Question

A financial services company runs a three-tier application in a single VPC: web instances in public subnets, application instances in private subnets, and an Amazon RDS instance in isolated subnets. Security requires that application instances only accept traffic from the web tier on TCP 8080, and RDS only accept traffic from the application tier on TCP 5432. The Auto Scaling groups for the web and app tiers frequently launch and terminate instances with changing private IPs. The security team wants a configuration that stays correct automatically as instances scale, without maintaining IP lists, and that only permits the required flows. Which approach best meets these requirements?

Accepted Answer

In the app-tier security group, allow inbound TCP 8080 from the web-tier security group ID; in the RDS security group, allow inbound TCP 5432 from the app-tier security group ID.

Answer

Configure network ACLs on each subnet to allow the required ports from the source subnet CIDRs and deny all other traffic, updating CIDRs whenever subnets change.

Answer

In each security group, allow inbound traffic on the required port from the VPC CIDR range so all tiers can communicate as instances scale.

Answer

Create a Lambda function triggered by Auto Scaling lifecycle hooks that adds and removes the launched instances' private IPs in the downstream security groups on the required ports.