--- title: Brokering Other Cloud Resources Behind AWS Services description: Places like DigitalOcean and Vultr have beefy systems for less --- [Skip to content](https://blog.reconinfosec.com/brokering-other-cloud-resources-behind-aws-services#main-content) [![recon_infosec.png](https://blog.reconinfosec.com/hs-fs/hubfs/recon-logo-full-on-white.png?width=7680&height=2304&name=recon-logo-full-on-white.png "recon_infosec.png")](http://reconinfosec.com) - [Website Home](https://www.reconinfosec.com/) - [Website Home](https://www.reconinfosec.com/) # Brokering Other Cloud Resources Behind AWS Services [Whitney Champion](https://blog.reconinfosec.com/author/whitney-champion) I tweeted this the other day, and had a lot of folks reach out asking for more details/a diagram of this setup. > places like digitalocean and vultr have beefy systems for less > > SO, we stand up a big system there, and a small proxy in AWS behind an ALB/cognito/okta > > lock them down, join them to the same [@ZeroTier](https://twitter.com/ZeroTier?ref_src=twsrc%5Etfw) network, and 💥 > > less AWS$, secure, reliable > > — Whitney Champion (@shortxstack) [November 20, 2019](https://twitter.com/shortxstack/status/1197153650684116992?ref_src=twsrc%5Etfw) As I mentioned in the tweet, sometimes we need to spin up ad-hoc systems on the fly. Often times, it's for an incident response engagement. We're huge fans of [Skadi](https://github.com/orlikoski/Skadi) and Timesketch--these things need a LOT of horsepower. That comes at a price, as many of you know, especially in some of the bigger cloud providers. We're also huge fans of Vultr and Digital Ocean. They provide that horsepower for a lot less money, BUT, they don't have all the other bells and whistles that AWS provides us. Problem is, some of those bells and whistles we absolutely need. We use Okta for just about everything in our organization. Single sign on / multifactor is critical. For a lot of our infrastructure, we can do this very easily by integrating it with AWS Cognito and our ALB's. We also have other mechanisms in place in various Lambda functions that handle other pieces of the auth flow. We wanted the best of both of these worlds. Cheaper systems, with all the same security as the rest of our infrastructure. Who doesn't, right? This is basically what that looks like. ![Generic-Network-Diagram](https://blog.reconinfosec.com/hs-fs/hubfs/Imported%20sitepage%20images/Generic-Network-Diagram.png?width=676&name=Generic-Network-Diagram.png) We spin up a small instance (Nginx, Apache, HAProxy, it can be whatever you want) in AWS. We have our Big Giant Server in Vultr (or the provider of your choice). We are heavy users of [ZeroTier](https://zerotier.com/), a mesh VPN service (you should go read more about it in Eric's blog posts [here](https://blog.reconinfosec.com/build-a-private-mesh-network-for-free/) and [here](https://blog.reconinfosec.com/locking-down-zerotier/)). We install ZeroTier on each system, and join them to the same network. This allows them to talk to each other and literally takes seconds to set up. Cognito (handling our Okta integration) is in front of the ALB, which is in front of the proxy, which sends us straight to our Big Giant Server. SSH is via bastion and VPN only, and absolutely nothing is open to the public except for UDP 9993 (necessary for ZeroTier), and 80/443 for the ALB. There are likely other ways to tackle this problem--this is the route we took, and it works quite well :)       [DFIR](https://blog.reconinfosec.com/tag/dfir), [Operations](https://blog.reconinfosec.com/tag/operations), [SecOps](https://blog.reconinfosec.com/tag/secops), [Security](https://blog.reconinfosec.com/tag/security), [ZeroTier](https://blog.reconinfosec.com/tag/zerotier), [DevOps](https://blog.reconinfosec.com/tag/devops), [AWS](https://blog.reconinfosec.com/tag/aws), [Cognito](https://blog.reconinfosec.com/tag/cognito), [Identity Aware Proxy](https://blog.reconinfosec.com/tag/identity-aware-proxy), [Cloud](https://blog.reconinfosec.com/tag/cloud) ## Read On ### [OPENSOC @ DEF CON 29](https://blog.reconinfosec.com/opensoc-def-con-29) It’s that time of year again - DEF CON! We were thrilled to run[OpenSOC](https://opensoc.io/)again at DEF CON this year,... ### [Locking down ZeroTier peer-to-peer networks](https://blog.reconinfosec.com/locking-down-zerotier) In a[previous post](https://blog.reconinfosec.com/build-a-private-mesh-network-for-free/), we shared our affinity for[ZeroTier](https://www.zerotier.com/): ### [The Infrastructure](https://blog.reconinfosec.com/the-infrastructure) When I joined the OpenSOC team at the beginning of this year, everything resided on 3 Intel Skull... © 2026 All rights reserved. [RSS Feed](https://blog.reconinfosec.com/rss.xml)