advanced
Scenario & brief The application takes unfiltered traffic straight from the internet — no
WAF to block common exploits and bots — and the tiers behind the ALB are
loosely exposed.
Harden the edge:
put a WAF in front (enable it),
the ALB should accept traffic only from the WAF ,
app and database belong in private subnets , the database not
internet-reachable and encrypted at rest , andprovide NAT for private egress.
3,000 rps peak p99 ≤ 200ms 99.95% avail durability: critical budget $200/mo
disabled
—
public · ← internet
$22/mo
public · ← internet
—
public · ← internet
—
disabled
—
WAF Load Balancer App Servers RDS Database NAT Gateway System health
Erupting · SLA breach
Budget $200/mo · within budget
Requirements
WAF is enabled at the edge — disabled (need enabled) Load balancer accepts only from the WAF — from internet (need only from waf) App servers in a private subnet — public subnet (need private subnet) Database in a private subnet — public subnet (need private subnet) Database not reachable from the internet — internet-reachable (need not internet-reachable) Database encrypted at rest — plaintext (need encrypted at rest) Private subnets egress via NAT — no NAT (need private egress via NAT) Advisor
WAF is enabled at the edge: Turn this protection on. Load balancer accepts only from the WAF: Restrict the security group to accept traffic only from waf. App servers in a private subnet: Move it to the private subnet. Database in a private subnet: Move it to the private subnet. Database not reachable from the internet: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet. Database encrypted at rest: Enable encryption at rest. Discussion top newest oldest
Sign in to join the discussion.
No comments yet. Be the first to start the discussion.
For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.
