A practical playbook to implementing Zero Trust architecture using AWS and Cloudflare. Covering edge security, identity controls, and data protection for modern cloud infrastructure.
As the founder of Jonanata, I often support clients who are growing fast but whose infrastructure hasn’t kept up with modern security expectations. One recent project stands out because it reflects a challenge many founders face:
How do you bring an existing production system closer to SOC 2 and PCI‑DSS expectations , without rewriting the application, without downtime, and without blowing the budget?
My client had a public‑facing mobile app backed by a legacy PHP API server built on a proprietary framework. It worked, but it wasn’t compliant, and it wasn’t defensible. They were already using AWS and Cloudflare — but only Cloudflare’s free plan.
The constraints were clear:
- No application revamp
- No downtime
- Free or low‑cost solutions only
- Compliance‑aligned security improvements
- Immediate business value
This is the story of how I delivered a Zero Trust Architecture that strengthened every layer — AWS, Cloudflare, PHP, and Nginx — while keeping the system running and the budget under control.
Why Zero Trust, SOC 2, and PCI‑DSS Matter
Before diving into the solution, it’s worth explaining these concepts in business terms.
Zero Trust Architecture (ZTA)
A modern security model built on one principle:
Never trust anything by default — verify everything.
It protects businesses from:
- Credential theft
- Lateral movement inside servers
- Insider threats
- Misconfigurations
- Public exposure
For founders, Zero Trust means reduced risk , better investor confidence , and stronger customer trust.
SOC 2
A widely recognized security and operational standard.
It focuses on:
- Access control
- Logging and monitoring
- Network restrictions
- Data protection
- Operational discipline
Even if you’re not formally audited, aligning with SOC 2 makes your business more trustworthy to partners and enterprise clients.
PCI‑DSS
A security standard for systems that handle payment‑related data.
It emphasizes:
- Network segmentation
- Least privilege
- Secure coding
- Logging
- Encryption
Even if you don’t process payments directly, PCI‑DSS alignment reduces the risk of data breaches and strengthens your compliance posture.
The Challenge: Secure a Legacy System Without Rewriting It
The client’s PHP backend was built on a proprietary framework. Rewriting it would take months and introduce risk. Instead, I designed a solution that wraps the existing system in Zero Trust , hardens every layer, and enforces strict access control — all without touching core business logic.
The only additional cost?
CloudWatch log storage.
Everything else used AWS native features and Cloudflare’s free plan.
AWS Layer: Identity‑Based Access and Network Isolation
1. IAM Roles Only — No Stored Keys
The production EC2 instance uses a dedicated IAM role (role-ec2-production) with:
- Access only to specific S3 buckets
- Access only to the RDS MySQL instance
- Access only to CloudWatch
- All permissions scoped to resource names
- No IAM users, no access keys stored on the server
Business & compliance value:
No leaked keys, no credential rotation headaches, and full alignment with SOC 2 CC6.1 and PCI‑DSS 7.1.
2. Private EC2 — No Public IP
The production EC2 sits behind a new security group (sg-ec2-production) with:
- No public IP
- No inbound access from the internet
- Only the bastion host can reach it via private IP
Business & compliance value:
The production server is invisible to attackers.
This satisfies PCI‑DSS 1.2.1 and SOC 2 CC6.6.
3. RDS: Identity‑Based Database Access
The MySQL database:
- Accepts connections only from the production SG
- Uses IAM authentication (no password stored anywhere)
- Generates short‑lived tokens via AWS KMS
- Grants the role-ec2-production only SELECT/INSERT/UPDATE/DELETE
- No public IP and is accessible only inside the VPC
- Is fully encrypted
Business & compliance value:
No database passwords to leak.
No over‑privileged accounts.
Meets PCI‑DSS 3.4, 7.2 and SOC 2 CC6.1.
4. S3: Fully Private With Pre‑Signed URLs
- Block all public access
- Upload/download only via pre‑signed URLs
Business value:
Keeps all PII and sensitive files private and off the public internet, reducing breach risk and supporting compliance with SOC 2 (CC6.6, CC6.7, CC9.1) and PCI‑DSS (3.4, 7.1, 10.2).
5. Logging: Fluent Bit + CloudWatch + Logrotate
- Logs stored outside the web root
- Fluent Bit ships logs to CloudWatch
- Logrotate deletes rotated logs immediately
Business & compliance value:
Centralized, tamper‑resistant logs that satisfy SOC 2 CC7.2 and PCI‑DSS 10.x.
6. Bastion Host: Controlled, Auditable Access
- Only turned on when needed
- Only developer IPs allowed
- Developers authenticate with their own SSH keys
- Developers never see the production private key
- A controlled script handles access to the production EC2
Business & compliance value:
No shared credentials.
Full accountability.
Meets SOC 2 CC6.3 and PCI‑DSS 8.x.
Cloudflare Layer: Strong Perimeter Security (Free Plan)
Even on the free plan, Cloudflare provides powerful security controls when configured correctly.
1. Cloudflare Tunnel — What It Is and Why It Matters
Cloudflare Tunnel creates an outbound‑only connection from the EC2 instance to Cloudflare.
This means:
- The server is never exposed to the public internet
- No open ports
- No public IP
- All traffic passes through Cloudflare’s Zero Trust layer
Compliance value:
Supports SOC 2 CC6.6 (network segmentation) and PCI‑DSS 1.3 (no direct public access).
2. mTLS With Client Certificates
A security mechanism where both the client and server present certificates, proving their identities before any data is exchanged.
This means:
- The server to trust the client
- The client to trust the server
- Only devices with valid client certificates can reach the API
- Prevents unauthorized devices, bots, or compromised workloads from connecting to your API
- Eliminates blind trust inside the network and blocks lateral movement
Business & compliance value:
Even if someone discovers the tunnel URL, or credentials (JWT) leak they cannot bypass certificate‑based authentication to access the API.
This fulfills SOC 2 CC6.7 (strong authentication) and PCI‑DSS 8.x.
3. Cloudflare Worker: JWT Validation at the Edge
Before requests reach the EC2 instance, a Worker:
- Validates the JWT
- Rejects invalid or expired tokens
- Ensures only authenticated traffic reaches the backend
Business & compliance value:
Reduces load on the server and blocks attacks early.
Supports SOC 2 CC7.1 (input validation) and PCI‑DSS 6.5.
PHP Layer: Hardening Without Rewriting Code
Even without modifying business logic, we strengthened the runtime environment.
1. Disable Dangerous Functions
Functions like exec, system, popen, etc. are disabled. Prevents remote command execution.
2. Disable URL File Access
Prevents remote file inclusion (RFI) attacks.
3. Disable legacy PHP features that automatically turn user input into variables
Attackers can exploit old PHP behaviors such as register_globals and magic_quotes_gpc, which implicitly convert or modify user input. Prevents malicious input from becoming variables and reduces the risk of remote code injection.
4. Hide PHP Version & Disable Error Display
Prevents attackers from fingerprinting the system.
5. Session Security Hardening
Protects against session hijacking and fixation.
6. PDO Everywhere
Prevents SQL injection.
Compliance value:
Hardens the PHP runtime without modifying business logic, eliminating high‑risk attack vectors (RCE, SQL injection, session hijacking) and strengthening compliance posture for SOC 2 and PCI‑DSS by enforcing safer defaults, strict input handling, and controlled execution paths.
Nginx Layer: API‑Focused Security Controls
- No directory browsing
- Block multipart uploads
- Enforce correct Host header
- Add HSTS and minimal CSP
- Limit request size
- Block directory traversal
- Block hidden files except .well-known
- Block sensitive files
- Remove version numbers
Business & compliance value:
Reduces attack surface and prevents common web vulnerabilities.
Supports PCI‑DSS 6.6 and SOC 2 CC7.1.
Defense in Depth: How Each Layer Protects the Business
How Each Layer Protects the Business
This is Zero Trust in practice : every layer assumes nothing is safe and verifies everything.
The Outcome: Compliance‑Aligned Security Without Rewrites or Cost Overruns
By applying Zero Trust principles across AWS, Cloudflare, PHP, and Nginx, we delivered:
- A secure, compliant, modernized backend
- No application rewrite
- No downtime
- No expensive tools
- Only CloudWatch storage cost
- A defensible security posture aligned with SOC 2 and PCI‑DSS
For the client, this meant:
- Stronger trust with users
- Better readiness for enterprise partnerships
- Reduced operational risk
- A future‑proof foundation for growth
- A compliance‑aligned architecture that enables expansion into regulated or restricted markets without major rework
- A security posture that meets the expectations of partners operating in highly controlled industries and jurisdictions
This is the kind of security upgrade that delivers real business value , not just technical improvements.
What’s Next
I’ll publish a deeper technical breakdown on my next AWS Builder Center article, including full configuration examples and source code in my GitHub repository.
The post How I Delivered Zero Trust Security for a Client’s Legacy PHP System — Without Rewrites, Downtime, or Big Costs appeared first on Behind the Build.
Top comments (0)