Network segmentation isolates CDE from non-cardholder systems

PCI-DSS 4.0 Req 1.2 requires that network security controls are defined, implemented, and maintained; Req 1.3 prohibits direct connections between the internet and any component in the CDE. A flat network where your payment webhook receiver, application database, and CDE share a single VPC and security group means any web-layer compromise — SSRF, RCE in a dependency — provides direct lateral movement to cardholder data with no network barrier. CWE-668 (Exposure of Resource to Wrong Sphere) and NIST SC-7 (Boundary Protection) both require explicit network segmentation between trust zones. OWASP A05 (Security Misconfiguration) flags flat networks as a routine finding.

Separate CDE resources into their own VPC or subnet with explicit security group rules that restrict cross-zone traffic. Internet traffic must transit a DMZ layer (ALB, WAF, or API Gateway) before reaching the application tier, and the application tier must use a separate security group from the CDE. Add an ASCII architecture diagram to docs/cde-architecture.md so the boundary is auditable.

# Dedicated CDE VPC
resource "aws_vpc" "cde" {
  cidr_block = "10.1.0.0/16"
  tags       = { Name = "cde-vpc" }
}

# CDE security group — only accepts traffic from app tier
resource "aws_security_group" "cde" {
  vpc_id = aws_vpc.cde.id
  ingress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.app.id]
  }
}