Three-Tier Network Segmentation with ASGs

Application Security Groups (ASGs) let you group virtual machines by their application role (for example, "web-tier," "app-tier," or "database-tier") without relying on fixed IP addresses. When you reference an ASG as the source or destination in an NSG rule, the rule automatically applies to all VMs that are members of that ASG, even as VMs are added or removed. This logical grouping eliminates the need to update NSG rules whenever the infrastructure scales. ASGs work best when you assign them based on dynamic attributes, such as the workload's function or environment tag, rather than static network location. To enforce least-privilege traffic controls, each application tier should only be able to communicate with the tiers it depends on; for example, the web tier can send traffic to the app tier, and the app tier can send traffic to the database tier, but the database tier should not initiate connections to the web tier.