Network ACLs for External Data Sources

Security Recommendation

If access to external data sources will come from specific known sources, network ACLs SHOULD be implemented to allow access only from those known sources. This provides a network-level defense-in-depth layer on top of authentication and authorization.

Defense-in-Depth Value

Network ACLs complement authentication and authorization by restricting which network locations can even attempt to connect:

Network ACLs (can this source IP/network connect at all?)
  → Authentication (is this principal who they claim to be?)
    → Authorization (does this principal have permission?)
      → Data access (execute the query/operation)

Even if credentials are compromised, network ACLs prevent their use from unauthorized network locations.