30.3 Network Security in AWS
Security groups are stateful firewalls on each instance (Chapter 12). NACLs are stateless firewalls on each subnet – a second layer.
Good design for the reels app:
| Resource | Inbound rule | Why |
|---|---|---|
web-sg (EC2) |
80, 443 from 0.0.0.0/0 |
Public website |
web-sg (EC2) |
22 from your IP only (/32) |
SSH never open to the world |
db-sg (RDS) |
3306 from web-sg only |
Database reachable only by the web server |
Rules to follow:
- Never
0.0.0.0/0on 22 (SSH), 3389 (RDP), 3306 (MySQL) or 5432 (PostgreSQL). Internet-wide scanners (Chapter 19) find open ports within minutes. - Put databases in private subnets with "Publicly accessible = No".
- Better than SSH: AWS Systems Manager Session Manager gives a shell with no open port 22 at all, and every session is logged.
- Use a VPC endpoint for S3 so private instances reach S3 without going over the internet.
# Find any security group that allows SSH from the whole internet
aws ec2 describe-security-groups \
--filters Name=ip-permission.from-port,Values=22 Name=ip-permission.cidr,Values=0.0.0.0/0 \
--query "SecurityGroups[].[GroupId,GroupName]" --output table
Ravindra Bagale's Tip
"It wouldn't connect, so I opened all traffic to 0.0.0.0/0" – that works in a lab, but in production it is an accident waiting to happen. Once the problem is solved, close the rule immediately. Also, your laptop's IP changes, so select "My IP" again in the SSH rule, not 0.0.0.0/0.
Ravindra Bagale's Tip – मराठी
"Connect होत नाही म्हणून 0.0.0.0/0 all traffic open केला" – हे lab मध्ये चालते पण production मध्ये अपघात आहे. Problem solve झाला की rule लगेच बंद करा. आणि laptop चा IP बदलतो, म्हणून SSH rule मध्ये "My IP" पुन्हा select करा, 0.0.0.0/0 नाही.
Ravindra Bagale's Tip – हिंदी
"Connect नहीं हो रहा था इसलिए 0.0.0.0/0 all traffic open कर दिया" – यह lab में चलता है पर production में हादसा है. Problem solve होते ही rule तुरंत बंद करो. और laptop का IP बदलता है, इसलिए SSH rule में "My IP" फिर से select करो, 0.0.0.0/0 नहीं.
Lab
Run the CLI command above in your account. For every group it lists, change the SSH source to "My IP". Then confirm your RDS instance has "Publicly accessible: No" and db-sg allows 3306 only from web-sg.