Secure Infrastructure Setup for AI/LLM

AWS VPC Configuration

# Terraform configuration for secure VPC
resource "aws_vpc" "llm_vpc" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name        = "llm-secure-vpc"
    Environment = "production"
    Compliance  = "pci-dss"
  }
}

# Private subnets for LLM workloads
resource "aws_subnet" "private_llm" {
  count             = 3
  vpc_id            = aws_vpc.llm_vpc.id
  cidr_block        = "10.0.${count.index + 1}.0/24"
  availability_zone = data.aws_availability_zones.available.names[count.index]

  tags = {
    Name = "llm-private-subnet-${count.index + 1}"
    Type = "private"
  }
}

# Network ACLs with strict rules
resource "aws_network_acl_rule" "llm_ingress" {
  network_acl_id = aws_vpc.llm_vpc.default_network_acl_id
  rule_number    = 100
  protocol       = "tcp"
  rule_action    = "allow"
  cidr_block     = "10.0.0.0/16"
  from_port      = 443
  to_port        = 443
}

# VPC Endpoints for private connectivity
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.llm_vpc.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_vpc.llm_vpc.main_route_table_id]
}

resource "aws_vpc_endpoint" "ecr" {
  vpc_id              = aws_vpc.llm_vpc.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private_llm[*].id
  security_group_ids  = [aws_security_group.vpc_endpoints.id]
  private_dns_enabled = true
}

# Security group for LLM endpoints
resource "aws_security_group" "llm_endpoint" {
  name_prefix = "llm-endpoint-"
  vpc_id      = aws_vpc.llm_vpc.id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"]  # Only from within VPC
  }

  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"]  # Restrict egress
  }

  tags = {
    Name = "llm-endpoint-sg"
  }
}

Network Segmentation Strategy