffic from users or external applications on ports or protocols that aren't necessary for communication.

In the following section, AWS provides best practices to guide you in reducing your attack surface and limiting your application's internet exposure.