Security Group's best practice

Question

My website has somehow been infected with a virus, and I believe I need to be more vigilant in managing both inbound and outbound rules.

Here are the current inbound rules:

HTTP: 0.0.0.0/0
HTTPS: 0.0.0.0/0
SSH: 0.0.0.0/0
HTTP: ::/0
HTTPS: ::/0
SSH: ::/0
The current outbound rule is:

AllTrafic: 0.0.0.0/0
What are the best practices for managing these rules?

Website: https://runtobuy.com/

Answer

Hi, you should limit 0.0.0.0/0 and 0.0.0.0::0 to http(s). ssh should be reserved to controlled addresses: ip of admins.

More importantly, you should probably introduce AWS Web Application Firewall (aka WAF) to better protect your site: see https://aws.amazon.com/waf/

This video is also a good place to start: https://www.youtube.com/watch?v=FdJ4fKMMTIE

Best,

Didier

Relevant content