Zero Trust

Zero Trust Security Patterns

Core Principles

• Never trust, always verify — no implicit trust based on network location
• Least privilege access — minimum permissions required for the task
• Assume breach — design as if attacker is already inside
• Verify explicitly — authenticate and authorize every request

Identity-Aware Proxy (IAP)

# Google Cloud IAP configuration
resource "google_iap_web_backend_service_iam_binding" "binding" {
  web_backend_service = google_compute_backend_service.default.name
  role                = "roles/iap.httpsResourceAccessor"
  members = [
    "group:engineers@company.com",
  ]
}

# Nginx with IAP header verification
server {
  location /internal/ {
    # Verify Google IAP JWT
    auth_jwt "Secure Zone" token=$http_x_goog_iap_jwt_assertion;
    auth_jwt_key_file /etc/nginx/google-iap-public-keys.json;
    proxy_pass http://backend;
  }
}

Mutual TLS (mTLS)

# Python server with mTLS
import ssl
import http.server

context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
context.load_cert_chain('/etc/certs/server.crt', '/etc/certs/server.key')
context.load_verify_locations('/etc/certs/ca.crt')
context.verify_mode = ssl.CERT_REQUIRED  # Require client cert

server = http.server.HTTPServer(('0.0.0.0', 443), handler)
server.socket = context.wrap_socket(server.socket, server_side=True)
server.serve_forever()

# Istio mTLS policy (mesh-wide)
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT   # Reject plaintext traffic

---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: payments-policy
  namespace: production
spec:
  selector:
    matchLabels:
      app: payments-service
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/orders-service"]
    to:
    - operation:
        methods: ["POST"]
        paths: ["/api/charge"]

Least Privilege — AWS IAM

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3ReadSpecificBucket",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::my-app-bucket",
        "arn:aws:s3:::my-app-bucket/*"
      ]
    }
  ]
}

# Temporary credentials with STS
import boto3

sts = boto3.client('sts')
assumed = sts.assume_role(
    RoleArn='arn:aws:iam::123456789:role/ReadOnlyRole',
    RoleSessionName='task-session',
    DurationSeconds=900  # 15 minutes max
)
credentials = assumed['Credentials']

Micro-Segmentation with Network Policies

# Kubernetes NetworkPolicy — deny all, allow only needed
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-api-to-db
spec:
  podSelector:
    matchLabels:
      app: postgres
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: api-server
    ports:
    - port: 5432

ZTNA Implementation Checklist

Identity Layer:
  ✓ SSO with MFA enforced for all users
  ✓ Device posture checked (OS version, disk encryption, EDR)
  ✓ Short-lived credentials (tokens expire ≤1h)
  ✓ Just-in-time access for privileged operations

Network Layer:
  ✓ No VPN; use ZTNA gateway (Cloudflare Access, Zscaler, Tailscale)
  ✓ mTLS between all services
  ✓ Network policies block east-west traffic by default
  ✓ Service mesh for observability + policy enforcement

Data Layer:
  ✓ Encryption at rest and in transit (TLS 1.3)
  ✓ Data classification labels on sensitive resources
  ✓ DLP policies on egress
  ✓ Audit logs for all data access (immutable)

Monitoring:
  ✓ Continuous validation — re-verify every N minutes
  ✓ Anomaly detection on access patterns
  ✓ Alert on impossible travel, off-hours access
  ✓ Automated response: revoke session on anomaly

Cloudflare Access (ZTNA)

# Cloudflare Access policy via Terraform
resource "cloudflare_access_application" "internal_app" {
  zone_id          = var.zone_id
  name             = "Internal Dashboard"
  domain           = "dashboard.internal.example.com"
  session_duration = "1h"
}

resource "cloudflare_access_policy" "engineers_only" {
  application_id = cloudflare_access_application.internal_app.id
  zone_id        = var.zone_id
  name           = "Engineers with MFA"
  precedence     = 1
  decision       = "allow"

  include {
    email_domain = ["company.com"]
    gsuite {
      email                = "engineers@company.com"
      identity_provider_id = cloudflare_access_identity_provider.gsuite.id
    }
  }

  require {
    mfa { }
  }
}