A perimeter only exists if the origin can't be bypassed

Some infrastructure decisions are not made by comparing feature lists. The useful question is about order: when you are trying to launch, what do you change first, and what must stay true no matter what?

This is a write-up of a conversation with a DevOps/SRE friend about putting an edge in front of a backend as a security perimeter, without rewriting the backend to get there. I am keeping the reasoning and leaving out the topology.

Don't move runtime and perimeter at the same time

The tempting move, when an edge provider offers a WAF, rate limiting, validation and more, is to migrate everything onto it at once. The more sober answer: if the goal is to launch, control the public entrypoint first and leave compute where it already runs. Changing the runtime and the perimeter in the same step stacks two kinds of risk on top of a deadline. One of them can wait.

An edge reduces surface; it does not grant authorization

It is easy to over-trust a WAF. It filters traffic before it reaches the application, which is valuable — but it does not replace tokens, roles, scopes or business checks. The clean split is: the edge reduces surface and load; the backend stays authoritative about who may do what. A rule you can only justify with "for security" is not finished; a good one names a surface, a risk and an action.

The invariant that actually matters

Here is the part worth keeping: a WAF in front of an origin that still answers direct traffic is protecting one door while another stays open. A perimeter is not "where I put DNS." It only exists when the entrypoint you control is the only way in. Everything else — which controls, in which order — is downstream of that one invariant.

What I took from the SRE lens

• Write the invariants before choosing tools: decide what must always be true, then pick controls that serve those truths.
• Sequence the rollout so you learn legitimate traffic before you block aggressively — strong blocking on day one just manufactures false positives.
• Every security rule needs a rollback plan written before it ships. A rule without one is an outage waiting for a time slot.

The edge is not "where I put DNS." It is the public perimeter — and a perimeter only really exists when the origin cannot be bypassed.

This article is part of my architecture and operations notes. Follow the blog or contact me.