FDE ForgeBeta
Start free
Week 9 · Field delivery

Fence the data APIs

0:00 / 3:00

15 seconds

Key worked from a laptop abroad.

The API key was valid. The data left the customer boundary anyway.

Leaked keyValidPerimeterBlocks egressData APIStays in
Lesson notesFence the data APIs: the short version+

Week 9 · Kubernetes & Terraform · about 3 minutes

What you will be able to do

Use a service perimeter so Helix data APIs cannot exfiltrate even if a key leaks.

The idea

Identity alone is not enough. A perimeter (VPC Service Controls, private endpoints, egress policies) blocks calls that leave the trusted boundary.

Leaked keys should fail closed outside the fence.

Data APIs: private only
Egress: deny by default
Exception: approved connectors

A key without a fence is a portable breach.

Key takeaways

  • Private data APIs.
  • Deny egress by default.
  • Valid key ≠ allowed path.

Part of the Forward Deployed Engineer roadmap. New to the role? Start with what a Forward Deployed Engineer does.