FDE ForgeBeta
Start free
Week 4 · Foundation

Private by default

0:00 / 3:00

15 seconds

The database has a public IP.

Someone checked the easy box in the cloud console. The ticket DB answers the internet.

InternetAnyoneAPIPrivate subnetPostgresNo public IP
Lesson notesPrivate by default: the short version+

Week 4 · Cloud & containers · about 3 minutes

What you will be able to do

Deploy the ticket API and its database with no public endpoints unless Northwind explicitly asks.

The idea

Customer data stays on private subnets. The API sits behind an internal load balancer or a private service. The database has no public IP.

If a human must reach it, use a bastion or VPN that Northwind already trusts — not 0.0.0.0/0 on Postgres.

resource "aws_db_instance" "tickets" {
  publicly_accessible = false
  vpc_security_group_ids = [aws_security_group.db.id]
}

resource "aws_lb" "api" {
  internal = true
  load_balancer_type = "application"
  subnets = var.private_subnet_ids
}

Public by accident is still a breach waiting for a scanner.

Key takeaways

  • API and DB live on private subnets.
  • Prefer internal load balancers.
  • Bastion or VPN for human access — not open Postgres.

Part of the Forward Deployed Engineer roadmap. New to the role? Start with what a Forward Deployed Engineer does.