Security group outbound rules for RDS, ElastiCache, EFS
0
We are using RDS PostgreSQL, ElastiCache Redis and EFS as managed services. For each service we have currently our security group allow any IPv4 outbound connections. We want to restrict this. Do we need to add any specific protocols/ports/destinations so that AWS can maintain the managed services, i.e. for performing updates?
asked 3 months ago11 views
1 Answers
1
Hello,
I don't have the answer for ElastiCache and EFS, however for RDS you don't need to allow any outbound connections by default. All the communication the service itself needs to function is done over a different networking path (a separate internal networking interface not impacted by the security group).
Regards
answered 2 months ago
Relevant questions
Security group outbound rules for RDS, ElastiCache, EFS
asked 3 months agoPlans for more allowing more than 2 other regions for secondary clusters in Elasticache for Redis Global Datastore?
asked 5 months agoElasticache Redis 6 multi-threading enabled?
asked a month agoElasticache for Redis cluster service update got stuck
asked 4 months agoAmazon Aurora Postgresql views be loaded to ElastiCache for Redis
asked 5 months agoCan I set a security group for each workspace that is launched?
asked 3 months agoProblem upgrading AWS ElastiCache Redis cluster
asked 4 months agoElastic BeanStalk can't connect to ElastiCache Redis
asked 17 days agoElastiCache for Redis load distribution
asked 5 months agoHow to whitelist an RDS endpoint
asked 17 days ago
Thanks for your answer. Since, you mentioned the separate network interface, I hope it's ok to ask an extended question: Does AWS require any specific network ACL inbound/outbound rules to maintain services such as RDS? We would like to adapt the network ACLs to our particular applications running on AWS infrastructure, too. In case we would create a custom network ACL only allowing HTTPS for a specific source/destination IPv4 address, is it still possible that AWS can maintain the managed services? Can AWS then still install updates for RDS or ElastiCache even if the network ACLs do not allow any inbound/outbound connections for that? If not, which protocol, ports and destinations need to be allowed?