This page applies only to Cloud Platform. To access the documentation, select Cloud Platform from the infrastructure list.

Enterprise Security Package

In addition to the various base features that are available out-of-the box in Enterprise Security Package (ESP), you can use the following security-related paid features that are available in ESP. For more information about ESP, visit Cloud Platform Product Guide.

These features are built on the Kubernetes infrastructure unlike the legacy Shield offering, which is built on non-Kubernetes infrastructure. These features enable organizations to implement enhanced security controls and maintain strict compliance requirements for their digital experiences. You can get seamless network isolation, secure connectivity, and flexible access management capabilities. Also, subscriber deployments in an isolated network environment are separated from other subscriber deployments at the network level.

This set of features uses a modern, integrated approach that allows you to manage advanced network configurations and security controls for your Cloud Platform applications. Like , it provides enterprise-grade networking capabilities that enable you to implement robust security measures and maintain strict compliance requirements. This solution addresses the demanding security requirements of organizations that operate in highly regulated environments.

This page applies only to Cloud Platform. To access the documentation, select Cloud Platform from the infrastructure list.

Enterprise Security Package

These features are built on the Kubernetes infrastructure unlike the legacy Shield offering, which is built on non-Kubernetes infrastructure. These features enable organizations to implement enhanced security controls and maintain strict compliance requirements for their digital experiences. You can get seamless network isolation, secure connectivity, and flexible access management capabilities. Also, subscriber deployments in an isolated network environment are separated from other subscriber deployments at the network level.

This page applies only to Cloud Platform. To access the documentation, select Cloud Platform from the infrastructure list.

Enterprise Security Package

These features are built on the Kubernetes infrastructure unlike the legacy Shield offering, which is built on non-Kubernetes infrastructure. These features enable organizations to implement enhanced security controls and maintain strict compliance requirements for their digital experiences. You can get seamless network isolation, secure connectivity, and flexible access management capabilities. Also, subscriber deployments in an isolated network environment are separated from other subscriber deployments at the network level.

This set of features uses a modern, integrated approach that allows you to manage advanced network configurations and security controls for your Cloud Platform applications. Like Shield, it provides enterprise-grade networking capabilities that enable you to implement robust security measures and maintain strict compliance requirements. This solution addresses the demanding security requirements of organizations that operate in highly regulated environments.

Adds an optional Virtual Private Network (VPN) hosted by Cloud Platform to connect between Cloud Platform and your private network. The VPN connection ensures that you have secure bi-directional interaction between your websites and your internal IT systems such as CRM.

To enable the VPN, you must first buy a subscription to Cloud Platform. If you change endpoints during the
Subscription
Term, you will incur added fees of $250 per hour of work. For Acquia to enable the VPN connection, you must meet the technical requirements described in the Amazon VPC FAQs.

Note

Internal DNS

These features do not support resolution to your internal DNS servers. Although they provide access to your internal network through a VPN gateway, your network systems are only accessible through IP. Therefore, if you have a service or site in your internal network that changes IP addresses and resolves to an internal-only DNS, the system does not resolve the domain for that service or site.

Shared Services

Cloud Platform shared services are not hosted in your VPC. This includes, but is not limited to:

Git, which is your code repository
Acquia Search
CD and IDE environments
Any SaaS offerings

Feature	Shield	Security features in ESP
Network Isolation	Provides network isolation for production and non-production servers based on EC2 instances in separate VPCs.	Provides network isolation for environments based on Kubernetes infrastructure, with isolated pods in subnet.
VPN Support	Supports VPN connectivity with IKEv1 and IKEv2.	Maintains existing VPN connections and configurations.
IP Allowlisting for SSH access	Is available for Shield subscribers on Cloud Platform Enterprise and has a limit of 25 IP addresses or CIDR ranges.	Preserves existing security configurations.
Infrastructure	Is based on the traditional non-Kubernetes infrastructure.	Is based on the modern Kubernetes infrastructure.
Performance	Supports standard performance.	Supports enhanced performance and scalability.

Control how your applications are accessed.
Manage applications that are hosted in isolated networks within the Acquia infrastructure.
Establish secure connections between your network and Cloud Platform.
Configure private access patterns for both incoming SSH traffic and outgoing VPN or VPC Peering traffic.
Operate under strict compliance requirements.
Maintain private network connections to internal systems.
Maintain granular control over application access.
Implement network-level security controls.
Isolate sensitive applications and data.

A private network can have a minimum of 0 and a maximum of 100 environments.
All environments in the single private network must belong to the same region.
A private network can have a minimum of 0 and a maximum of 10 VPNs.
A private network can have a minimum of 0 and a maximum of 10 VPC peers.
For ACLs, access restriction can be applied to a maximum 25 IP addresses.
After the first connection of VPN and VPC Peer, additional connections will incur extra charges.

Network isolation refers to a configuration where applications operate on a dedicated pool of nodes in a Kubernetes cluster. These nodes are situated in a specific set of subnets to ensure that the applications have their own isolated environment. This setup provides an additional layer of isolation beyond the standard capabilities of Kubernetes to ensure that the application does not share memory, compute, or disk resources with applications that belong to other customers.

Dedicated resource Pools:
Applications are allocated exclusive resources to ensure that they do not compete with other applications for memory, CPU, or storage. Each application is completely separated from others to ensure that performance and security are not compromised by neighboring applications.

However, if your private network has multiple applications and if you want to have dedicated resources for each of such applications, you must have multiple private networks.
Enhanced security:
By isolating applications at the network level, the risk of unauthorized access or data breaches at node level is significantly reduced. Applications are shielded from potential vulnerabilities that could arise from shared environments. This isolation minimizes the risk of cross-application attacks and data leaks.
Compliance assurance:
This setup helps meet strict security and compliance requirements, which are often mandated by industry regulations. Network isolation provides a controlled and secure environment to help organizations meet these requirements.
Preservation of Kubernetes advantages:
Despite the added isolation, the benefits of Kubernetes, such as scalability, flexibility, and efficient resource management, are maintained.

Applications requiring strict resource isolation:
Ideal for applications that demand high levels of security and performance, where resource sharing could lead to potential risks or inefficiencies.
Compliance-driven deployments:
Suitable for industries such as finance, healthcare, and government, where regulatory compliance is critical, and data protection is paramount.
Security-sensitive Implementations:
Suitable for applications that handle sensitive data or perform critical operations, where any compromise could have significant consequences.

Adds an optional Virtual Private Network (VPN) hosted by Cloud Platform to connect between Cloud Platform and your private network. The VPN connection ensures that you have secure bi-directional interaction between your websites and your internal IT systems such as CRM.

To enable the VPN, you must first buy a subscription to Cloud Platform. If you change endpoints during the
Subscription
Term, you will incur added fees of $250 per hour of work. For Acquia to enable the VPN connection, you must meet the technical requirements described in the Amazon VPC FAQs.

Note

Internal DNS

Shared Services

Cloud Platform shared services are not hosted in your VPC. This includes, but is not limited to:

Git, which is your code repository
Acquia Search
CD and IDE environments
Any SaaS offerings

Feature	Shield	Security features in ESP
Network Isolation	Provides network isolation for production and non-production servers based on EC2 instances in separate VPCs.	Provides network isolation for environments based on Kubernetes infrastructure, with isolated pods in subnet.
VPN Support	Supports VPN connectivity with IKEv1 and IKEv2.	Maintains existing VPN connections and configurations.
IP Allowlisting for SSH access	Is available for Shield subscribers on Cloud Platform Enterprise and has a limit of 25 IP addresses or CIDR ranges.	Preserves existing security configurations.
Infrastructure	Is based on the traditional non-Kubernetes infrastructure.	Is based on the modern Kubernetes infrastructure.
Performance	Supports standard performance.	Supports enhanced performance and scalability.

Control how your applications are accessed.
Manage applications that are hosted in isolated networks within the Acquia infrastructure.
Establish secure connections between your network and Cloud Platform.
Configure private access patterns for both incoming SSH traffic and outgoing VPN or VPC Peering traffic.
Operate under strict compliance requirements.
Maintain private network connections to internal systems.
Maintain granular control over application access.
Implement network-level security controls.
Isolate sensitive applications and data.

A private network can have a minimum of 0 and a maximum of 100 environments.
All environments in the single private network must belong to the same region.
A private network can have a minimum of 0 and a maximum of 10 VPNs.
A private network can have a minimum of 0 and a maximum of 10 VPC peers.
For ACLs, access restriction can be applied to a maximum 25 IP addresses.
After the first connection of VPN and VPC Peer, additional connections will incur extra charges.

Dedicated resource Pools:
Applications are allocated exclusive resources to ensure that they do not compete with other applications for memory, CPU, or storage. Each application is completely separated from others to ensure that performance and security are not compromised by neighboring applications.

However, if your private network has multiple applications and if you want to have dedicated resources for each of such applications, you must have multiple private networks.
Enhanced security:
By isolating applications at the network level, the risk of unauthorized access or data breaches at node level is significantly reduced. Applications are shielded from potential vulnerabilities that could arise from shared environments. This isolation minimizes the risk of cross-application attacks and data leaks.
Compliance assurance:
This setup helps meet strict security and compliance requirements, which are often mandated by industry regulations. Network isolation provides a controlled and secure environment to help organizations meet these requirements.
Preservation of Kubernetes advantages:
Despite the added isolation, the benefits of Kubernetes, such as scalability, flexibility, and efficient resource management, are maintained.

Applications requiring strict resource isolation:
Ideal for applications that demand high levels of security and performance, where resource sharing could lead to potential risks or inefficiencies.
Compliance-driven deployments:
Suitable for industries such as finance, healthcare, and government, where regulatory compliance is critical, and data protection is paramount.
Security-sensitive Implementations:
Suitable for applications that handle sensitive data or perform critical operations, where any compromise could have significant consequences.

Enterprise Security Package

Network Isolation

Private SSH Access

Private Egress Using VPN and VPC Peering

Enterprise Security Package

Network Isolation

Private SSH Access

Private Egress Using VPN and VPC Peering

Enterprise Security Package

Network Isolation

Private SSH Access

Private Egress Using VPN and VPC Peering

Key benefits

Differences with legacy Shield

Use cases

Use the security-related features in ESP to do the following:

Quotas and constraints

Network isolation

Key features of network isolation

Use cases for of network isolation

Network isolation infographic

Did not find what you were looking for?

Key benefits

Differences with legacy Shield

Use cases

Use the security-related features in ESP to do the following:

Quotas and constraints

Network isolation

Key features of network isolation

Use cases for of network isolation

Network isolation infographic

Did not find what you were looking for?