Continuing from the previous example, it may not be enough to just group your servers by function. The previous example would work great for general web pages that are accessible to the public, but would not work well if the applications needed to be controlled are on a per-client or per-system basis.

Refer to the following diagram:

This diagram looks very similar to the previous one, except we have simplified it down to a single application with separate front-end instances. The database instance still contains a security group that allows anything in the web interfaces (sg-1 and sg-2) while the web interfaces are bound to an organization (the client).

In the previous functional firewall pattern, these web interfaces would have the same Security Group; however, by binding them to an organization (such as a consuming system or client), we can easily change what is relevant to that organization without affecting the others. This might include managing a client-specific...