Ravindra BagaleCourses & study guides

30. Cloud and AWS Security

30.3 Network Security in AWS

By Last updated:

Security groups are stateful firewalls on each instance (Chapter 12). NACLs are stateless firewalls on each subnet – a second layer.

Good design for the reels app:

Resource Inbound rule Why
web-sg (EC2) 80, 443 from 0.0.0.0/0 Public website
web-sg (EC2) 22 from your IP only (/32) SSH never open to the world
db-sg (RDS) 3306 from web-sg only Database reachable only by the web server

Rules to follow:

  • Never 0.0.0.0/0 on 22 (SSH), 3389 (RDP), 3306 (MySQL) or 5432 (PostgreSQL). Internet-wide scanners (Chapter 19) find open ports within minutes.
  • Put databases in private subnets with "Publicly accessible = No".
  • Better than SSH: AWS Systems Manager Session Manager gives a shell with no open port 22 at all, and every session is logged.
  • Use a VPC endpoint for S3 so private instances reach S3 without going over the internet.
# Find any security group that allows SSH from the whole internet
aws ec2 describe-security-groups \
  --filters Name=ip-permission.from-port,Values=22 Name=ip-permission.cidr,Values=0.0.0.0/0 \
  --query "SecurityGroups[].[GroupId,GroupName]" --output table

Ravindra Bagale's Tip

"Connect hot nahi mhanun 0.0.0.0/0 all traffic open kela" – he lab madhe chalte pan production madhe apghat aahe. Problem solve zala ki rule laglech band kara. Aani laptop cha IP badalto, mhanun SSH rule madhe "My IP" punha select kara, 0.0.0.0/0 nahi.

Lab

Run the CLI command above in your account. For every group it lists, change the SSH source to "My IP". Then confirm your RDS instance has "Publicly accessible: No" and db-sg allows 3306 only from web-sg.