Strategies to Optimize AWS Security Group Port Configuration
Hello! How I can narrow down/limit the ports of an existing Security Group that currently allows all traffic. How can I validate which destinations and ports I actually need to permit while blocking the rest of the traffic, ensuring that it doesn't affect the operation of the workload? Thank you!
- 최신
- 최다 투표
- 가장 많은 댓글
You could use Flow logs to see the in and out traffic for the hosts in question to help minimise the access.
But overly, knowing how your application or system works should dictate what ports you allow in or out.
Flow Logs are a good way of achieving this. For example, you can enable them on the network interfaces that use the Security Group in question and leave them running for some time until they collect enough information about your traffic.
Currently Flow Logs can publish data to CloudWatch Logs, Amazon S3 and Kinesis Data Firehose.
Once the data has been collected, there are several ways you can analyse it. For example, use CloudWatch Logs Insights or Amazon Athena.
It should give you fairly good understanding of what ports and IPs are used. Always keep in mind that Flow Logs should run for long enough to make sure that they capture all ports and IPs that your applications may need. It is better to double-check and schedule a maintenance window to apply changes to Security Groups if you are not sure and want to test how it is going to affect your workload.
Don't forget to consider the pricing when collecting a lot of data with the help of Flow Logs.
관련 콘텐츠
AWS 공식업데이트됨 일 년 전
