Ravi Sir's Cyber Security Cards › Revision Cards
Planning the Network: Subnet Group and Security Groups
Planning the Network: Subnet Group and Security Groups Before making an RDS database, plan where it lives and who can reach it. Put the database in private subnets . Its security group allows port 3306 only from the web server’s security group ( web-sg ). Port 3306 open to 0.0.0.0/0 is one of the fi
Read card text
What this card says
What it is
Before making an RDS database, plan where it lives and who can reach it.
Key idea
Put the database in private subnets.
Its security group allows port 3306 only from the web server’s security group (web-sg).
Why it matters for security
Port 3306 open to 0.0.0.0/0 is one of the first things scanners find.
Using web-sg as the source means only your web server can connect, even if its IP changes.
| Item | Setting for our project |
|---|---|
| VPC | The same VPC as your EC2 web server (default VPC is fine… |
| DB subnet group | At least two subnets in different Availability Zones… |
| Public access | No |
| Security group for EC2 | web-sg: inbound 80/443 from anywhere, 22 from your IP only |
| Security group for RDS | db-sg: inbound MySQL/Aurora 3306 with source = web-sg (the… |
Learn more in the lesson: 15.2 Planning the Network: Subnet Group and Security Groups