# AWS DMZ Architecture for Bureau Access

> A network design that lets approved integrations reach the internet while internal systems stay isolated.

- Kind: Work
- Stack: AWS networking, ALB, Lambda, Security groups, Routing controls

A US credit management company needed its internal systems kept off the public internet, while some of its work still had to reach credit bureaus online. I designed a DMZ on AWS for that: a small zone between the private network and the internet.

I put the internal systems in subnets the internet can't reach, behind load balancers, security groups and routing rules. Outbound traffic can only take fixed paths to domains on an approved list. The Lambda functions that call the credit bureau APIs go out that way.