Least-privilege security groups

advanced

Scenario & brief

The subnets are laid out correctly, but the security groups are lazy — each tier allows ingress from the entire VPC. That means a foothold anywhere gives an attacker lateral access to everything.

Apply least privilege so each tier accepts traffic only from its immediate upstream:

ALB internet-facing, web ← ALB, app ← web, data ← app, and
the database must not be reachable from the internet.

2,000 rps peakp99 ≤ 200ms99.95% availdurability: criticalbudget $200/mo

Load Balancer

Networking

Allowed ingress (security group)

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture25

Connectivity100

Requirements met40

Requirements

Load balancer is internet-facing — internet-facing (need internet-facing)
Web tier accepts only from the ALB — from vpc (need only from alb)
App tier accepts only from the web tier — from vpc (need only from web)
Data tier accepts only from the app tier — from vpc (need only from app)
Database not reachable from the internet — isolated (need not internet-reachable)

Advisor

Web tier accepts only from the ALB: Restrict the security group to accept traffic only from alb.
App tier accepts only from the web tier: Restrict the security group to accept traffic only from web.
Data tier accepts only from the app tier: Restrict the security group to accept traffic only from app.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.