ALB Security Group

Question

sg-06ea94777d82c3725 (Default) 	--> -- All TCP	TCP	0 - 65535	0.0.0.0/0  
sg-0a3806b0e18149559 		--> -- All TCP	TCP	0 - 65535	sg-06ea94777d82c3725

we have an API gateway with VPC link using the Security Group sg-0a3806b0e18149559
and The ALB which is using security group sg-06ea94777d82c3725 and the i-005fc7b88c9b2826a instance as target group
the i-005fc7b88c9b2826a has the security group sg-0a3806b0e18149559

Now i want to remove the 0.0.0.0/0 From the sg-06ea94777d82c3725 but it is not working if i removed

Behrens, Isaac · Answer

Best practice is to never use the default SG -- Always create your own SGs that have the specific least-privilege access for your use case.

What is not working when you remove the 0.0.0.0/0 rule?  I assume that the ALB gets no traffic, which would make sense as that rule is allowing the traffic in.

Appropriate basic rule for a public ALB would be TCP port 443 from 0.0.0.0/0 and enable redirect 80->443.

If you are wanting to allow only traffice from a single IP (allow list a single customer or such), replace the 0.0.0.0/0 with a specific IP a.b.x.y/32.

If you are wanting to make it private to only the VPC traffice, recommend a Private ALB but you could also update the 0.0.0.0/0 to the VPC CIDR.

Again, be careful changing the default SG.  If you are using it here, you may be using it elsewhere as well and have unintended effects when you change it.  Hence the best practice of using unique SGs for each workload.

Hope this helps!

ALB Security Group

Add your answer

Relevant content