Lock down the database

intermediate

Scenario & brief

A security review flagged the database: it's in a public subnet, its security group allows ingress from the internet, and it has no encryption at rest or in transit.

Lock it down:

keep the ALB internet-facing and the app in a private subnet,
move the database to a private subnet, not reachable from the internet,
restrict its security group to accept traffic only from the app tier,
turn on encryption at rest and in transit, and
provide NAT for private-subnet egress.

1,000 rps peakp99 ≤ 200ms99.9% availdurability: criticalbudget $200/mo

Load Balancer

Networking

Subnet placement

Allowed ingress (security group)

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture0

Connectivity50

Requirements met25

Requirements

Load balancer is internet-facing — internet-facing (need internet-facing)
App servers in a private subnet — private subnet (need private subnet)
Database in a private subnet — public subnet (need private subnet)
Database not reachable from the internet — internet-reachable (need not internet-reachable)
Database accepts traffic only from the app tier — from internet (need only from app)
Database encrypted at rest — plaintext (need encrypted at rest)
Database traffic encrypted in transit — cleartext (need encrypted in transit)
Private subnets egress via NAT — no NAT (need private egress via NAT)

Advisor

Database in a private subnet: Move it to the private subnet.
Database not reachable from the internet: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.
Database accepts traffic only from the app tier: Restrict the security group to accept traffic only from app.
Database encrypted at rest: Enable encryption at rest.
Database traffic encrypted in transit: Require TLS/HTTPS in transit.
Private subnets egress via NAT: Add a NAT gateway so private-subnet resources can reach the internet for updates without being exposed.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.