Secure Global Supply Chain - WAF solution for Cloudera on Cloud

Overview

Secure Global Supply Chain - Highly secure internet-facing WAF solution for data ingestion & consumption scalability

This new Layer 7 + WAF (Web Application Firewall) consumption layer architecture address by design supply chain scalabilities issues, allowing to decommission costly VPN hardware, while seamlessly elevating security posture for modern threads.

Key Highlights & Architecture

• Strategic Shift: We are enhancing the existing CDP ingress stack with an Application Load Balancer (ALB) paired with a WAF filtering, adding a robust perimeter shield that complements Apache Knox/Istio without requiring intrusive changes to our products.
• Advanced Threat Protection: The L7 consumption layer offloads edge TLS termination, advanced HTTPS payload real-time inspection, DDoS mitigation, and active threat mitigation with AWS-Managed rules.
• Proven Performance: During the live demonstration, the WAF successfully blocked simulated SQL injections and malicious file uploads. We also confirmed zero performance degradation when routing high-volume traffic (200,000 rows) through JDBC connections.

What contains? Terraform module for automated publishing an existing CDP DataLake Knox gateway, on a customer-owned domain behind AWS CloudFront+WAF, ACM for certs, and Route53

What it needs

• Cloud Provider
• Human Final Approval
• Cloud Provider
• Cloud Provider
• Data Residency Region
• Data Residency Region

How it runs

It can be connected to an existing Cloudera environment, or deploy a new one end to end from scrath.

Optional: This same business logic can be done using Azure Frontdoor, GCP, Cloudflare, etc. Contact us if you require adaptation.