Best Practice- Security Group architecture
Hi,
I would like to ask about the best approach for setting up a 3-tier application hosted on AWS using EC2 with Auto Scaling and RDS. Specifically, I’m trying to decide between two options for security group configuration:
- Creating a unified security group that contains all the required open ports and attaching it to the Auto Scaling instances through the launch template.
- Creating individual security groups for each service, such as
security-group-vpc,security-group-alb, etc.
What is considered best practice, especially since I am working with Terraform? Are there any AWS recommendations for this setup?
Additionally, in our case, there is the possibility of replicating the infrastructure in other regions, and I aim to organize everything to ensure the security groups are clear and manageable without unnecessary dependencies.
Thank you!
- Language
- English
asked 2 years ago1.2K views
- Newest
- Most votes
- Most comments
You should create a separate security group for every set of workloads with different connectivity requirements.
For example, your ALB will likely be receiving traffic from the public internet or at least large IP ranges on your internal network, while the RDS database will not be doing either. The EC2 instances in your autoscaling group will be receiving HTTPS or HTTP connections from the ALB, and the EC2 instances will also be connecting to the RDS database, making the EC2 instances distinctly different from the ALB and the RDS database. The RDS database, in turn, will be receiving database connections from the EC2 instances but nothing directly from the ALB, and the RDS database won't likely be initiating any outgoing connections in your scenario.
You should think of the concept of security "group" as grouping resources with identical connectivity needs. Your autoscaling group is a good example of a situation where a literal group of virtual machines will get created, all sharing the exact same connectivity requirements. That's why the ASG should have its own security group.
For connecting from the ASG's instances to the RDS database, the RDS database needs its own security group, so that you can reference the security group ID of the ASG in the inbound rules of the RDS to allow the inbound traffic, and optionally, if you're restricting outbound traffic, you can also reference the RDS database's security group as the destination of outbound connections from the instances in the ASG.
Relevant content
asked 2 years ago
asked 2 years ago
