Alfa-Bank has described how it migrated regulated on-premises workloads into Yandex Cloud while maintaining its existing Zero Trust posture alongside a new Cloud Trust model of shared responsibility.
The bank began with a classic perimeter-based architecture that enforced strict network segmentation and default-deny policies. When teams requested access to external cloud resources, traditional controls proved insufficient because Yandex Cloud exposes public APIs protected primarily by RBAC, policies, and ACLs rather than network firewalls.
Network Access
Engineers established a dedicated interconnect consisting of dark fiber between the bank and the cloud provider, encrypted with GOST algorithms. All management, integration, and data-plane traffic traverses this link. On-premises network objects were replicated in the cloud: each system maps to a cloud, each environment to a folder, and each folder contains isolated networks protected by Security Groups. IP address pools are announced across the interconnect so cloud subnets appear as additional data-center segments within the bank’s existing IP-address management system.
User Access
Authentication remains anchored in on-premises Active Directory and KeyCloak instances that are federated with Yandex Cloud IAM. Authorization is delegated to cloud-native service roles that map directly to Active Directory groups, preserving least-privilege principles while allowing teams to continue using familiar approval workflows.
Configuration Control
Every cloud project must produce architecture documentation that is reviewed before resources are provisioned through an internal platform integrated with the cloud API. The bank maintains an allow-list of approved managed services and enforces configuration standards through custom Cloud Security Posture Management checks written in code. Where internal expertise is limited, the team supplements its scanner with Yandex Security Deck modules.
SOC and Logging
Because the bank cannot collect every log type directly, it uses the provider’s YCDR service for detection and response while retaining full control over on-premises logs. This hybrid monitoring approach covers both control-plane and data-plane events generated inside Yandex Cloud.
The resulting environment currently runs 1,500 virtual machines, 100 managed services, and supports 1,000 identities. Alfa-Bank concludes that security in hybrid infrastructure requires deliberate decisions about where to retain control and where to accept Cloud Trust delegation, rather than attempting to enforce either model exclusively.
