Close public SSH with SSM

intermediate

Scenario & brief

Operators currently SSH to the app servers over port 22 open to 0.0.0.0/0, and the instances sit in a public subnet. That's a standing invitation to brute-force attacks.

Fix admin access:

move the app servers to a private subnet (reachable only from the ALB),
replace public SSH with SSM Session Manager (no inbound port at all), and
give the private subnet NAT egress so the SSM agent can call home. Keep the load balancer public so users still get through.

1,500 rps peakp99 ≤ 200ms99.9% availdurability: standardbudget $200/mo

Load Balancer

Networking

Subnet placement

Allowed ingress (security group)

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture0

Connectivity50

Requirements met33

Requirements

Load balancer stays public — internet-facing (need internet-facing)
App servers in a private subnet — public subnet (need private subnet)
No public SSH — use SSM or a bastion — public SSH open (need no public SSH)
Database in a private subnet — public subnet (need private subnet)
Database not reachable from the internet — internet-reachable (need not internet-reachable)
Private subnets egress via NAT — no NAT (need private egress via NAT)

Advisor

App servers in a private subnet: Move it to the private subnet.
No public SSH — use SSM or a bastion: Close public SSH — use SSM Session Manager or a bastion host instead.
Database in a private subnet: Move it to the private subnet.
Database not reachable from the internet: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.