CloudGuard IaaS Public Cloud Architecture Reference and Best Practices - Guide for Successful Lift and Shift Secure Migration Model for Microsoft Azure, AWS, and Google Cloud Platform

Oct 25, 2026

This white paper provides security reference architectures for public cloud IaaS, leveraging CloudGuard Network Security to support a Zero Trust approach. It explains how organizations can plan and execute secure lift and shift migrations across Microsoft Azure, Amazon Web Services, and Google Cloud Platform, aligned to business requirements and shared responsibility. It includes use cases, architecture diagrams, IaaS security segmentation, transit security hub concepts, and guidance for security and networking engineers and architects.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages71

Reading Time2 h 59 min

AccessFree to download

Introduction

What is Lift-and-Shift?

Lift-and-Shift Optimized Model

Shared Responsibility for Public IaaS

Zero Trust Model

IaaS Security Segmentation

HUB-AND-SPOKE PRINCIPLES

High-Level Security Design

Reference Architecture for Public Cloud IaaS

Macro-Segments and Micro-Segments With Transit Security Hubs

Microsoft Azure Security Architecture

Google Cloud Platform (GCP) Security Architecture

Amazon Web Services (AWS) Security Architecture

Transit Gateway Appliance Mode and GWLB - Gateway Load Balancer

Use Cases

Ingress Traffic to the Public Cloud

Egress Traffic

East-West Traffic in the Public Cloud

Data Center On-Premises Traffic to the Cloud

Remote Access to Corporate Resources Using the Public Cloud (SASE)

Consolidated Cloud Security Management

Infrastructure as Code

Infrastructure as Code Posture Management

Conclusion

Security Reference Architectures for Public Clouds Using CloudGuard Network Security Guide for a Successful Lift and Shift Secure Migration Model for Microsoft Azure, Amazon Web Services, and Google Cloud Platform ABSTRACT This white paper outlines use cases, architecture diagrams, and a Zero Trust approach that will allow organizations to build the best strategy for a public cloud data center. CloudGuard Network Security will be used to design the strategy , according to the organization’s business needs, within a variety of cloud service providers. AUDIENCE The desire to transition from a hardware-centric to an application-centric network construct is driving more and more organizations to embrace the cloud as part of their IT strategy. As a result, businesses are rapidly adopting cloud-based solutions to virtualize their data centers, as well as extending applications and data to public cloud environments. This white paper aims to provide the reader with reference architectures using different technical examples taken from Microsoft Azure, Amazon Web Services, the Google Cloud Platform, and Check Point Software Technologies, as well as from a variety of technical blogs. The information presented in this paper is intended to educate and enable security and networking engineers, solution architects, and designers who would like to integrate public cloud IaaS solutions and Check Point technology for advanced security. To get the most from this paper, the reader should be well versed in cloud computing, network and security design, as well as Zero Trust methodologies. TABLE OF CONTENTS INTRODUCTION ............................................................................................................................................... 4 What is Lift-and-Shift? ........................................................................................................................................................ 4 Lift-and-Shift Optimized Model ........................................................................................................................................... 4 Shared Responsibility for Public IaaS................................................................................................................................. 5 Zero Trust Model................................................................................................................................................................. 6 IaaS Security Segmentation ............................................................................................................................................... 7 HUB-AND-SPOKE PRINCIPLES....................................................................................................................... 9 High-Level Security Design .............................................................................................................................................. 10 REFERENCE ARCHITECTURE FOR PUBLIC CLOUD IAAS ......................................................................... 12 Macro-Segments and Micro-Segments With Transit Security Hubs ................................................................................ 12 Microsoft Azure Security Architecture............................................................................................................................... 19 Google Cloud Platform (GCP) Security Architecture ........................................................................................................ 20 Amazon Web Services (AWS) Security Architecture ....................................................................................................... 22 Transit Gateway Appliance Mode and GWLB – Gateway Load Balancer............................................................... 24 USE CASES ........................................................................................................

FAQs

What is the main purpose of the white paper?

It outlines security reference architectures and a Zero Trust approach for public cloud IaaS using CloudGuard Network Security, enabling secure lift-and-shift migrations across major cloud providers.

Which cloud platforms are covered for the reference architectures?

The paper covers Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP), along with related Check Point technology and technical examples.

Who is the intended audience for this document?

It is aimed at security and networking engineers, solution architects, and designers who want to integrate public cloud IaaS solutions with Check Point technology for advanced security.

Oct 25, 2026

Upload by Aria Callaghan