Stop the public exposure

beginner

Scenario & brief

A quick audit found three of the most common cloud exposures at once: a publicly reachable database, an S3 bucket open to the internet, and SSH open to 0.0.0.0/0 on the app servers.

Close all three while keeping the load balancer public so the site stays up:

the database must be in a private subnet and not internet-reachable,
the S3 bucket must not be public, and
app-server admin access must not use public SSH — use SSM Session Manager or a bastion instead.

1,000 rps peakp99 ≤ 200ms99.9% availdurability: standardbudget $200/mo

Load Balancer

Networking

Subnet placement

Allowed ingress (security group)

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture0

Connectivity50

Requirements met20

Requirements

Load balancer stays public — internet-facing (need internet-facing)
Database in a private subnet — public subnet (need private subnet)
Database not reachable from the internet — internet-reachable (need not internet-reachable)
S3 bucket is not public — internet-reachable (need not internet-reachable)
No public SSH on the app servers — public SSH open (need no public SSH)

Advisor

Database in a private subnet: Move it to the private subnet.
Database not reachable from the internet: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.
S3 bucket is not public: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.
No public SSH on the app servers: Close public SSH — use SSM Session Manager or a bastion host instead.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.