Firewalls, security groups, and NACLs make decisions on network attributes: source IP, port, protocol. A stolen API key presented from an allowed network path traverses every one of those controls *legitimately* — the packets are exactly what the rules permit. ## Why the Gap Is Structural Network controls answer "may this address talk to that address?" They cannot answer "is the thing presenting this credential the thing the credential was issued to?" Location on the network proves nothing about identity. This is the one-line justification for zero-trust architecture. ## What Closes It Cryptographic machine identity at the application layer, designed so there is no long-lived secret to steal: - **mTLS with dynamically attested identities** — short-lived X.509 certificates issued to verified workloads ([[SPIFFE Workload Attestation]]) - **Federated token exchange** — workloads trade a signed identity token for temporary credentials ([[Workload Identity Federation]]) A stolen credential is then either expired within minutes or was never stored anywhere to begin with. ## The Layering Rule Keep the network perimeter — it filters noise and bounds blast radius. Just never let it be the *only* control standing between a stolen secret and your data. --- *Source: [[Setup an Egress Path Between Two Cloud Providers]] (NotebookLM)*