Ingress vs. Egress in the cloud

Learning Center | Cloud Security | What do Egress and Ingress Mean in the Cloud?

Learning Objectives

• Egress means exiting the cloud
• Ingress means entering the cloud

MORE CLOUD SECURITY & OPERATIONS ARTICLES

What is Site to Cloud VPN?
What Do Egress and Ingress Mean in the Cloud?
What is the AWS Console?
Why Use Egress Filtering?
What does AWS Networking Services Offer?
What are Security Groups in AWS?
Network Security in Azure
What is Azure Firewall?
How do I create Network Security Groups in Azure?
What is Azure Network Security Group?
What is Azure Express Route?
What is Azure Network Virtual Appliance (NVA)?

The definitions of Egress and Ingress for the cloud

What is egress?

Egress in the world of networking implies traffic that exits an entity or a network boundary. While in service provider types of networks this is pretty clear, in the case of a datacenter or cloud it is slightly different.

In the cloud, Egress still means traffic that’s leaving from inside the private network out to the public internet, but Ingress means something slightly different. To be clear private networks here refers to resources inside the network boundary of a data center or cloud environment and its IP space is completely under the control of an entity who operates it.

Since traffic often is translated using NAT in and out of a private network like the cloud, a response back from a public endpoint to a request that was initiated inside the private network is not considered Ingress. If a request is made from the private network out to a public IP, the public server/endpoint responds back to that request using a port number that was defined in the request, and firewall allows that connection since its aware of an initiated session based on that port number. See picture below for reference.

Egress:

What is ingress?

With Egress out of the way, let’s define Ingress. Ingress is traffic that enters the boundary of a network. As you might be guessing by now, Ingress more specifically refers to unsolicited traffic sent from an address in public internet to the private network – it is not a response to a request initiated by an inside system. In this case, firewalls are designed to decline this request unless there are specific policy and configuration that allows ingress connections. See picture below for reference.